Design – the difference between WCF service and a simple Web service in developing using .NET Framework

iOS applications run on constrained devices, which is the first and foremost thing to keep in mind. Those constrained devices are actually pretty capable, but do consider the following:

• XML is non-trivial to parse. If the requests are small and the data payload is not structured, there is no inherent benefit to using SOAP.
• Apple has reasonably set high expectations for how responsive a web bound application is, processing has to be really fast.
• Question for you: does the iOS have good SOAP support, or do you have to roll your own?
• REST style services (i.e. simple HTTP requests/posts with XML, JSON, or plain text responses) are usually low impact and easy to code on both client and server.
• How do you intend to/do you need to implement security?

Each of these points and questions can help you come to the right answer for your application. I don't know enough about the iOS API to talk toward it's support for SOAP based messaging--but it's something you need to consider. Is there anything inherently wrong in SOAP? Not necessarily, but it is definitely like trying to kill a wasp with a sledgehammer in some cases. It'll get the job done but the collateral damage is significant.

You will want something that is easy to invoke and process on your target platform. This principle doesn't change if you suddenly decide to do Android apps in addition to the iOS apps. Your conclusion might change, but the reasoning to get to that answer will be the same.

Well, the famous WSHTTPBinding. It causes a lot of pain for non-.NET platforms.

First of all, even if SOAP 1.2 is a standard, WSHTTPBinding is a Microsoft implementation over SOAP 1.2 and by experience, it's not as easy as "Our product support SOAP 1.2 so it'll work with WCF & WSHTTPBinding services, no problem!".

Answer 1

There are two main security settings:

• Message Security: the message is partially encrypted, Default
• Transport Security: uses SSL to secure the channel

About authentication, WSHTTPBinding uses Windows credentials (NTLM or Kerberos) by default.

Answer 2

It depends, but a short answer is:

• You need to re-route the messages or inspect them: use Message Security
• You need point-to-point channels and can secure them with certificates: use Transport Security
• Your clients and servers share the same authentication platform, use Windows authentication
• You need an open authentication for externals clients, or cross-platform, use Username authentication

About Username authentication, there are different configurations. You can store the credentials in an SQL database, yes (we do this in our company for some services).

Some simple cases: Improving Web Services Security: Scenarios and Implementation Guidance for WCF