How to secure data over WCF (dynamic security)

Question

How can I secure data across WCF?

This isn't the standard WCF authentication question. What I need to do is lock the data down and make sure that none of it can be sent to a client who isn't allowed to see it.

I have WCF authentication to check the validity of the client but I need to put a wrapper around the service layer to restrict data.

In this poor example I describe the issue; http://www.website.com/customers.aspx?CustomerId=1

Now a 'hacker' or the lowest quality changes the querystring to customerid=2. The authenticated user shouldn't be allowed to see this customer data.

What standard practice for locking down data? Is there anything built into WCF which I could use?

Answer 1

WCF only supports authentication and with role based security also operation based authorization. You need data driven authorization. It is up to you to build it in your operations or business layer.