Using BasicHTTPBinding WCF service from Silverlight breaks when turning on security

Question

I'm trying to consume a BasicHTTPBinding WCF service (which is self-hosted in a .Net 4.0 console application) from Silverlight (v5). It all works fine when there's no transport encryption, but I'd like to wrap the traffic in a layer of SSL. There's no need for any kind of authentication.

With transport security turned on, I get the internal exception

{System.Security.SecurityException ---> System.Security.SecurityException: Security error. at System.Net.Browser.BrowserHttpWebRequest.InternalEndGetResponse(IAsyncResult asyncResult) at System.Net.Browser.BrowserHttpWebRequest.<>c_DisplayClassa.b_9(Object sendState) at System.Net.Browser.AsyncHelper.<>c_DisplayClass4.b_0(Object sendState) --- End of inner exception stack trace --- at System.Net.Browser.AsyncHelper.BeginOnUI(SendOrPostCallback beginMethod, Object state) at System.Net.Browser.BrowserHttp WebRequest.EndGetResponse(IAsyncResult asyncResult) at System.ServiceModel.Channels.HttpChannelFactory.HttpRequestChannel.HttpChannelAsyncRequest.CompleteGetResponse(IAsyncResult result)}

Here's the code:

Server - not working (with security)

baseAddress = new Uri("https://mysite.com:8080/myService"); 
BasicHttpBinding externalBinding = new BasicHttpBinding{                                                              MaxReceivedMessageSize = 1000000,
MaxBufferPoolSize = 1000000,
SendTimeout = TimeSpan.FromSeconds(30),
ReceiveTimeout = TimeSpan.FromSeconds(30),
Security = {Mode = BasicHttpSecurityMode.Transport}                                          
                                                   };

           externalBinding.Security.Transport.ClientCredentialType=HttpClientCredentialType.None;
host.AddServiceEndpoint(typeof(IPolicyRetriever), wsbinding, "").Behaviors.Add(new WebHttpBehavior());
host.AddServiceEndpoint(typeof(ImyServiceService), externalBinding, "myService");

Server working (no security)

baseAddress = new Uri("http://mysite.com:8080/myService"); 

BasicHttpBinding externalBinding = new BasicHttpBinding
{
MaxReceivedMessageSize = 1000000,
MaxBufferPoolSize = 1000000,
SendTimeout = TimeSpan.FromSeconds(30),
ReceiveTimeout = TimeSpan.FromSeconds(30)
                                   }    ;

host.AddServiceEndpoint(typeof(IPolicyRetriever), wsbinding, "").Behaviors.Add(new WebHttpBehavior());
host.AddServiceEndpoint(typeof(ImyServiceService), externalBinding, "myServiceService");

SL client not working (with security)

EndpointAddress address = new EndpointAddress("https://mysite.com:8080/myService");
BasicHttpBinding binding = new BasicHttpBinding(BasicHttpSecurityMode.Transport);                                  
client = new myServiceServiceReference.myServiceServiceClient(binding, address);

SL client working (no security)

EndpointAddress address = new EndpointAddress("http://mysite.com:8080/myService");
BasicHttpBinding binding = new BasicHttpBinding();                           
client = new myServiceServiceReference.myServiceServiceClient(binding, address);

clientaccesspolicy.xml

<xml version=""1.0"" encoding=""utf-8""?>
<access-policy>
 <cross-domain-access>
   <policy>
    <allow-from http-request-headers=""*"">
    <domain uri=""*""/></allow-from>
    <grant-to><resource path=""/"" include-subpaths=""true""/>
    </grant-to></policy>
 </cross-domain-access>
</access-policy>

I've tried changing http-request-headers to https-request-headers to no avail.

Can anyone see what's wrong; what do I need to do to enable simple SSL security on this BasicHTTPBinding?

Answer 1

Cracked it. The problem, bizarrely enough, is with the <domain uri=""*""/> line in the clientaccesspolicy.xml file - for SSL it has to explicitly include HTTPS. So the working file looks like:

<xml version="1.0" encoding="utf-8"?>  <access-policy>  
<cross-domain-access>
 <policy>
    <allow-from http-request-headers="*">
      <domain uri="http://*"/>
      <domain uri="https://*"/>
     </allow-from>
    <grant-to>
       <resource path=""/"" include-subpaths=""true""/>
    </grant-to>
   </policy> 
  </cross-domain-access>
</access-policy>

Strange, but apparently true.