asp.net - REST or SOAP WCF service on secure internal network NO SSL -

i have problem service writing.

we have webapp hosted on internal secure network.

there requirement provide service expose our web app business functionality client consume in order create native tablet app.

the mobile device use vpn onto network. access our webapp, user need use user name , password. ie. there no ssl. username , password stored in our db in custom set (no asp membership, etc).

now, have raised lack of ssl issue, has been shot down, , in charge of such matters feel security needed internal network enough.

i realise means app open internal user malicious behaviour inside network outside of app user group

so, raises issue when comes creating service in wcf. authentication without ssl appears quite fiddly. did manage find:

[yaron naveh's clearusernamebinding][1] http://webservices20.blogspot.co.uk/2008/11/introducing-wcf-clearusernamebinding.html

i felt solve problems until realised have alter plans offer restful service json, , have use soap.

still, fine until realised soap had bandwidth issues due envelope comes packet. worries me, service getting consumed mobile app on 3g, , there bandwidth limits.

so, without ssl being option (please don't otherwise), think using soap instead of rest here better option? should concerned bandwidth? (rows counts returned not exceeding 200, , smaller). how of overhead talking?

is there option wcf rest config can authenticate without certificate (using form of custom authentication)? preferable me.

the performance comparison between rest , soap web services discussed in detail in rest vs. soap. has rest better performance?.

you can implement custom authentication in wcf rest service, without certificates or secure transport. 1 option use binding similar following:

<bindings>     <webhttpbinding>         <binding name="default">             <security mode="transportcredentialonly">                 <transport clientcredentialtype="windows" proxycredentialtype="windows"/>             </security>         </binding>     </webhttpbinding> </bindings> 

http://msdn.microsoft.com/en-us/library/bb924478(v=vs.110).aspx

including microsoft caveat: “this mode not provide message integrity , confidentiality. provides http-based client authentication. mode should used caution. should used in environments transport security being provided other means (such ipsec) , client authentication provided wcf infrastructure.”

the following link provide comprehensive overview of custom wcf rest authentication solution: http://www.codeproject.com/articles/304877/wcf-rest-4-0-authorization-with-form-based-authent