title: How do I build a secure webservice with .Net?
body: <p>I need to build a simple webservice to get data in and out of a HR System over the Internet (it's a hosted solution). I am using IIS and ASP.Net with .Net 2.0.</p>
  
  <p>Having looked into it, there are several ways of making the webservice secure - I am after some advice on which method to choose, with some views on pros and cons. </p>
  
  <p>These are the methods I am aware of:</p>
  
  <h2>SoapHeaders over SSL</h2>
  
  <p>Post the UID/PWD in a Soap header and implement a SOAP extension (<a href="https://stackoverflow.com/questions/130427/call-a-certain-method-before-each-webservice-call">link</a>).<br>
  Pretty straightforward to implement and should be quite secure over SSL. This is by far my preferred option due to the relative simplicity. Also, for historical reasons, I will need to consume the webservice from VBScript of all things, so the ability to just deal with simple SOAP is a bonus.
  <em>However, are there any caveats? Am I going to have clients complaining this is a security risk?</em> </p>
  
  <h2>Using WCF with TransportWithMessageCredential</h2>
  
  <p>I found a lot of old articles referring to WS and if I am not misstaken, this is what is now provided in WCF? <a href="http://msdn.microsoft.com/en-us/library/ms789011.aspx" rel="nofollow noreferrer">This Microsoft link</a> has a primer.<br>
  If I understand it correctly, this uses certificate-based security between client and server for authentication. Is this correct or have I got it completely wrong?<br>
  I suspect this will be a much bigger job, at least implementation wise. Also, I won't be able to access the Webservice directly from VBScript, so will have to write a dll it call call and then deploy that locally - correct?<br>
  Is this even available in .Net 2.0?</p>
  
  <h2>Other methods</h2>
  
  <ul>
  <li>I could disallow anonymous access to
  the asmx file and use rely on IIS to
  do authentication through
  challenge/response. This is actually
  practical in my scenario but feels
  very inelegant (and no idea how to
  make that work from VBScript either).</li>
  <li>Passing in a UID to the method call
  is a poor cousin of the SoapHeader so
  I won't use that.</li>
  </ul>
  
  <p><em>I would be very grateful for any advice on the best approach to this problem. If anyone has a good argument why Soap Headers are secure then I would love to hear it, as that seems like the simplest to use, as long as it is "secure enough"</em>. </p>