title: WCF and wsHttpBinding - Message encryption
body: <p>I'm working on a client-server project implemented using <code>WCF</code>. The clients are deployed on different machines and communicate with services through the internet. I'm relatively new to <code>WCF</code>, and am a bit confused on choosing the appropriate binding for my Web services. The clients need to be authorized to perform operations, however, I'm implementing my own authentication algorithm and trying to avoid Windows authentication for various reasons, but I still need to make sure the message transferred in the channel is encrypted.</p>
  
  <p>Right now I'm using <code>wsHttpBinding</code> with security mode set to <code>Message</code>. Full configuration looks like this:</p>
  
  <p><img src="https://i.stack.imgur.com/B4dRE.png" alt="enter image description here"></p>
  
  <p>I've set the authentication type in <code>IIS</code> to <code>Anonymous Authentication</code> to make sure the requests are passed through, and was expecting a service call to fail since <code>MessageClientCredentialType</code> in my binding is explicitly set to <code>Windows</code>. However, when I run the code, the service successfully gets called and returns the expected values. I have a feeling that I'm missing something - why is the call authorized? Can I make sure the message is still encrypted even though authentication type is set to <code>Anonymous</code>? Any help is appreciated.</p>
  
  <h2>Edit</h2>
  
  <p>To clarify on this, I tested the service with a client deployed to a machine outside the network on a different domain.</p>