title: How does WCF Client retain login session
body: <p>I have a WCF client connecting to a WCF Service hosted in IIS via WsHttpBinding with Message level security and UserName client credential type.</p>
  
  <p>In the client, I specify my username and password in an instance of the generated proxy class representing the service. The one proxy instance is used for all subsequent calls, and the service authenticates these credentials in the custom validator either when I explicitly call Open() or when I make my first call on the service. The validation is only made on this initial call, and not on subsequent calls. e.g.:</p>
  
  <pre><code>   var client = new MyServiceClient();
      client.ClientCredentials.UserName.UserName = "username";
      client.ClientCredentials.UserName.Password = "password";        client.ClientCredentials.ServiceCertificate.Authentication.CertificateValidationMode =   
  X509CertificateValidationMode.None;
      client.GetStuff1(); // authentication is made here
      client.GetStuff2(); // already authenticated, no further authentication. Why/How?
      client.GetStuff3(); // already authenticated, no further authentication. Why/How?
  </code></pre>
  
  <p>How is this session maintained? How can I configure the server and/or client so that authentication is done on each call rather than the "session" that seems to exist? Is this not determined by the <code>&lt;reliableSession&gt;</code> which I have off?</p>
  
  <p>The service class is defined with these attributes:</p>
  
  <pre><code>[ServiceBehavior(IncludeExceptionDetailInFaults = true, AutomaticSessionShutdown = false, InstanceContextMode = InstanceContextMode.Single, ConcurrencyMode = ConcurrencyMode.Multiple)]
  </code></pre>
  
  <p>The client's app.config is as follows:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="utf-8" ?&gt;
  &lt;configuration&gt;
      &lt;system.serviceModel&gt;
          &lt;bindings&gt;
              &lt;wsHttpBinding&gt;
                  &lt;binding name="wsHttpBindingWithAuth" closeTimeout="00:01:00"
                      openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
                      bypassProxyOnLocal="false" transactionFlow="false" hostNameComparisonMode="StrongWildcard"
                      maxBufferPoolSize="524288" maxReceivedMessageSize="200000000"
                      messageEncoding="Text" textEncoding="utf-8" useDefaultWebProxy="true"
                      allowCookies="false"&gt;
                      &lt;readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
                          maxBytesPerRead="4096" maxNameTableCharCount="16384" /&gt;
                      &lt;reliableSession ordered="true" inactivityTimeout="00:10:00"
                          enabled="false" /&gt;
                      &lt;security mode="Message"&gt;
                        &lt;!--
                          &lt;transport clientCredentialType="Windows" proxyCredentialType="None"
                              realm="" /&gt; --&gt;
                          &lt;message clientCredentialType="UserName" negotiateServiceCredential="true"
                              algorithmSuite="Default"/&gt;
                      &lt;/security&gt;
                  &lt;/binding&gt;
              &lt;/wsHttpBinding&gt;
          &lt;/bindings&gt;
          &lt;client&gt;
              &lt;endpoint address="http://testmachine/MyService.svc"
                  binding="wsHttpBinding" bindingConfiguration="wsHttpBindingWithAuth"
                  contract="NewServiceIIS.IMyService" name="wsHttpBindingWithAuth"&gt;
                  &lt;identity&gt;
                    &lt;certificate encodedValue="ZZZZ" /&gt;
                  &lt;/identity&gt;
              &lt;/endpoint&gt;
          &lt;/client&gt;
      &lt;/system.serviceModel&gt;
  &lt;/configuration&gt;
  </code></pre>