We Keep Coding

WCF - HTTPS - Transport security works but message security throws exception on application startup

I have a WCF self hosted server (a console application which registers the wcf contract with castle ioc container AsWcfService). I need it to work securely over https.
When I configure the server to use wsHttpBinding with security mode=Transport and clientCredentialsType=None, everthing works fine.
The configurations looks as follows:
Transport Security Configuration
<behaviors>
<serviceBehaviors>
<behavior name="secureBehavior">
<serviceMetadata httpsGetEnabled="true" httpGetEnabled="false" />
<serviceDebug includeExceptionDetailInFaults="true" httpsHelpPageEnabled="true"/>
</behavior>
</serviceBehaviors>
</behaviors>
<bindings>
<wsHttpBinding>
<binding name="secureBinding" maxBufferPoolSize="2147483647" maxReceivedMessageSize="2147483647" sendTimeout="01:00:00">
<security mode="Transport" >
<transport clientCredentialType="None"/>
</security>
</binding>
</wsHttpBinding>
</bindings>
<services>
<service name="service" behaviorConfiguration="secureBehavior">
<endpoint binding="wsHttpBinding" bindingConfiguration="secureBinding" contract="Contract.Service" />
<host>
<baseAddresses>
<add baseAddress="https://domain-name:port-number/"/>
</baseAddresses>
</host>
</service>
</services>
The above works fine.
Message Security Configuration
<behaviors>
<serviceBehaviors>
<behavior name="secureBehavior">
<serviceMetadata httpsGetEnabled="true" httpGetEnabled="false" />
<serviceDebug includeExceptionDetailInFaults="true" httpsHelpPageEnabled="true"/>
</behavior>
</serviceBehaviors>
</behaviors>
<bindings>
<wsHttpBinding>
<binding name="secureBinding" maxBufferPoolSize="2147483647" maxReceivedMessageSize="2147483647" sendTimeout="01:00:00">
<security mode="Message" >
<message clientCredentialType="None"/>
</security>
</binding>
</wsHttpBinding>
</bindings>
<services>
<service name="service" behaviorConfiguration="secureBehavior">
<endpoint binding="wsHttpBinding" bindingConfiguration="secureBinding" contract="Contract.Service" />
<host>
<baseAddresses>
<add baseAddress="https://domain-name:port-number/"/>
</baseAddresses>
</host>
</service>
</services>
With message security configuration, however, when I try to start the server I get the following exception:
Could not find a base address that matches scheme http for the
endpoint with binding WSHttpBinding. Registered base address schemes
are [https]. System.InvalidOperationException: Could not find a base
address that matches scheme http for the endpoint with binding
WSHttpBinding. Registered base address schemes are [https].
I can't find the reason for this error anywhere I look.
An explanation would be highly appreciated.

How to listen self-hosted Azure Relay endpoint in both HTTP & HTTPS?

I'm trying to use Azure WCF Relays, creating my listener via a ServiceHost instance. It works well, but I can't make it work in both HTTP and HTTPS. I know it seems strange but that's a requirement I have.
Here is my code:
Uri httpUri = ServiceBusEnvironment.CreateServiceUri(Uri.UriSchemeHttp, "MYNAMESPACE", "TEST");
Uri httpsUri = ServiceBusEnvironment.CreateServiceUri(Uri.UriSchemeHttps, "MYNAMESPACE", "TEST");
WebServiceHost sh = new WebServiceHost(typeof(TestAPI), httpsUri, httpUri);
sh.Open();
And here is my conf:
<bindings>
<webHttpRelayBinding>
<binding name="https" maxBufferSize="2147483647" maxBufferPoolSize="2147483647" maxReceivedMessageSize="2147483647" transferMode="Streamed" sendTimeout="00:15:00">
<security mode="Transport" relayClientAuthenticationType="None"/>
</binding>
<binding name="http" maxBufferSize="2147483647" maxBufferPoolSize="2147483647" maxReceivedMessageSize="2147483647" transferMode="Streamed" sendTimeout="00:15:00">
<security mode="None" relayClientAuthenticationType="None"/>
</binding>
</webHttpRelayBinding>
</bindings>
<services>
<service name="TestAPI" behaviorConfiguration="default">
<endpoint name="MobileEndpointHttps" contract="ITestAPI" binding="webHttpRelayBinding" bindingConfiguration="https" behaviorConfiguration="sbTokenProviderTest" address="" />
<endpoint name="MobileEndpoint" contract="ITestAPI" binding="webHttpRelayBinding" bindingConfiguration="http" behaviorConfiguration="sbTokenProviderTest" address="" />
</service>
</services>
<behaviors>
<endpointBehaviors>
<behavior name="sbTokenProviderTest">
<webHttp/>
<serviceRegistrySettings discoveryMode="Public" />
<transportClientEndpointBehavior>
<tokenProvider>
<sharedAccessSignature keyName="RootManageSharedAccessKey" key="MYKEY"/>
</tokenProvider>
</transportClientEndpointBehavior>
</behavior>
</endpointBehaviors>
<serviceBehaviors>
<behavior name="default">
<serviceDebug httpHelpPageEnabled="false" httpsHelpPageEnabled="false"/>
<serviceMetadata httpGetEnabled="false" httpsGetEnabled="false" />
</behavior>
</serviceBehaviors>
</behaviors>
<serviceHostingEnvironment multipleSiteBindingsEnabled="true" />
The httpGetEnabled & httpsGetEnabled seems not required to make it work alone, so I disabled it to avoid the netsh warning.
With this config, I get the following error:
System.InvalidOperationException: The ChannelDispatcher at 'sb://mynamespace.servicebus.windows.net/TEST/' with contract(s) '"ITestAPI"' is unable to open its IChannelListener. --->
System.InvalidOperationException: A registration already exists for
Uri 'sb://mynamespace.servicebus.windows.net/TEST/'.
Is it at least possible ? Need your help :(

