In the Internet scenario, the clients or services may not be using WCF, or even Windows. If you are writing an Internet service or client, you cannot assume the use of WCF on the other end. In addition, an Internet application typically has a relatively large number of clients calling the service. These client calls originate from outside the firewall. You need to rely on HTTP for transport, and multiple intermediaries are possible. In an Internet application, you typically do not want to use Windows accounts and groups for credentials; instead, the application needs to access some custom credentials store. That said, you could still be using Windows security, as demonstrated later.
In an Internet application, you must use Message
security for the transfer security mode to provide for end-to-end
security across all intermediaries. The client should provide
credentials in the form of a username and password, as this is a safe,
low common denominator that all platforms support. For the Internet
scenario, you should use the
WSHttpBinding. You cannot use the basic
binding because it does not provide for username credentials over
Message security. In addition, if you have an intranet application
that uses the
NetTcpBinding but you
do not wish to use Windows security for user accounts and groups, you
should follow the same configuration as with the WS-based binding.
This is done uniformly across these bindings by selecting