Sending a clear text username token over unsecured HTTP transport

For a WCF service endpoint that uses the username authentication type, it requires, by default, the service endpoint to secure the service channel through either message-layer or transport-layer security. In other words, we need to either use the HTTPS transport protocol or message-layer signing and encryption to make the service endpoint able to transfer a username token. However, for some very special cases, we might need to send clear text username/password credentials (for username authentication) over an unsecured HTTP channel. Though this is not supported out of the box, there still exists some workarounds that can help us achieve this. Yaron Naveh has created ClearUsernameBinding, which successfully achieves this goal. Here we will demonstrate how to apply this ClearUsernameBinding in our own WCF HTTP service.

Getting ready

The full source code of ClearUsernameBinding and samples can be found at the following location...