Configuring WCF can be a daunting task. So a lot of people just use the WCF default settings and change as little as possible. However changing these defaults can dramatically improve the service performance, so it’s really worth the effort.
Let’s have a look at the most used binding in enterprise environments; the WsHttpBinding.
By default the following setttings are used:
There are 2 settings here that can have a negative impact on the performance:
negotiateServiceCredential
This setting determines whether the clients can get the service credential using negotiation with the service. When this setting is set to "true" a bunch of infrastructure soap envelopes are sent on the wire before the client sends its request. When set to "false" the client needs to have the service credentials out of band.
The trade off here is better performance (using "false") versus more convenience (using "true").
establishSecurityContext
This setting determines whether WS-SecureConversation sessions are established between the client and the server. A normal secured web service request requires one asymmetric encryption. Respectively, normal N requests require N asymmetric encryptions. Since asymmetric encryption is very slow, setting up a secure conversation is usually a good practice: It requires a one-time asymmetric encrypted message exchange in order to set up a session; Further calls in the session use symmetric encryption which is much faster.
But most of the time a user sends only one request.In that case set establishSecurityContext to "false".
Remark: As with all performance considerations, measure first!
Let’s have a look at the most used binding in enterprise environments; the WsHttpBinding.
By default the following setttings are used:
<wsHttpBinding> <binding name="BadPerformanceBinding"> <security mode="Message"> <message clientCredentialType="..." negotiateServiceCredential="true" establishSecurityContext="true" /> </security> </binding> </wsHttpBinding>
There are 2 settings here that can have a negative impact on the performance:
negotiateServiceCredential
This setting determines whether the clients can get the service credential using negotiation with the service. When this setting is set to "true" a bunch of infrastructure soap envelopes are sent on the wire before the client sends its request. When set to "false" the client needs to have the service credentials out of band.
The trade off here is better performance (using "false") versus more convenience (using "true").
establishSecurityContext
This setting determines whether WS-SecureConversation sessions are established between the client and the server. A normal secured web service request requires one asymmetric encryption. Respectively, normal N requests require N asymmetric encryptions. Since asymmetric encryption is very slow, setting up a secure conversation is usually a good practice: It requires a one-time asymmetric encrypted message exchange in order to set up a session; Further calls in the session use symmetric encryption which is much faster.
But most of the time a user sends only one request.In that case set establishSecurityContext to "false".
Remark: As with all performance considerations, measure first!