是否可以使用表单身份验证来保护 Web 服务的安全？
我们正在寻求保护大量 ASP.Net 2.0 .asmx Web 服务的安全。 将托管 Web 服务的表单已经经过身份验证。
是否可以使用表单身份验证来保护 Web 服务的安全？ 实现这一目标的优点和缺点是什么以及其他可能的方法。 我们当然不想在每个 Web 方法调用中传递用户名/密码或令牌。
We are looking to secure a bunch of ASP.Net 2.0 .asmx web services. The which will host the web services is already forms authenticated.
Is it possible to secure the web services using forms authentication?
What are the pros and cons and other possible ways to achieve this. We certainly don't want to pass a username/pwd or token in each web method call.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
您应该能够使用 WSE 通过表单身份验证来保护您的服务 - 尽管我个人从未这样做过。
以下是使用 WSE 的一些资源：
要不使用 WSE，您需要实施一些操作就像其他一些回答者提到的那样，尽管我不确定它有多可靠：
You should be able to use WSE to secure your service using forms authentication - though personally I've never had to do it.
Here are some resources using WSE:
To not use WSE you'd need to implement something like this as some of the other presponders have alluded to, though I'm not sure how reliable it would be:
表单身份验证的特点是它是为人们设计的，而 Web 服务则旨在由客户端应用程序使用。 虽然可以像这样进行身份验证，但这是错误的思维方式。
所需的安全级别显然取决于您正在使用的数据的敏感性，但我假设它至少有些敏感（但低于银行交易）。 当我输入此内容时，您也许可以使用 SSL 并按照 jle 的建议传递用户名和密码，或者您可能需要一个 api 密钥，就像 flickr 那样。
另一个更安全的选择是仅传递一次用户名和密码（并且具有 ssl 的安全性），并给出在一段时间内有效的令牌。 这样做的好处是可以保护密码信息，并避免 ssl 的持续开销。
如前所述，这在很大程度上取决于您要保护的信息的敏感程度。
The thing with form authentication is that its designed for people, where as a web service is designed to be consumed by a client application. While it is possible to do the authentication like this, it's the wrong way of thinking.
The level of security needed obviously depends upon the sensitivity of data that you're working with, but I'm going to assume its at least somewhat sensitive (but less than bank transactions). You could perhaps use SSL and passing a username and password as jle suggested, while I was typing this, or you could require an api key much like flickr does.
Another more secure option is to only pass the username and password once (and with the security of ssl) and have that give out a token that is valid for a period of time. This has the benefit of protecting the password information, and avoiding the constant overhead of ssl.
As mentioned though, it highly depends on HOW sensitive the information is that you're trying to secure.
华尔街英语已经过时了。 除非您别无选择，否则不要使用它。
WSE的几乎所有功能都由WCF更好地实现。 其余功能（未由 WCF 实现的功能）本身已过时（例如 DIME）。
WSE is obsolete. Do not use it unless you have no choice at all.
Almost all the functions of WSE are implemented better by WCF. The remaining capabilities, those not implemented by WCF, are obsolete themselves (DIME, for instance).
这是可能的，但您需要将用户重定向到登录页面。 传递用户名/密码的另一个选项是通过 ssl 使用 Web 服务。 如果您加密连接，则可以使用基本身份验证没有问题。
It is possible, but you will need to redirect users to a login page. Another option for passing username/pw is to use the web service over ssl. If you encrypt the connection, basic authentication can be used no problem.