What's new with web services in Silverlight 3 Beta

Silverlight Web Services Team : What's new with web services in Silverlight 3 Beta

Fri, 20 Mar 2009 21:56:23 GMT

PingBack from http://blogs.msdn.com/silverlightws/archive/2009/03/20/what-s-new-with-web-services-in-silverlight-3-beta.aspx

re: What's new with web services in Silverlight 3 Beta

charlymoon — Fri, 20 Mar 2009 23:51:17 GMT

Synchronous calls are needed... I can understand why you are taking just Asynchronous calls but in some scenarios the need for Syn is better, the use of sync or async shoul be a decition of the application architec just like in WPF programming

re: What's new with web services in Silverlight 3 Beta

SLWSTeam — Sat, 21 Mar 2009 00:04:36 GMT

The underlying networking stack in Silverlight does not support synchronous programming, so WCF cannot use the synchronous pattern in Silverlight.

I do understand that the synchronous pattern is simpler in most case, unfortunately this is a limitation we have to live with.

Are there any specific scenarios where you have a problem?

Thanks,

-Yavor

re: What's new with web services in Silverlight 3 Beta

Greg Neilson — Mon, 23 Mar 2009 12:30:41 GMT

Hi Yavor,

Thankyou for this post, there's some good stuff in here I was hoping you guys were working on Faults in particular are a pain point at the moment, and any improvements here are welcome. The other area of concern I have is security between Silverlight and WCF services, and the introduction of TransportSecurityWithMessageCredential is very welcome.

However, currently, all security between Silverlight and web services hinges on the use of SSL. I and many other people I suspect would like to be able to take advantage of the WCF bindings that support message security and the WS-* standards. Are you guys working on that, is it in your plans, or do you not have any plans for it at all at present?

Cheers,

Greg

re: What's new with web services in Silverlight 3 Beta

SLWSTeam — Wed, 25 Mar 2009 10:46:19 GMT

Hi Greg - thanks for your feedback. This is exactly the kind of dialog we're hoping to develop on our blog.

I cannot make specific commitments but support for WS-Security is definitely on our list of big chunky features that we know are missing from SL3. Please consider your scenario and let me know why the current security mechanisms don't work for you. Any data you can give us about key scenarios that are currently blocked will help us argue the case for WS-Security in subsequent Silverlight releases.

Thanks and keep the feedback coming!

-Yavor

re: What's new with web services in Silverlight 3 Beta

Greg Neilson — Thu, 02 Apr 2009 12:40:48 GMT

Hi Yavor,

Sorry for the delay in responding, I've been playing with the new SL3 features! OK, I'll explain, and please anyone jump in and correct me if I'm wrong or misunderstand the situation we have.

Broadly, we're creating a SL application which will communicate with WCF services hosted outside of the user's LAN, and could be accessing sensitive data. Whilst we can use SSL, this is only point-to-point secure. It is entirely feasible that there may be routers/intermediaries inbetween the client and the services. Unless we have encryption of the message content itself, it's possible that the contents could be intercepted and read at the point where the message is vunerable during the hop - when it's inbetween SSL connections from one server to the next.

Now, on the WCF services side, we can implement wsHttpBinding, which gives us WS-Security, allowing for message security (encryption, message integrity, etc). If we were writing a WPF thick client then we could use this binding, giving us message security. However SL doesn't support this.

For a number of our customers, this is potentially a problem. When it's explained that their data isn't as secure when using a SL app as when using a thick client, it can be a sticking point. Of course, the actual risk to their data may well be low, and SSL transport security may be actually good enough, but the perception of SL being "less secure" is enough to put people off.

It may well be that we will have to roll our own encryption mechanism within our SOAP messages. Now this also gives us problems in that it's time consuming, probably won't give us the full spectrum of Ws-Security functionality, will mean that we will have to implement custom binding on the WCF side (therefore reducing our interoperability options with other clients in the future) and gives us issues with having to have security keys of some sort in the SL client code which of course is visible to the client (I'm aware it could be obfusticated). We'd much rather prefer to use the mechanism which is built into WCF!

