title: How to modify a WCF message header's MustUnderstand using ClientInspector
body: <p>I am calling a non-WCF service from a WCF client. The WCF client includes the "MustUnderstand" header attribute set to "1". Here's a typical SOAP request:</p>
  
  <pre><code>&lt;s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt;
  &lt;s:Header&gt;
      &lt;o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt;
          &lt;u:Timestamp u:Id="_0"&gt;
              &lt;u:Created&gt;2010-08-23T20:48:52.680Z&lt;/u:Created&gt;
              &lt;u:Expires&gt;2010-08-23T20:53:52.680Z&lt;/u:Expires&gt;
          &lt;/u:Timestamp&gt;
          &lt;o:UsernameToken u:Id="uuid-72ea0c0a-43aa-43b2-bed7-c2da13624105-1"&gt;
              &lt;o:Username&gt;blablabla&lt;/o:Username&gt;
              &lt;o:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText"&gt;blablabla&lt;/o:Password&gt;
          &lt;/o:UsernameToken&gt;
      &lt;/o:Security&gt;
  &lt;/s:Header&gt;
  &lt;s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"&gt;
      &lt;HeartbeatRequest xmlns="http://removed"&gt;
          &lt;DateTime xmlns=""&gt;8/23/2010 4:48:51 PM&lt;/DateTime&gt;
          &lt;Message xmlns=""&gt;123&lt;/Message&gt;
      &lt;/HeartbeatRequest&gt;
  &lt;/s:Body&gt;
  </code></pre>
  
  <p></p>
  
  <p>Now, here's the response I get back for this.</p>
  
  <pre><code>&lt;soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"&gt;
  &lt;soapenv:Header&gt;
      &lt;Misunderstood qname="o:Security" xmlns="http://www.w3.org/2002/06/soap-faults" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" /&gt;
  &lt;/soapenv:Header&gt;
  &lt;soapenv:Body&gt;
      &lt;soapenv:Fault xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"&gt;
          &lt;faultcode&gt;soapenv:MustUnderstand&lt;/faultcode&gt;
          &lt;faultstring&gt;WSWS3173E: Error: Did not understand &amp;quot;MustUnderstand&amp;quot; header(s):{http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}Security&lt;/faultstring&gt;
      &lt;/soapenv:Fault&gt;
  &lt;/soapenv:Body&gt;
  </code></pre>
  
  <p></p>
  
  <p>Note the part about MustUnderstand not being understood.</p>
  
  <p>The owner of this service has indicated that they allow elements that have the WSSE namespace prefix but aren't actually in the XSD, and do some other processing that would prevent them from accepting MustUnderstand="1" so I have to find a way to send messages with MustUnderstand="0".</p>
  
  <p>I tried to change this in the MessageContract for the proxy client using a MessageHeader attribute, but that didn't help.</p>
  
  <p>Next, I implemented a custom client message inspector. I created classes per MSDN for a custom Behavior Extension Element and an IEndpointBehavior, these are trivial but here for completeness:</p>
  
  <pre><code>    public class ExClientBehavior : IEndpointBehavior
  {
      #region IEndpointBehavior Members
  
      public void AddBindingParameters(ServiceEndpoint endpoint, BindingParameterCollection bindingParameters)
      {
          // no op
      }
  
      public void ApplyClientBehavior(ServiceEndpoint endpoint, ClientRuntime clientRuntime)
      {
          ExInspector inspector = new ExInspector();
          clientRuntime.MessageInspectors.Add(inspector);
      }
  
      public void ApplyDispatchBehavior(ServiceEndpoint endpoint, EndpointDispatcher endpointDispatcher)
      {
          // no op
      }
  
      public void Validate(ServiceEndpoint endpoint)
      {
          // no op
      }
  
      #endregion
  }
  
  
      public class ExClientBehaviorExtensionElement : BehaviorExtensionElement
  {
      public override Type BehaviorType
      {
          get { return typeof(ExClientBehavior); }
      }
  
      protected override object CreateBehavior()
      {
          return new ExClientBehavior();
      }
  }
  </code></pre>
  
