开发者

Encrypted proof token in wsfederationhttpbinding

I have written a WCF c开发者_Go百科lient that uses wsfederationhttpbinding in order to authenticate to a STS and RPS. I recently noticed (using Fiddler) that the response received from the STS includes a SymmetricKey for the proof token (as I have configured the client to request) but that the proof token is not encrypted.

A few questions about this:

  1. As I understand it, if the proof token is not encrypted, there is no point to it (e.g. does nothing extra to prevent a Man in the Middle attack)
  2. How do I request the STS to encrypt the proof token?
  3. Can I provide a public key in my RST to the STS in order for it to encrypt the proof token?
  4. If so, how do I configure my WCF client to do this?

Thanks in advance...

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