https - WCF Security - protecting from Man in the middle attacks -

I have a WCF service that uses transportation and messaging security, I am using a malicious man-in-the-middle attack How do I protect data, where do I say using a user and allow IIT to decrypt with HTTPS traffic?

This topic is included in this. You can use Fiddler to smell messages from those parties who have physical access to you, seeing that you do not give physical access to the malicious user, you are protected from transportation and message security.

Q: Does Fiddler show a flaw in 2 HTTPS?

A: No, depending on HTTPS certificates for securing web traffic. Depending on the Trusted Route Certification Authorities, to issue certificates that secure web browser traffic, in-the-middle Stop the attack. As is designed, the web browser will show a warning when traffic is not secured by a certificate issued by a trusted root. Edit
This is from someone

Transportation security provides only point-to-point channel security This means that HTTPS only establishes a secure channel in connection with the client and the customer. But if this server is a load balancer or proxy server, then it has direct access to the contents of the message.

Message security provides end-to-end channel security This means that security is part of a transferred data and can only decrypt the desired destination data (load balancer or proxy only sees encrypted messages) . In most cases, message security also uses certificates to provide encryption and signatures, but it is usually slow because transport security can use HW acceleration.