Encrypted proof token in wsfederationhttpbinding
I have written a WCF c开发者_Go百科lient that uses wsfederationhttpbinding in order to authenticate to a STS and RPS. I recently noticed (using Fiddler) that the response received from the STS includes a SymmetricKey for the proof token (as I have configured the client to request) but that the proof token is not encrypted.
A few questions about this:
- As I understand it, if the proof token is not encrypted, there is no point to it (e.g. does nothing extra to prevent a Man in the Middle attack)
- How do I request the STS to encrypt the proof token?
- Can I provide a public key in my RST to the STS in order for it to encrypt the proof token?
- If so, how do I configure my WCF client to do this?
Thanks in advance...
精彩评论