As well as security, there is also the issue of reliability. wsHttpBinding also gives us ws-Reliable messaging. Now, we've not looked too deeply at what the lack of this will mean for us, but looking at it briefly, we could potentially run into problems with messages being delivered out of order to our WCF service, or not at all. This may or may not be a problem for us, we need to investigate further.

Now, I realise you guys are working within the constrains of the browser networking stack and implementation of full wsHttpBinding on the SL side may be tricky - but I hope you give it some serious thought. You've done such a good job of pushing the area of SL being secure within the browser and client machine environment due to the sandbox, it would be a pity if adoption for serious internet-based LOB applications is reduced once the perception is out there that the security between the client and server is lacking as SL can't support the full range of security features that WCF can.

Cheers,

Greg

re: What's new with web services in Silverlight 3 Beta

Greg Neilson — Thu, 02 Apr 2009 12:52:58 GMT

I've looked at the new features you've described here, and have some feedback:

Binary Message Encoding - seems to work well. I'd like to be able to see the content within Fiddler (the existing Fiddler transformer options for decoding content don't seem to work with the SL encoding). Maybe I'll post on the Fiddler forums/site about this.

Duplex Object model - First thing to note, for anyone looking at this, is that the Visual Studio Add Service Reference functionality doesn't bring in the callback event delegate on the client proxy it generates. I had to use the new SL3 beta command line tool SlSvcUtil to generate a proxy with the delegate included.

Once I'd done that though, it worked great, and is certainly a great deal simplier to use that having to delve into channel factories and binding parameters (not to mention rolling up and decoding your parameters into/out of generic soap messages).

Faults support - I love this. Combined with the SL3 standard unhandled exception message box, I can now get a proper exception back from the server, and re-throw it in my SL app and when I'm running and testing my SL app and services I can get the error straight through instead of messing about with Fiddler.

Great stuff guys!

re: What's new with web services in Silverlight 3 Beta

dsoltesz — Wed, 08 Apr 2009 16:21:49 GMT

Can you provide an example of how to setup TransportSecurityWithMessageCredential to secure your wcf service with sl3

re: What's new with web services in Silverlight 3 Beta

dmargin — Mon, 27 Apr 2009 01:50:19 GMT

I could also really do with some example code for using SOAP authentication headers with an SSL layer.

I use the following bindings, and the async service call silently fails. When I remove the TransportSecurityBindingElement, the service works perfectly.

CustomBinding binding = new CustomBinding(

TransportSecurityBindingElement.CreateUserNameOverTransportBindingElement(),

new PollingDuplexBindingElement(),

new BinaryMessageEncodingBindingElement(),

new HttpsTransportBindingElement() );

I'm also struggling to see how to access the SOAP authentication response headers, to assess login errors etc.

Are there any good resources on error handling, debugging, and diagnostics when using the Async callback and duplex pattern with SL3? I think I'm missing out on something, but I seem to be blindly trying various options in the hope that one might work.

I'm really excited about some of these new features, but it feels like the lack of example code is really holding me back.

WCF Binary Bindings in Silverlight 3

JohnPapa.net — Fri, 15 May 2009 05:10:12 GMT

One of the most common comments I hear form people when they start digging into Silverlight 3 Beta (and Silverlight 2) is the lack of WCF binding options. Some changes have been made to include binary encoding in Silverlight 3, so now we have: customBinding

WCF Binary Bindings in Silverlight 3

Community Blogs — Fri, 15 May 2009 06:08:28 GMT

One of the most common comments I hear form people when they start digging into Silverlight 3 Beta (and

Improving the performance of web services in SL3 Beta

Silverlight Web Services Team — Mon, 08 Jun 2009 06:30:05 GMT

Silverlight 3 Beta introduces a new way to improve the performance of web services. You have all probably

Improving the performance of web services in Silverlight 3 Beta

The .NET Endpoint — Mon, 08 Jun 2009 06:32:18 GMT

Cross-posted from the Silverlight Web Services Team Blog . Silverlight 3 Beta introduces a new way to

슈러의 생각

shooter's me2DAY — Mon, 08 Jun 2009 11:11:51 GMT

What's new with web services in Silverlight 3 Beta