如何在WCF中仅使用一次客户端凭据进行身份验证?

在使用基于WCF构建的API时,确保您只需要验证一次的最佳方法是什么?

下面列出了我当前的绑定和行为

    <bindings>
        <wsHttpBinding>
            <binding name="wsHttp">
                <security mode="TransportWithMessageCredential">
                    <transport/>
                    <message clientCredentialType="UserName" negotiateServiceCredential="false" establishSecurityContext="true"/>
                </security>
            </binding>
        </wsHttpBinding>
    </bindings>
    <behaviors>
        <serviceBehaviors>
            <behavior name="NorthwindBehavior">
                <serviceMetadata httpGetEnabled="true"/>
                <serviceAuthorization principalPermissionMode="UseAspNetRoles"/>
                <serviceCredentials>
                    <userNameAuthentication userNamePasswordValidationMode="MembershipProvider"/>
                </serviceCredentials>
            </behavior>
        </serviceBehaviors>
    </behaviors>

接下来是我在客户端应用程序中使用什么进行身份验证(目前每次我想调用WCF时都必须这样做)

Dim client As ProductServiceClient = New ProductServiceClient("wsHttpProductService")
client.ClientCredentials.UserName.UserName = "foo"
client.ClientCredentials.UserName.Password = "bar"
Dim ProductList As List(Of Product) = client.GetProducts()

我想做的是,一旦使用这些凭据,就通过API进行身份验证,然后在我的客户端应用程序使用web服务项目的时间段内获得某种类型的令牌。我以为establishsecuritycontext=true是为我做的吗?