If you just create a single endpoint with security mode="None" and relayClientAuthenticationType="None" doesn't it accept traffic over both HTTP and HTTPS?

RESTful WCF (4.5.2) service errors with "413 Entity Request Too Large"

this seems to be a really common question - and I've read through a ton of comments here on SO and other sites. Problem is that even after fixing up my configuration I'm still getting the 413 error when sending an ~50K payload.
Here's the relevant portion of the service config...
<system.serviceModel>
<serviceHostingEnvironment multipleSiteBindingsEnabled="false" />
<services>
<service name="Sync.Inbound" behaviorConfiguration="serviceWebConfiguration">
<endpoint address="" binding="webHttpBinding" bindingName="defaultRest" behaviorConfiguration="web" contract="Sync.IInbound" />
</service>
</services>
<bindings>
<webHttpBinding>
<binding name="defaultRest" maxReceivedMessageSize="2147483647" maxBufferSize="2147483647" maxBufferPoolSize="2147483647" transferMode="Streamed">
<readerQuotas maxStringContentLength="2147483647" maxArrayLength="2147483647" maxBytesPerRead="2147483647" maxDepth="2147483647" maxNameTableCharCount="2147483647" />
<security mode="None" />
</binding>
</webHttpBinding>
</bindings>
<behaviors>
<endpointBehaviors>
<behavior name="web">
<webHttp />
<dataContractSerializer maxItemsInObjectGraph="2147483647" />
</behavior>
<behavior name="json">
<enableWebScript />
</behavior>
</endpointBehaviors>
<serviceBehaviors>
<behavior name="serviceWebConfiguration">
<serviceMetadata httpGetEnabled="true" />
</behavior>
</serviceBehaviors>
</behaviors>
I'm testing by calling this from a simple C# console application via an httpWebRequest... Anybody see anything I'm missing in the service config?

You need to set the bindingConfiguration attribute to "defaultRest" on the service endpoint element, otherwise the service will not use the specified binding configuration block.
The sample above shows the binding configuration name in a "bindingName" attribute rather than the "bindingConfiguration" attribute.
Therefore, you need to change:
<endpoint ... bindingName="defaultRest"
to:
<endpoint ... bindingConfiguration="defaultRest"
Example:
<system.serviceModel>
<serviceHostingEnvironment multipleSiteBindingsEnabled="false" />
<services>
<service name="Sync.Inbound" behaviorConfiguration="serviceWebConfiguration">
<endpoint address="" binding="webHttpBinding" bindingConfiguration="defaultRest" ...
</service>
</services>
<bindings>
<webHttpBinding>
<binding name="defaultRest" maxReceivedMessageSize="2147483647" maxBufferSize="2147483647" maxBufferPoolSize="2147483647" transferMode="Streamed">
<readerQuotas maxStringContentLength="2147483647" maxArrayLength="2147483647" maxBytesPerRead="2147483647" maxDepth="2147483647" maxNameTableCharCount="2147483647" />
<security mode="None" />
</binding>
</webHttpBinding>
</bindings>
Reference:
https://msdn.microsoft.com/en-us/library/ms733099(v=vs.110).aspx
bindingConfiguration vs bindingName

