title: How secure is WCF wsHttpBinding's Windows authentication?
body: <p>I have created WCF and I have used wsHttpBinding and MTOM as message transport with authentcation as "Windows". </p>
  
  <p>Now my service is not current SECURE, its plain HTTP, running on custom port.</p>
  
  <p>Is Windows Authentication of WCF's wsHttpBinding secure? can anyone see the password or guess through network trace?</p>
  
  <p>Environment Information:</p>
  
  <ol>
  <li>Hosted on Internet</li>
  <li>No Active Directory, its single server</li>
  <li>Connecting from my office with server's admin username and password</li>
  <li>On the client side, Password is not mentioned in config file, it is entered at runtime. It works correctly becausing entering wrong credentials returns some sort of security exception as well.</li>
  <li>Running .NET 4.0, on custom port 89, currently I have set following configuration in app.config of my custom windows service, I am hosting my WCF inside custom windows service installed as Local Service. I have enabled impersonation on each method.</li>
  </ol>
  
  <p>Here is the app.config</p>
  
  <pre><code>  &lt;system.serviceModel&gt;
      &lt;behaviors&gt;
        &lt;serviceBehaviors&gt;
          &lt;behavior name="metaAndErrors"&gt;
            &lt;serviceMetadata httpGetEnabled="true" /&gt;
            &lt;serviceDebug includeExceptionDetailInFaults="true" /&gt;
            &lt;dataContractSerializer maxItemsInObjectGraph="2147483647"/&gt;
            &lt;serviceAuthorization impersonateCallerForAllOperations="true"/&gt;
          &lt;/behavior&gt;
        &lt;/serviceBehaviors&gt;
      &lt;/behaviors&gt;
      &lt;services&gt;
        &lt;service name="CustomServiceHost.CustomService"
                 behaviorConfiguration="metaAndErrors"
                 &gt;
              &lt;endpoint address="" binding="wsHttpBinding"
                    bindingConfiguration="wsHttpLargeBinding"
                    contract="CustomServiceHost.ICustomService"/&gt;
          &lt;endpoint address="mex" binding="mexHttpBinding"
                    contract="IMetadataExchange" /&gt;
          &lt;host&gt;
            &lt;baseAddresses&gt;
              &lt;add baseAddress="http://localhost:89/CustomService" /&gt;
            &lt;/baseAddresses&gt;
          &lt;/host&gt;
        &lt;/service&gt;
      &lt;/services&gt;
      &lt;bindings&gt;
        &lt;wsHttpBinding&gt;
          &lt;binding
            name="wsHttpLargeBinding" messageEncoding="Mtom"
            maxReceivedMessageSize="2147483647"&gt;
            &lt;readerQuotas maxArrayLength="512000"/&gt;
          &lt;/binding&gt;
        &lt;/wsHttpBinding&gt;
      &lt;/bindings&gt;
    &lt;/system.serviceModel&gt;
  </code></pre>
  
  <p>Following is client configuration done at runtime,</p>
  
  <pre><code>        WSHttpBinding binding = new WSHttpBinding();
  
          binding.Security.Message.ClientCredentialType 
              = MessageCredentialType.Windows;
          binding.Security.Mode = SecurityMode.Message;
  
          binding.MessageEncoding = WSMessageEncoding.Mtom;
  
          binding.ReaderQuotas.MaxArrayLength = 512000;
  
          CustomServiceClient cc = new CustomServiceClient(
              binding,
              new EndpointAddress(string.Format(
                  "http://{0}:89/CustomService", 
                  host.ServerHost))
              );
  
          cc.ClientCredentials.Windows.AllowedImpersonationLevel 
              = System.Security.Principal.TokenImpersonationLevel.Impersonation; 
          cc.ClientCredentials.Windows.ClientCredential 
              = new NetworkCredential(host.Username, host.Password);
  </code></pre>
  
  <p>Thank you,
  - Akash</p>