How to hide my WCF service

Question

I have a WCF service embedded into windows service. It's bind to localhost but it also accepts connection from this kind of URL - "http://ip:port/ServiceName", how can i hide it from others and allow connection only from localhost.

Here is my service configuration

<system.serviceModel>
 <behaviors>
  <serviceBehaviors>
     <behavior name="Test.Service.ServiceBehavior">
         <serviceMetadata httpGetEnabled="true" /> 
         <serviceDebug includeExceptionDetailInFaults="true" /> 
     </behavior>
  </serviceBehaviors>
 </behaviors>
 <services>
   <service behaviorConfiguration="Test.Service.ServiceBehavior" name="Test.Service.TestService">
      <endpoint address="localhost" binding="wsHttpBinding" contract="Test.Service.IService">
        <identity>
           <dns value="localhost" /> 
        </identity>
      </endpoint>
      <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" /> 
      <host>
         <baseAddresses>
              <add baseAddress="http://localhost:8732/MyService/service" /> 
         </baseAddresses>
      </host>
  </service>
</services>
</system.serviceModel>

Answer 1

To "hide" it, you need to turn off any meta data exchange, so you need to remove:

<serviceMetadata httpGetEnabled="true" /> 

from your service behaviors, and you need to remove the mex endpoint:

<endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" /> 

However, this is only "obscuring" it. To avoid anyone else but localhost to call - why not switch to the netNamedPipeBinding, which is by design "on this machine only" - no outside callers are able to call into that endpoint.

Otherwise, you'd have to check for the caller's IP address and block them based on that information - which however can be spoofed pretty easily....

Answer 2

I would switch to NetNamedPipeBinding - this is inherently local-only, but also avoids a few additional layers, and doesn't require access to any ports (which non-admins don't have by default). This can be done in config using the <netNamedPipeBinding> element.