  <p>and now the actual Inspector:</p>
  
  <pre><code>    public class ExInspector : IClientMessageInspector
  {
  
      #region IClientMessageInspector Members
  
      public void AfterReceiveReply(ref Message reply, object correlationState)
      {
          // no op
          return;
      }
  
      public object BeforeSendRequest(ref Message request, IClientChannel channel)
      {
          MessageBuffer buffer = request.CreateBufferedCopy(int.MaxValue);
  
          Message newMessage = buffer.CreateMessage();
  
          newMessage.Headers.RemoveAt(0);
  
          newMessage.Headers.Add(MessageHeader.CreateHeader
              (
                  request.Headers[0].Name,
                  request.Headers[0].Namespace,
                  string.Empty,
                  false,
                  string.Empty,
                  request.Headers[0].Relay
              )
          );
  
          request = newMessage;
  
          return null;
      }
  
      #endregion
  }
  </code></pre>
  
  <p>As you see, I am creating a new request via buffered copy, then deleting the security header (there is only one header) and adding a new one with MustUnderstand set to false (why am I doing this? MessageHeader.MustUnderstand is read-only). I set a breakpoint in this method and indeed, the new header is added, the newMessage is written back to the request, and both newMessage.Headers[0].MustUnderstand as well as request.Headers[0].MustUnderstand are false at the end of this method.</p>
  
  <p>However, the message that is sent to the service still includes MustUnderstand="1" on the header!!!!!</p>
  
  <p>Here's the app.config that includes the behavior above:</p>
  
  <pre><code>&lt;configuration&gt;
  &lt;system.serviceModel&gt;
      &lt;bindings&gt;
          &lt;basicHttpBinding&gt;
              &lt;binding name="WebServiceSOAP" closeTimeout="00:01:00" openTimeout="00:01:00"
                      receiveTimeout="00:10:00" sendTimeout="00:01:00" allowCookies="false"
                      bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
                      maxBufferSize="65536" maxBufferPoolSize="524288" maxReceivedMessageSize="65536"
                      messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered"
                      useDefaultWebProxy="true"&gt;
                  &lt;readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384" maxBytesPerRead="4096" maxNameTableCharCount="16384" /&gt;
                  &lt;security mode="TransportWithMessageCredential"&gt;
                      &lt;transport clientCredentialType="Basic" proxyCredentialType="None" realm="" /&gt;
                      &lt;message clientCredentialType="UserName" algorithmSuite="Default" /&gt;
                  &lt;/security&gt;
              &lt;/binding&gt;
          &lt;/basicHttpBinding&gt;
      &lt;/bindings&gt;
      &lt;client&gt;
          &lt;endpoint
                  address="https://removed"
                  behaviorConfiguration="ovrExClientBehavior"
                  binding="basicHttpBinding"
                  bindingConfiguration="WebServiceSOAP"
                  contract="EWebService.EWebService"
                  name="WebServiceSOAP" /&gt;
      &lt;/client&gt;
      &lt;extensions&gt;
          &lt;behaviorExtensions&gt;
              &lt;add name="exClientBehavior" type="ExMessageInspector.ExClientBehaviorExtensionElement, ExMessageInspector, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"/&gt;
          &lt;/behaviorExtensions&gt;
      &lt;/extensions&gt;
      &lt;behaviors&gt;
          &lt;endpointBehaviors&gt;
              &lt;behavior name="ovrExClientBehavior"&gt;
                  &lt;exClientBehavior /&gt;
              &lt;/behavior&gt;
          &lt;/endpointBehaviors&gt;
      &lt;/behaviors&gt;
  &lt;/system.serviceModel&gt;
  </code></pre>
  
  <p></p>
  
  <p>So my question: is it possible to change MustUnderstand on an outgoing message like above, or in a similar manner? Or is it forcibly being changed back to true later in the pipeline, after the inspector replaces the security header?</p>
  
  <p>Note: the service owner says that they are only aware of one other organization consuming this service in .NET, and that that consumer had to essentially throw out WCF and WSE and create SOAP messages - and handle the replies - from scratch, probably using POX POSTs or some such. We would really prefer to avoid this since we need to call a number of operations on the service.</p>
  
  <p>Also, we need to preserve the body and properties of the message intact.</p>
  
  <p>Any help would be really appreciated!!</p>