How Do I make my BarScan SmartClient application use SSL so my users see HTTPS instead of HTTP?

BarScan Smart Client does not use SSL, but please read the following so that you will understand why.

There are two basic types of internet transfer security (also known as the security mode):

-Transport Security

-Message Security

You may find others but they are just mixtures of these two.

TRANSPORT SECURITY. SSL (where the user sees https:// at the beginning of a web site URL) is Transport Security. There are several advantages to this type of security. The main advantage is that all point to point traffic is secure and web applications do not have to know about security as the web site itself handles it. However, it is not the only accepted security method. The second type of Transfer Security is Message Level Security.

MESSAGE SECURITY. Message Level Security is considered just as secure as Transport Security and is used by the BarScan SmartClient. It encrypts and signs each message after an initial packet exchange. It is especially valued as an application level security and this is especially important when an application wants to keep secure communications but it is unknown whether the web site has SSL available. In some scenarios it is considered superior to SSL and is secure even when SSL is not enabled.

Here is a description published by Microsoft patterns and practices:

‘When using message security, the user credentials and claims are encapsulated in every message using the WS-Security specification to secure messages. This option gives the most flexibility from an authentication perspective. You can use any type of security credentials you want, largely independent of transport, as long as both the client and the service agree.’

BINDING. The BarScan SmartClient implements its message security by selecting and implementing what Microsoft calls a ‘binding’. A binding encapsulate the various security modes, client credential types and other security settings used in communication. The binding that the BarScan SmartClient uses is  the ‘wsHttpBinding’.

‘wsHttpBinding’ itself can use a variety of algorithm suites. (An algorithm suite is a specific collection of cryptographic algorithms used for signing, encrypting, etc. under various circumstances). The BarScan Smart  Client uses a security algorithm suite called BASIC256. BASIC256 uses the following bundle of algorithms:

[Dig]                      Digest Algorithm                                              Sha1

[Enc]                      Encryption Algorithm                                     Aes256

[Sym KW]            Symmetric Key-Wrap Algorithm                KsAes256

[Asym KW]         Asymmetric Key-Wrap Algorithm             KwRsaOaep

[Enc KD]               Encryption Key Derivation Algorithm       PSha1L256

[Sig KD]                Signature Key Derivation Algorithm         PSha1L192

There are other possible algorithm suites available, but these would require program customization. Among these are

TripleDes

TripleDesSha256Rsa15

Basic256Sha256Rsa15

 

Here is an explanation of the various security concepts used by Windows Communication Foundation, which is what the BarScan SmartClient uses.

http://wcfsecurityguide.codeplex.com/wikipage?title=Ch%2004%20-%20WCF%20Security%20Fundamentals

In summary, BarScan uses a different type of security method when communicating between the server and the client. That is, Message Security via wsHttpBinding.  It does not use SSL port 443 but requires only the normal HTTP port 80. In fact, attempting to force it to use SSL may cause some of the following errors:

1.The HTTP request was forbidden with client authentication scheme ‘Anonymous’.- System.NetWebException:  The remote server returned an error: (403) Forbidden.

2.System.ServiceModel.ProtocolException: the content type text/html;charset=UTF-8 of the response message does not match the content type of the binding (application/soap+xml;charset-utf-8).  If using a custom encoder, be sure that the IsContentTypeSuppported method is implemented properly.