如何在 Silverlight 中验证主机服务器的证书？
我担心我正在编写的 Silverlight 应用程序中存在 MITM 攻击。 该网站将通过 SSL 运行。 如果我的网站是 MITM 攻击的受害者，据我所知，我现在唯一的防御措施是当网站的证书不受信任时浏览器显示的警告页面。 由于它只是一个浏览器，它能做的最好的事情就是简单地警告用户，然后让他们通过。 用户可能会很乐意点击，但往往不会阅读内容。 因此，他们很可能会阅读此警告，摸不着头脑，然后继续访问该网站。 我的想法是，由于我正在编写一个强大的 Silverlight 应用程序，因此我应该能够检测浏览器是否看到证书错误，或者执行与浏览器执行的相同验证。 然后，如果我确定存在问题，我可以简单地锁定整个应用程序，以便用户不会向 MITM 暴露任何关键信息。 我遇到的问题是，我似乎无法在 Silverlight 的有限子集中找到正确的类来完成我需要做的事情。 有谁知道我如何实现这个目标，或者以不同的方式解决这个问题？
I am concerned with MITM attacks in the Silverlight application I am writing. The site will be running over SSL. If my site is the victim of a MITM attack, as far as I know, my only defense right now is the warning page the browser displays when the site's certificate is untrusted. Since it is only a browser, the best it can do is simply warn the user and then let them through anyway. User's can be click happy, and tend to not read things. Therefore, chances are they will read this warning, scratch their head, and continue on to the site. My thought was that since I am writing a robust Silverlight application, I should be able to either detect if the browser is seeing a certificate error, or perform that same verification that the browser performs. Then if I determine that there is a problem, I can simply lock down my entire app so that the user does not expose any critical information to the MITM. The problem that I am having is that I can't seem to find the right classes in Silverlight's limited subset of .NET to do what I need to do. Does anyone know how I can accomplish this goal, or a different way around this issue?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
据我所知，这是不可能的 - Silverlight 使用浏览器的网络堆栈，因此依赖于其网络警告和安全基础设施。
Silverlight 3 添加了一个新的网络堆栈，但我相信一般来说这同样适用：当浏览器下载 .xap（Silverlight 应用程序）时，您的主机服务器的证书将得到验证，而不是您可以在代码中检查或交互的东西。
This isn't possible as far as I know - Silverlight uses the browser's networking stack, and as a result relies on its networking warnings and security infrastructure.
Silverlight 3 added a new networking stack, but I believe that in general the same applies: your host server's certificate is validated when the .xap (Silverlight application) is downloaded by the browser, and not something you can check or interact with in code.
恕我直言，您可以检查本地存储的证书，因为浏览器将在 SSL 请求后保存它的副本。
请查看这篇文章。 我希望它能给你一些提示
IMHO You may check the certificate that is stored locally since browser will save a copy of it after SSL request.
Check out this article. I hope it will give you some hints