I have public WCF web service which works over https. There are lots of technical restrictions on client side, so I can't use any advanced schemes like oauth. I have registered users and some of them can access WCF service using their credentials. Should client pass credentials with every request or I can design login method which generates some token that can be used to access my service? Which is more secure? What are the requirments for token?

  • preventing replay attacks is one thing you may want to consider... – goodguys_activate Feb 20 '15 at 13:52
  • @makerofthings7 as far as I know https is not replayable, is it? – vsevolod Feb 21 '15 at 7:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.