is authentication using UserNamePasswordValidator in WsHttpBinding using message security is Safe?

Question

Basically i have a web application and Wcf services with usernamepassword validator using WSHttpBinding using message security. Once the service client is validated, i am storing the client in Session, to access the all other web methods in side the service.

Whether this approach is correct ? or should i use security token service ?

Please advise me.

Thanks

Answer 1

This is a viable approach and one that we use extensively, but you should take great care when using it.

We always encrypt our passwords in the client app and decrypt in the WCF service or, better yet, compare with the user's previously encrypted password if we control the password store even if the communication is via HTTPS.