Does a WCF service get called from the IIS server hosting the silverlight XAP or directly from the client's browser? If you were to put your WCF services on a server closer to your database (and not the same server as your Silverlight / ASP.NET page), would the WCF server's ports need to be opened to the world?
It may be sound like a simple answer, but really it's not as obvious as it sounds for example:
- ClientAccessPolicy.xml
This file helps you control which domains have access to call your WCF service. Here is a very basic example of how you can restrict access to only those applications running under your desired domain. This permits someone running your Silverlight application from both a secure and a non-secure url.
<?xml version="1.0" encoding="utf-8"?> <access-policy> <cross-domain-access> <policy> <allow-from http-request-headers="*"> <domain uri="https://www.yourwebsite.com"/> <domain uri="http://www.yourwebsite.com"/> </allow-from> <grant-to> <resource path="/" include-subpaths="true"/> </grant-to> </policy> </cross-domain-access> </access-policy>
Sounds as if the call goes back to the web server which hosts the Silverlight application and then to the WCF service.
Additional: I understand that I may not have communicated my question well.
If you have a server that you use for your WCF server (Server A) and a server hosting your Silverlight application (Server B)
Does your client directly call Server A or does it make a request to Server B which is used as a proxy to communicate with Server A?
Server A is on one domain, Server B is on another domain, and Client is through the internet.