You might want to change up maxItemsInObjectGraph for your services dataContractSerializer to allow larger collections through.
<serviceBehaviors>
<behavior name="SecureServiceBehavior">
<serviceMetadata httpGetEnabled="true" httpsGetEnabled="false"/>
<serviceDebug includeExceptionDetailInFaults="true"/>
<dataContractSerializer ignoreExtensionDataObject="true" maxItemsInObjectGraph="2147483647"/>
<serviceTimeouts transactionTimeout="00:03:00"/>
<serviceThrottling maxConcurrentCalls="10" maxConcurrentSessions="10" maxConcurrentInstances="10"/>
</behavior>
</serviceBehaviors>

WCF: The remote server returned an error: (413) Request Entity Too Large [duplicate]

This question already has answers here:
(413) Request Entity Too Large | uploadReadAheadSize
(15 answers)
Closed 8 years ago.
I have a wcf service
there is a method which gets base64 string to upload a file my file's size 100kb it may be larger in time
i got the error message: The remote server returned an error: (413) Request Entity Too Large
while try to get HttpWebResponse
this is my wcf service web.config
<system.serviceModel>
<bindings>
<webHttpBinding>
<binding name="webHttpTransportSecurity" allowCookies="false" maxReceivedMessageSize="104857600">
<readerQuotas maxDepth="2147483647" maxStringContentLength="2147483647" maxArrayLength="2147483647"
maxBytesPerRead="2147483647" />
<security mode="Transport">
<transport clientCredentialType="None" />
</security>
</binding>
</webHttpBinding>
</bindings>
<services>
<service name="FHServices.FHSmartService" behaviorConfiguration="ServiceBehaviour">
<endpoint address="" binding="webHttpBinding" contract="FieldHoundServices.IFHSmartService" behaviorConfiguration="web">
</endpoint>
<host>
<baseAddresses>
<add baseAddress="http://localhost/FHServices/FHSmartService.svc/" />
</baseAddresses>
</host>
</service>
</services>
<behaviors>
<serviceBehaviors>
<behavior name="ServiceBehaviour">
<serviceMetadata httpGetEnabled="true" httpsGetEnabled="true" />
<serviceDebug includeExceptionDetailInFaults="true" />
</behavior>
</serviceBehaviors>
<endpointBehaviors>
<behavior name="web">
<webHttp />
</behavior>
</endpointBehaviors>
</behaviors>
<serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />
</system.serviceModel>
what is my mistake?
solved
i found my mistake
i remove these codes
<security mode="Transport">
<transport clientCredentialType="None" />
</security>
i think transport mode for https and we have no ssl so we dont need transport mode. anyway after i remove it, everything seems ok now

You don't assign a defined WebHttpBinding configuration to your endpoint, so the endpoint uses the default values for the binding.
You can tell the endpoint to use your binding congfiguration by specifying it in the bindingConfiguration attribute on the <endpoint> element, like this:
<endpoint address="" binding="webHttpBinding"
bindingConfiguration="webHttpTransportSecurity"
contract="FieldHoundServices.IFHSmartService"
behaviorConfiguration="web">
</endpoint>

