Best way for webservice security for a public application

[news.demon.nl]

Hi,

I hope someone can give me some advice on which form of security i can use
best in this scenario:

I have a free application that everbody on the internet can download.
It calls a webservice retrieve it's data. Currently it's not secured, so
anybody can use it.

I want to secure it, but the guy who owns the server does not want to make
use of windwos authentication, so that's not an option.

I would only like that my application can access the webservice. Which do
you think is the best way? (and perhaps i also need to use this for a
windows mobile application, is that also possible in your suggestion?)

I hope someone can give me some useful advice.

Greetings,
Jeroen

[Pablo Cibraro [MVP]]

Hi Jeroen,

I recommend you to take a look to the "Security Patterns for Web services"
guide. It was published by Microsoft, and it is available here
http://msdn.microsoft.com/library/en.../html/WSSP.asp

I think the simplest configuration for your scenario is the following:

1. Authentication :HTTP Transport authentication - Basic Authentication
2. Confidentiality: HTTPS Transport security

Regards,
Pablo Cibraro
http://weblogs.asp.net/cibrax

"news.demon.nl" <no@mailwrote in message
news:12*************@corp.supernews.com...

Hi,

I hope someone can give me some advice on which form of security i can use
best in this scenario:

I have a free application that everbody on the internet can download.
It calls a webservice retrieve it's data. Currently it's not secured, so
anybody can use it.

I want to secure it, but the guy who owns the server does not want to make
use of windwos authentication, so that's not an option.

I would only like that my application can access the webservice. Which do
you think is the best way? (and perhaps i also need to use this for a
windows mobile application, is that also possible in your suggestion?)

I hope someone can give me some useful advice.

Greetings,
Jeroen

[news.demon.nl]

thanks, i'll read that.

"Pablo Cibraro [MVP]" <pc******@hotmail.comschreef in bericht
news:%2******************@TK2MSFTNGP02.phx.gbl...

Hi Jeroen,

I recommend you to take a look to the "Security Patterns for Web services"
guide. It was published by Microsoft, and it is available here
http://msdn.microsoft.com/library/en.../html/WSSP.asp

I think the simplest configuration for your scenario is the following:

1. Authentication :HTTP Transport authentication - Basic Authentication
2. Confidentiality: HTTPS Transport security

Regards,
Pablo Cibraro
http://weblogs.asp.net/cibrax

"news.demon.nl" <no@mailwrote in message
news:12*************@corp.supernews.com...

>Hi,

I hope someone can give me some advice on which form of security i can
use best in this scenario:

I have a free application that everbody on the internet can download.
It calls a webservice retrieve it's data. Currently it's not secured, so
anybody can use it.

I want to secure it, but the guy who owns the server does not want to
make use of windwos authentication, so that's not an option.

I would only like that my application can access the webservice. Which do
you think is the best way? (and perhaps i also need to use this for a
windows mobile application, is that also possible in your suggestion?)

I hope someone can give me some useful advice.

Greetings,
Jeroen