WCF Rest - mixing HTTP and HTTPS in one ServiceContract

Question

I currently have a Http Rest WCF4 service, defined by the ServiceContract IEventService which is exposed only over HTTP.

I have been tasked with making some of the OperationContracts to work only over HTTPS So I have split those methods into a seperate ServiceContract called IEventServiceHTTPS

Hosting this on my dev box using IIS7.5 with a self-signed certificate, the methods which are part of the IEventServiceHTTPS are called fine over HTTPS and not over HTTP, as expected.

However the HTTP methods exposed by IEventService now do not work.

I get the following when trying to access the HTTP methods:

HTTP Error 403.4 - Forbidden
The page you are trying to access is secured with Secure Sockets Layer (SSL).

web.config with my changes:

<system.serviceModel>
    <serviceHostingEnvironment multipleSiteBindingsEnabled="true" aspNetCompatibilityEnabled="true">
      <serviceActivations>
        <add service="Api.EventService" relativeAddress="EventService.svc" factory="Api.UnityServiceHostFactory"/>
      </serviceActivations>
    </serviceHostingEnvironment>
    <behaviors>
      <serviceBehaviors>
        <behavior name="Api.EventServiceBehavior">
          <serviceMetadata httpGetEnabled="true" httpsGetEnabled="true"/>
          <serviceDebug includeExceptionDetailInFaults="true"/>
        </behavior>
      </serviceBehaviors>
      <endpointBehaviors>
        <behavior name="WebBehavior">
          <webHttp/>
        </behavior>
      </endpointBehaviors>
    </behaviors>
    <services>
      <service behaviorConfiguration="Api.EventServiceBehavior" name="Api.EventService">
        <endpoint address="" binding="webHttpBinding" behaviorConfiguration="WebBehavior" bindingConfiguration="webBindingHTTP" contract="Api.IEventService"/>
        **<endpoint address="" binding="webHttpBinding" behaviorConfiguration="WebBehavior" bindingConfiguration="webBindingHTTPS" contract="Api.IEventServiceHTTPS"/>**
      </service>
    </services>
    <bindings>
      <webHttpBinding>
        <binding name="webBindingHTTP">
          <security mode="None"></security>
        </binding>
        **<binding name="webBindingHTTPS">
          <security mode="Transport">
          </security>
        </binding>**
      </webHttpBinding>
    </bindings>
  </system.serviceModel>

Any help would be greatly appreciated, thanks.

Answer 1

I believe this error is originating because of IIS vdir [SSL settings]-> Require SSL -> true. If you want both http and https endpoints accessible in the same service then uncheck this setting as this will prevent you from doing unsecure http in the vdir.