title: What are the impacts of setting establishSecurityContext="False" if i use https?
body: <p>My WFC service uses wsHttpBinding configured with:</p>
  
  <pre><code>&lt;security mode="TransportWithMessageCredential"&gt;
      &lt;message establishSecurityContext="True" clientCredentialType="UserName"/&gt;
      &lt;transport clientCredentialType="None" proxyCredentialType="None"/&gt;
  &lt;/security&gt;
  </code></pre>
  
  <p>One of our partner is trying to invoke our services using the java the Metro library. They have <a href="http://social.msdn.microsoft.com/forums/en-US/wcf/thread/f11d0045-e00d-4c76-8a72-562077826565/" rel="noreferrer">this</a> problem. I have to set establishSecurityContext="False" for this to work. We did a quick test and it works indeed when I set it to false. </p>
  
  <p>What would be the impacts of not using secure sessions (by setting establishSecurityContext="False"). I'm already running on https. So will I be OK in terms of security? And are there other impacts to consider (performance maybe)?</p>
  
  <p>Thanks</p>