title: Securing WCF REST service for use with iPhone application
body: <p>I've a created a simple WCF REST service which I intend to consume from an iPhone application.
  The service works fine but now I'd like to secure it.</p>
  
  <p>In my test enviornment (IIS on Windows 7) I already setup a self signed certificate using makecert.exe.</p>
  
  <p>I also overridden the validate() method so I can use a custom username &amp; password (since windows authentication is out of the question).</p>
  
  <p>Now I'm stuck for more than two days figuring out how to configure everything so it can work.</p>
  
  <p>My goal now is to be able to do a simple GET request via the browser, something like: </p>
  
  <p><code>https://localhost/testservice/service1.svc/sayHello</code></p>
  
  <p>When this will work I'll continue on to all iPhone related stuff.</p>
  
  <p>Any help / examples will be highly appreciated!</p>
  
  <p>Here's my web.config:</p>
  
  <pre><code> &lt;system.serviceModel&gt;
  &lt;services&gt;
    &lt;service name="IphoneWcf.Service1" behaviorConfiguration="IphoneWcf.Service1Behavior"&gt;
      &lt;!-- Service Endpoints --&gt;
      &lt;endpoint address="" binding="basicHttpBinding" bindingConfiguration="webBinding" behaviorConfiguration="webBehavior" contract="IphoneWcf.IService1"&gt;
        &lt;!-- 
            Upon deployment, the following identity element should be removed or replaced to reflect the 
            identity under which the deployed service runs.  If removed, WCF will infer an appropriate identity 
            automatically.
        --&gt;
        &lt;identity&gt;
          &lt;dns value="localhost" /&gt;
        &lt;/identity&gt;
      &lt;/endpoint&gt;
      &lt;!--&lt;endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange"/&gt; --&gt;
      &lt;host&gt;
        &lt;baseAddresses&gt;
          &lt;add baseAddress="https://localhost/iphonewcf" /&gt;
        &lt;/baseAddresses&gt; 
       &lt;/host&gt;
    &lt;/service&gt;
  &lt;/services&gt;
  &lt;behaviors&gt;
    &lt;endpointBehaviors&gt;
      &lt;behavior name="webBehavior"&gt;
  
      &lt;/behavior&gt;
       &lt;/endpointBehaviors&gt;
    &lt;serviceBehaviors&gt;
      &lt;behavior name="IphoneWcf.Service1Behavior"&gt;
        &lt;!-- To avoid disclosing metadata information, set the value below to false and remove the metadata endpoint above before deployment --&gt;
        &lt;serviceMetadata httpsGetEnabled="false" /&gt;
        &lt;!-- To receive exception details in faults for debugging purposes, set the value below to true.  Set to false before deployment to avoid disclosing exception information --&gt;
        &lt;serviceDebug includeExceptionDetailInFaults="true" /&gt;
         &lt;serviceCredentials&gt;
          &lt;serviceCertificate findValue="localhost" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName" /&gt;
        &lt;/serviceCredentials&gt;
      &lt;/behavior&gt;
    &lt;/serviceBehaviors&gt;
  &lt;/behaviors&gt;
  &lt;bindings&gt;
    &lt;basicHttpBinding&gt;
      &lt;binding name="webBinding"&gt;
        &lt;security mode="Transport"&gt;
          &lt;transport clientCredentialType="Basic" /&gt;
        &lt;/security&gt;
     &lt;/binding&gt;
    &lt;/basicHttpBinding&gt;
  &lt;/bindings&gt;
  </code></pre>
  
  <p></p>
  
  <p>Thanks in advance!</p>