WCF, HTTP, Security and Data Service topics for Silverlight

WCF, HTTP and Security topics for Silverlight | Tmao Coders

WCF, HTTP and Security topics for Silverlight | Tmao Coders — Wed, 12 Nov 2008 02:47:17 GMT

PingBack from http://www.tmao.info/wcf-http-and-security-topics-for-silverlight/

Doing CRUD Operations in Silverlight 2 Against ADO.NET Data Services

WebLog of Ken Cox — Thu, 13 Nov 2008 09:14:28 GMT

Many of us have been struggling to create business-oriented (LOB) forms using Silverlight 2 and ADO.NET

Silverlight Cream for November 12, 2008 -- #426

Community Blogs — Thu, 13 Nov 2008 15:14:44 GMT

In this issue: Silverlight Girl, Mehdi Slaoui Andaloussi, David Anson, Cheryl, Justin Angel, Kathy Kam

re: WCF, HTTP, Security and Data Service topics for Silverlight

KellenF — Thu, 13 Nov 2008 18:37:00 GMT

Thanks for the post Cheryl, I've posted several times on the silverlight.net forums about some of these security restrictions and I still have some concerns that I don't feel have been addressed.

I understand the absolute necessity for a secure platform, and I don't feel that mistakes of the past can be used as an excuse for future applications, that said the socket restrictions in place don't seem to make sense to me. I would be perfectly happy with a confirmation box per connection, like the expand storage confirmation (requiring a user initiated event to show the box), to open up a socket. This would make a DoS application infeasible. Essentially I would like to be able to write the equivalent of an FTP client, that lives in a Silverlight application.

If I am missing a major security hole please enlighten me, I think allowing this to happen would open up a world of application replacements, allowing clients to existing services to be developed in Silverlight. As it is right now I have had to write a server side component that martials sockets to their destination, which limits performance and security.

-Kellen

re: WCF, HTTP, Security and Data Service topics for Silverlight

cherylws — Tue, 02 Dec 2008 18:09:58 GMT

Kellen,

Thanks for your comment. I checked with the team responsible for the sockets implementation and there are valid security reasons for the restrictions you mention. They cannot allow users to make security decisions through prompting because they are concerned about risks to the network, not just the individual client.

Cheryl