如何在 VB.Net 桌面应用程序和 ASP.Net Web 应用程序之间进行匿名身份验证
我正在寻找一种将某种凭据或授权令牌从 VB.Net 客户端传递到 ASP.Net Web 应用程序的方法，该应用程序允许客户端自动登录到我们的表单验证网站。如果用户登录到本地应用程序，我希望他们能够查看一些网页，而无需登录网站。应用程序之间的凭据不相同，但我只想将某种加密令牌或密钥传递到网页，以便我知道它们来自桌面应用程序。是否可以不需要用户名和密码登录？
我还需要确保所使用的 URL 不能简单地从另一个位置复制和使用，因此我需要在加密值中包含某种信息以了解它来自哪里。
我知道如何使用表单身份验证登录用户以及所有这些，只需要找出保护这一点的最佳方法。谢谢！
I'm looking for a way to pass some sort of credentials or Authorization token from a VB.Net Client to an ASP.Net web application that allows the Client to auto-login to our Forms-Authenticated website. If a user is logged into a local application, I want them to be able to view some web pages without having to login to the website as well. The credentials are not the same between the apps, but I would just like to pass some sort of encrypted token or key to the web page so I know they are coming from the desktop application. Is this possible without requiring a username and password login?
I also need to make sure this URL that is used cannot be simply copied and used from another location, so I'll need to include some sort of information in the encrypted value to know where it's coming from.
I know how to login the user with Forms Authentication and all that, just need to figure out the best way to secure this. Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
OAuth 通常用于允许桌面应用程序访问网站上用户的私人数据。由于您使用的是 .NET，我建议您查看 DotNetOpenAuth，其中包括示例 OAuth 网站和客户端应用程序。它允许传递此安全令牌，该令牌可以告诉您的网站桌面应用程序是发出请求的应用程序并且（通常）正在访问其数据。
OAuth 解决方案的最佳部分是您的桌面应用程序永远不需要询问用户的凭据。 URL 中没有凭据。如果桌面应用程序遭到破坏（可能是由于计算机被盗），网站可以杀死桌面应用程序用来切断访问的安全令牌，而无需用户更改密码。
OAuth is commonly used to allow desktop applications to access a user's private data on a web site. Since you're using .NET, I suggest you check out DotNetOpenAuth which includes sample OAuth web sites and client applications. It allows for this secure token to be passed that can tell your web site that the desktop app is the one making the requests and (usually) whose data is being accessed.
The best part about the OAuth solution is your desktop app never has to ask for the user's credentials. No credentials are in the URL. And if the desktop application is ever compromised (perhaps by the computer being stolen), the web site can kill the secure token the desktop app was using to cut off access without requiring the user to change their password.
您可能想考虑为这些应用程序颁发客户端证书。基本上，您生成一个与客户端应用程序一起安装的证书，然后在服务器端检查当前上下文中的 Request 属性公开的 HttpRequest 实例的 ClientCertificate 属性。
请注意，您所做的确实是一个非常糟糕的主意，因为应用程序不应永远分配身份，而只能分配用户。为此，您应该对使用您的应用程序的每个用户进行身份验证，而不是将应用程序视为身份。这样做通常被认为是不好的做法。
You might want to look into issuing client-side certificates for these applications. Basically, you generate a certificate that you install with the client application and then on the server side, you check the ClientCertificate property of the HttpRequest instance exposed by the Request property on the current context.
Note that what you are doing is really a very bad idea, in that applications should never be assigned identity, only users. To that end, you should be authenticating each and every user that is using your app, not considering the application to be the identity. It's commonly considered a bad practice to do such a thing.
您可以使用 ASP.NET 客户端应用程序服务在应用程序之间共享凭据。
以下是一些资源：
客户端应用程序服务
使用 Visual Studio 2008 的客户端应用程序服务
You can share credentials between the applications using ASP.NET Client Application Services.
Here are some resources:
Client Application Services
Client Application Services with Visual Studio 2008
您的桌面应用程序是否在与您的 Web 服务器位于同一域中的计算机上运行（即全部位于同一家公司）？如果是这样，集成 Windows 身份验证是您最简单的解决方案。
Is your desktop app running on machines that are in the same domain as your web server (i.e. all in the same company)? If so, Integrated Windows Authentication is your easiest solution.
我认为最好的主意是在桌面应用程序中使用 Web 浏览器控件。
然后最有可能使用
WebBrowser1.Document在用户登录时获取。
I think its best idea to use a web browser control inside the desktop application .
Then use the
WebBrowser1.Documentmost probablyget if the user is singed in.
如果您将加密值存储在 cookie 中或作为表单中的字段（POST 请求），则凭证不再位于 URL 中，因此无法轻松复制（请注意，我说的是“轻松”）。
If you store the encrypted value in a cookie or as a field in a form (POST request), then the credential is no longer in the URL and so it can't be easily copied (note that I said "easily").