HTTP and HTTPS Bindings

I have a application that consumes a WCF web service.
I have it cofigured to use a https binding. It works fine. I also wanted to add a HTTP binding to the same.
My requirement is if my client is on my domain (or on VPN) i need them to use the HTTP binding. and if they are external clients I want them to use HTTPS binding. How can I go about doing that? I am very new to WCF and this is my first try on it.
I have attached my Config File for reference. I did not know where to add the end point for the HTTP binding. Any help would be appriciated.
<system.serviceModel>
<services>
<service name="{service name}"
behaviorConfiguration="httpsBehavior">
<!--HTTPS END POINT-->
<endpoint address=""
binding="basicHttpBinding"
bindingConfiguration="SecureHTTPBinding"
contract="{service contract}" />
<!--METADATA ENDPOINT-->
<endpoint address="mex"
binding="mexHttpsBinding"
contract="IMetadataExchange" />
</service>
</services>
<behaviors>
<serviceBehaviors>
<behavior name="httpsBehavior">
<serviceMetadata httpsGetEnabled="true" httpsGetUrl="" />
<serviceDebug includeExceptionDetailInFaults="false"/>
</behavior>
<behavior name="httpBehavior">
<serviceMetadata httpGetEnabled="true"/>
<serviceDebug includeExceptionDetailInFaults="false"/>
</behavior>
</serviceBehaviors>
</behaviors>
<bindings>
<basicHttpBinding>
<!--HTTPS BINDING-->
<binding name="SecureHTTPBinding">
<security mode="Transport">
<transport clientCredentialType="None" />
</security>
</binding>
<!--HTTP BINDING-->
<binding name="BasicHttpBinding">
<security mode="None" />
</binding>
</basicHttpBinding>
</bindings>
EDIT : Adding netTCP Binding
<system.serviceModel>
<services>
<service name="{Service Name}"
behaviorConfiguration="httpsBehavior">
<!--HTTPS END POINT-->
<endpoint address="https://localhost/Service1.svc"
binding="basicHttpBinding"
bindingConfiguration="SecureHTTPBinding"
contract="{Service Contract}" name="httpsEndPoint"/>
<!--METADATA ENDPOINT-->
<endpoint address="mex"
binding="mexHttpsBinding"
contract="IMetadataExchange" />
<!--HTTP END POINT-->
<endpoint address="http://localhost/Service1.svc"
binding="basicHttpBinding"
bindingConfiguration="HttpBinding"
contract="{Service Contract}" name="httpsEndPoint"/>
<!--TCP METATADATA END POINT-->
<endpoint address="mextcp" binding="mexTcpBinding" contract="IMetadataExchange"/>
<host>
<baseAddresses>
<add baseAddress="net.tcp://localhost:808/Service1.svc" />
</baseAddresses>
</host>
<!--TCP ENDPOIN-->
<endpoint address="net.tcp://localhost:808/Service1.svc" binding="netTcpBinding" contract="{Service Contract}" name="netTCPEndPoint" />
</service>
</services>
<behaviors>
<serviceBehaviors>
<behavior name="httpsBehavior">
<serviceMetadata httpsGetEnabled="true" httpsGetUrl="" />
<serviceDebug includeExceptionDetailInFaults="true"/>
</behavior>
</serviceBehaviors>
</behaviors>
<bindings>
<basicHttpBinding>
<!--HTTPS BINDING-->
<binding name="SecureHTTPBinding" allowCookies="true"
maxReceivedMessageSize="20000000"
maxBufferSize="20000000"
maxBufferPoolSize="20000000">
<readerQuotas maxDepth="32"
maxArrayLength="200000000"
maxStringContentLength="200000000"/>
<security mode="Transport">
<transport clientCredentialType="None" />
</security>
</binding>
<!--HTTP BINDING-->
<binding name="HttpBinding" allowCookies="true"
maxReceivedMessageSize="20000000"
maxBufferSize="20000000"
maxBufferPoolSize="20000000">
<readerQuotas maxDepth="32"
maxArrayLength="200000000"
maxStringContentLength="200000000"/>
<security mode="None" />
</binding>
</basicHttpBinding>
<!--TCP BINDING-->
<netTcpBinding>
<binding transferMode="Buffered" />
</netTcpBinding>
</bindings>
I am aware of the the possible Dos attacks wrt to the numbers in the code and I would work around it. For now just wanted to get it working. When I use this config file I run into error that says
Could not find a base address that matches the scheme net.tcp for the endpoint MetadataExchageTcpBinding. Registered base addresses are [http,https]
Can some one help me expose a net.tcp binding for my service.
Any help would be appriciated

Use netTcpBinding for your domain clients. Your network firewall will almost certainly block raw TCP traffic by default while letting in HTTP traffic, so it will naturally ensure that each client goes to the appropriate endpoint. You may very well get an extra performance boost for domain clients into the bargain.
If you don't want to do that (e.g. your WCF host doesn't support it, or you have problems with VPN clients), then just expose one HTTPS endpoint for all clients regardless of location. The cost of SSL will be trivial compared to the overhead of doing a cross-network call in the first place.
Background:
netTcpBinding transmits data in a compact binary format, which is more efficient than sending XML text over HTTP. The downsides are: it is not compatible with non-.NET clients, and you have to open specific ports on the firewall to let it through. Neither of those issues will be a problem for your scenario though.
You can expose any number of endpoints in a WCF service, as long as they all have unique distinct combinations of Address/Binding/Contract. You can therefore expose both HTTPS and TCP endpoints to the same service because they will have different Addresses and Bindings.