title: C# .NET 4.0 WCF MessageSecurityException, "Security header is empty." when consuming a service
body: <p>When using WCF and C# in a project I get an exception, MesssageSecurityException, with the message "Security header is empty.". Here follows the response (according to MS Service Trace Viewer):</p>
  
  <pre><code>    &lt;soapenv:Envelope xmlns:soapenv="http://www.w3.org/2003/05/soap-envelope" xmlns:wsa="http://www.w3.org/2005/08/addressing"&gt;
        &lt;soapenv:Header&gt;
          &lt;wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" soapenv:mustUnderstand="true"&gt;&lt;/wsse:Security&gt;
          &lt;wsa:Action&gt;_WHAT_I_DID_&lt;/wsa:Action&gt;
          &lt;wsa:RelatesTo&gt;_MSG_ID_OF_REQUEST_&lt;/wsa:RelatesTo&gt;
        &lt;/soapenv:Header&gt;
        &lt;soapenv:Body&gt;
          _CORRECT_BODY_
        &lt;/soapenv:Body&gt;
      &lt;/soapenv:Envelope&gt;
  </code></pre>
  
  <p>Indeed, the security header is "empty", but it is still correct accprding to the security header definition as far as I can tell.</p>
  
  <p>I've also tried editing the bindings, but that doesn't seem to help as well. I also found a similar problem where enabling <code>EnableUnsecuredResponse</code> would help, but it doesn't here.</p>
  
  <p>Here is the response according to SoapUI:</p>
  
  <pre><code>&lt;soapenv:Envelope xmlns:soapenv="http://www.w3.org/2003/05/soap-envelope" xmlns:wsa="http://www.w3.org/2005/08/addressing"&gt;
     &lt;soapenv:Header&gt;
        &lt;wsse:Security soapenv:mustUnderstand="true" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"/&gt;
        &lt;wsa:Action&gt;_WHAT_I_DID_&lt;/wsa:Action&gt;
        &lt;wsa:RelatesTo&gt;_REQ_MSG_ID_&lt;/wsa:RelatesTo&gt;
     &lt;/soapenv:Header&gt;
     &lt;soapenv:Body&gt;
        _CORRECT_BODY_
     &lt;/soapenv:Body&gt;
  &lt;/soapenv:Envelope&gt;
  </code></pre>
  
  <p>They are almost identical, except for how they close the security header. Which is interesting, but should not raise the exception?</p>
  
  <p>I also found a <a href="http://social.msdn.microsoft.com/Forums/da-DK/wcf/thread/bd244349-f3e0-4a07-93bb-b656590ad628" rel="noreferrer" title="similar problem">similar problem</a> where the solution was to create a custom message encoder and strip the entire security header, although this would work it is an extra unneeded step. Is that the only way to do it with .Net and WCF? Can't WCF handle security headers without content?</p>
  
  <p>EDIT:
  Clarification of the issue, is writing an encoder which drops the security header the only way to recieve and parse SOAP-messages with empty security headers using WCF?</p>
  
  <p>EDIT2: Adding part of conf:</p>
  
  <pre><code>    &lt;binding name="NinjaBinding"&gt;
        &lt;security allowSerializedSigningTokenOnReply="true" enableUnsecuredResponse="true"
        authenticationMode="UserNameOverTransport" requireDerivedKeys="false"
        securityHeaderLayout="Lax" includeTimestamp="false" allowInsecureTransport="true"
        keyEntropyMode="ClientEntropy"
        messageProtectionOrder="SignBeforeEncryptAndEncryptSignature"
      messageSecurityVersion="WSSecurity10WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10"
        requireSecurityContextCancellation="false"&gt;
          &lt;localServiceSettings detectReplays="false" /&gt;
          &lt;secureConversationBootstrap _IDENTICAL_TO_ABOVE_
          &lt;/secureConversationBootstrap&gt;
        &lt;/security&gt;
        &lt;textMessageEncoding /&gt;
        &lt;httpsTransport /&gt;
      &lt;/binding&gt;
  </code></pre>
  
  <p>As far as I know, its configure to allow practically everything?</p>