I have created a service (WCF) that acts as a backend for a DB. For now it does basic operations such as INSERT, SELECT etc. I have run it locally and now it is time to expose her to the internet and enter 'production'. Is there a best practice to doing so? Bear in mind this service will be hosted on a PC as a Windows Service (not IIS). This is the first time I am putting a Windows Service into production so I am hazy on the details but I think this is the main idea:

  1. On the service: Check for 'rookie' errors such as SQL Injection. Set maximum message sizes to ones marginally higher than the largest message that should be transmitted by my service. Also upgrade self signed X.509 certificate to one issued by a CA. (Where does one store this certificate? Locally on the PC?)

  2. On the PC: Fully patched software (OS etc) and windows firewall with a specific set of rules that allows traffic only on the ports being used (I suppose the safest way to do this is to use the windows tool Allow a program or feature through Windows Firewall ?). Furthermore an updated antivirus running.

  3. On the Network: For the network router, port forward the respective ports being used (the base address is declared as http://localhost:8080 so I guess port 80 for HTTP and 443 for HTTPS? I am using message level Security.)

  4. General precautions: Full message logging on the service to analyze traffic and potential attackers. Also run a Network intrusion detection system such as Snort so that I can sleep a bit better at night.

Am I missing anything obvious?


I am new to WCF and creating these types of services in general so I am not sure if I am using the correct terminology.

I have throttled the service by setting an upper bound on the number of maximum concurrent calls, sessions & instances (I realise this does not explicitly protect from HTTP attacks but at least my system will not run out of memory and crash).

As far as I understand the methods in my service can only be called via a SOAP client with the service contracts pre-configured. I am not sure if an attacker can engineer these contracts. Furthermore it seems like anyone who knows the base address of my service can download the service reference and will therefore have the service contracts ready. (Solved: by disabling metadata exchange)

The binding which specifies the communication between endpoints is 'wsHttpBinding' with 'message' level security.

My question is is slightly different though, can the setup of 1,2,3 & 4 as specified above jeopardize the network in which the machine with this service is running?

  • Wait, wait, wait, you are placing a piece of code on the internet without a wbeserver in front of it. That is terrible. You will need to code inside your application defences against HTTP attacks. Get a webserver in front of it, do not run a production application with a listening port open to the internet. – grochmal Sep 6 '16 at 2:45
  • Care to elaborate? I guess this means I should use IIS? – Kafros Sep 6 '16 at 7:43
  • Yes, IIS would be the Microsoft option. But anything that is a proper webserver would do. You could run apache, cherokee, nginx, on a different box and use that as a reverse proxy to the one running the web service. Point being web frameworks are not meant to face the internet, webserver should face the internet. The internet is a bad and evil place where people do scan your servers for vulnerabilities. – grochmal Sep 6 '16 at 15:31
  • I have not read about this as a danger of hosting from a Windows Service before, but the clarification makes sense. I will host using IIS. – Kafros Sep 6 '16 at 15:33
  • @grochmal That is not good advice at all. Opening a service to the internet has 0 technical difference from opening a web server to the internet if the correct security protocols and standards are put in place for the non-HTTP service, which are absolutely implementable for a WCF service running outside of IIS. – Patrick Bell Sep 6 '16 at 18:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.