Transfer Security Mode in WCF – Easy WCF
Skip to content

Transfer Security Mode in WCF

There are 3 ways to secure the client server secured communication.

  1. Message integrity – it ensures that message used in communication is not tampered by any malicious party.
  2. Message privacy – It ensures confidentiality of the msessage so that no third part can even read the message.
  3. Transfer security – it ensures that only authenticated user can able to read the content of the message.

WCF supports five different modes of transfer security to accomplish above three aspects.

  • No Transfer security mode
  • Transport Security mode
  • Message Security mode
  • Mixed transfer security mode
  • both security mode

No transfer security mode:

When system is configured with ‘None’ mode,this ensure that no security is applied while communication between server and client


Transport security mode:

When system is configured with ‘Transport’ mode, WCF uses secured communication protocol.

The available secure transports are HTTPS, TCP, IPC and MSMQ. Transport security encrypts all communication on the channel and provides integrity, privacy and mutual authentication. It provides point-to-point security.

It is mainly used in intranet application


Message security mode:

In this mode of configuration, message will get encrypted.

Encrypting the message rather than transport enables the service to communicate securely over non secure transport such as HTTP. It provides end-to-end security.

It may introduce call latency due to its inherent overhead, that is the disadvantage of Message security mode.

It is mainly used in internet application.


Mixed transfer security mode:

It uses Transport security for message integrity, privacy and service authentication and it uses Message security for securing client credential.

Mixed mode  will secure only point-to-point as nature of Transport security.


Both security modes:

This mode Both transfer security mode uses both Transport security and Message security.

So message is secured using Message security and then it is transferred to the service using secure transport.

This mode will maximize the security but overload the performance.


Name None Transport Message Mixed Both
BasicHttpBinding Yes(default) Yes Yes Yes No
NetTcpBinding Yes Yes(default) Yes Yes No
NetNamedPipeBinding Yes Yes(default) No No No
WsHttpBinding Yes Yes Yes(default) Yes No
WsDualHttpBinding Yes No Yes(default) No No
NetMsmqHttpBinding Yes Yes Yes(default) No Yes

© 2015, admin. All rights reserved.

Leave a Reply

Your email address will not be published. Required fields are marked *