WCF netTcpBinding MaxReceivedMessageSize 和自定义用户名密码验证
我正在构建一个 WCF 服务，该服务在具有消息级安全性的 netTcpBinding 上使用自定义用户名/密码验证。我一直在研究 MaxReceivedMessageSize 设置，并且收到了一个相当技术性的查询。我注意到，当您指定自定义用户名验证器时，它会在 WCF 管道的深处被调用（我想是在握手期间）。
如果我有一个相对较大的 MaxReceivedMessageSize 1MB，WCF 会离线读取整个消息然后进行身份验证，还是会先进行身份验证并以某种方式丢弃消息的其余部分？
我查询的原因是 DoS 攻击。我希望由于身份验证，该服务能够免受大消息 DoS 攻击。
I'm building a WCF Service that uses Custom Username/Password validation on netTcpBinding with message level security. I've been researching MaxReceivedMessageSize settings and I've got a query of a rather technical nature. I've noticed that when you specify a custom username validator that it gets called deep inside the plumbing of WCF (during handshaking I suppose).
If I have a relatively large MaxReceivedMessageSize of 1MB, will WCF read the entire message off the line and then do authentication, or will it first do the authentication and somehow discard the rest of the message?
The reason for my query is DoS attacks. I am hoping that due to the authentication the service would be immune to large message DoS attacks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我相信完整的消息已加载。消息首先由传输通道处理，该通道没有任何有关消息安全的信息。因此，通道使用选定的编码器读取整个消息并创建消息实例。该实例将被传递到进一步处理，包括消息安全检查。唯一的例外是当您使用流式传输模式时。在这种情况下，只有消息头在接收通道中被读取并放置到缓冲区中。
为了证明这一点，您还可以打开消息日志记录，它能够在传输级别和服务级别记录消息。传输级别是从传输接收的消息，服务级别是在服务处接收的消息（在所有安全处理之后）。因此该消息已在传输级别被读取。
I believe that full message is loaded. The message is first processed by transport channel which doesn't have any information about message security. So the channel reads the whole message with using selected encoder and creates Message instance. This instance is passed to futher processing including message security checking. The only exception is when you use Streamed transfer mode. In that case only message headers are read in receiving channel and placed to buffer.
To prove this you can also turn message logging which is able to log messages on transport level and at service level. Transport level is message received from transport, service level is message received at service (after all security processing). So the message is already read at transport level.