What are the impacts of setting establishSecurityContext="False" if i use https?

Question

My WFC service uses wsHttpBinding configured with:

<security mode="TransportWithMessageCredential">
    <message establishSecurityContext="True" clientCredentialType="UserName"/>
    <transport clientCredentialType="None" proxyCredentialType="None"/>
</security>

One of our partner is trying to invoke our services using the java the Metro library. They have this problem. I have to set establishSecurityContext="False" for this to work. We did a quick test and it works indeed when I set it to false.

What would be the impacts of not using secure sessions (by setting establishSecurityContext="False"). I'm already running on https. So will I be OK in terms of security? And are there other impacts to consider (performance maybe)?

Thanks

Answer 1

The difference is that the on an non-SCT (security context token) enabled endpoint, key exchange and validation must be done per call as opposed to being done once and cached for the session and only a SCT passed around in the messages instead. SCTs are based on a symmetric key which makes them much more efficient for signing/encrypting the message. The use of a SCT is very good when the client is expected to make many calls in succession because it alleviates the need to do the exchange and validation of a one off key every time.

What I would recommend is that you just expose another endpoint for clients that don't support SCTs and tell them to use that. Clients that can use SCTs you keep pointed at the default endpoint and keep all the benefits that come with it.

For more on the subject, check out section three of the WS-SecureConversation documentation.