Always protect the message and provide for message confidentiality and integrity.

In an intranet, you can use Transport security as long as the protection level is set to EncryptAndSign.

In an intranet, avoid impersonation. Set the impersonation level to TokenImpersonationLevel.Identification.

When using impersonation, have the client use TokenImpersonationLevel.Impersonation.

Use the declarative security framework and avoid manual configuration.

Never apply the PrincipalPermission attribute directly on the service class:

//Will always fail:
[PrincipalPermission(SecurityAction.Demand,Role = "...")]
public class MyService : IMyContract
{...}

Avoid sensitive work that requires authorization at the service constructor.

Avoid demanding a particular user, with or without demanding a role:

//Avoid:
[PrincipalPermission(SecurityAction.Demand,Name = "John")]
public void MyMethod(  )
{...}

Do not rely on role-based security in the client's callback operations.

With Internet clients, always use Message security.

Allow clients to negotiate the service certificate (the default).

Use the ASP.NET providers for custom credentials.

When developing a custom credentials store, develop it as a custom ASP.NET provider.

Validate certificates using peer trust.

Strive to run the client under partial trust. Grant the client permission only to:

When you own the service host environment, run the service and the host under full trust. Grant Microsoft and ECMA full trust, but remove all other code groups and grant them no permissions.

When hosting in partial trust, grant the host and the service permission only to: