I m building a webservice that needs to be accessible to a variety of potential platforms, including a number of older ASP and ASP .NET applications. After some research, I settled on a WCF service with both a REST (webHttpBinding) and SOAP (wsHttpBinding) endpoint (that way, I can support a wide range of platforms and still make the .NET coders happy).
For security, I m using SSL and HTTP Authentication Basic against my own database of username/passwords. So I ve written an HttpModule to handle the usernames and passwords and check for SSL. Now, the REST setup is working perfectly, but I m having problems with the SOAP endpoint. No matter what settings I use, the SOAP client never sends me a WWW-Authorization header that I can use to authenticate. I m assuming that setting something like <message clientCredentialType="UserName" /> should tell WCF that I expect an Authorization header, and that information will be picked up by Visual studio (or whatever client) when it creates a web reference. Perhaps I m just being hopelessly naive.
So to summarize the question: is there any way that I can tell WCF to send me a WWW-Authorization header (ie, an HTTP basic header) along with the soap messages?