Does my Silverlight/Web Service solution have a security vulnerability?

I'm building one of my first silverlight applications.  The silverlight will be hosted within Microsoft CRM 2011 Online.  It will need to access a web service that I am creating that is hosted on the clients server which is a different domain than the silverlight application.  

Users who access the silverlight application via CRM 2011 have already been authenticated by CRM and have permission to access the data in the web service.  The webservice doesn't need to know which user is making the request, just that it is an authenticated user of CRM.  

I am planning on setting up SSL on the server that hosts the web service and adding the domain of the crm system to the crossdomain.xml file.

Because this is my first silverlight application I'm concerned that I may accidentally be leaving a security vulnerability.  I would appreciate a response on whether.

1.  My solution is vulnerable to data being intercepted when it is communicated between Silverlight and the webservice.

2.  My solution is vulnerable to impersonation by a malicious user trying to query the web service.

3.  If there are any other security vulnerabilities I need to be aware of.

Thank you for your consideration.
Sandy WestmanIntegrations ConsultantAsked:
Who is Participating?
 
Kyle AbrahamsSenior .Net DeveloperCommented:
for 1:  use HTTPS . . . optionally you can also encrypt the results of a service call before sending and decrypt them locally.

for 2: Not sure how you're sharing the token.  If you're using windows auth impersonation is always possible.

for 3:  In general assume the client is always compromised.  All validation should be server side.

General securing tips:
http://msdn.microsoft.com/en-us/magazine/ff646975.aspx
0
 
Kyle AbrahamsSenior .Net DeveloperCommented:
Do you need further assistance?
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.