使用 SOAP 进行安全连接
我需要以安全的方式调用 .NET SOAP Web 服务。它必须是安全的，以便其他人无法调用 WebService 方法，并且“中间人”也不应该理解消息的内容。
调用者也将是安装在另一个 IIS 上的 .NET Web 应用程序。 我可以根据需要设计 Web 服务方法，因此没有任何限制。
我一直在研究带有证书的HTTPS/SSL，但我不知道它是否真的能很好地解决我的问题？例如，如果证书有过期日期，那将会很烦人，尽管它无论如何都不是一个问题。
那么我该如何以一种好的方式解决这个问题呢？
感谢您的任何帮助。
I need to call a .NET SOAP webservice in a secure way. It must be secure in such a way that others can't call the WebService methods, and also it should not be possible for "the middle man" to understand the content of the messages.
The caller will also be a .NET webapplication installed on another IIS.
I can design the webservice methods as I want, so no restrictions there.
I have been researching HTTPS/SSL with certificates, but I don't know if it actually solves my problems in a good way? For example, it would be anoying if the certificates has an expiration date, although it's not a showstopper in any way.
So how would I go about this in a good way..?
Thanks for any help.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
正如@BrokenGlass 所说，SSL 仅加密点之间的流量。它不负责保护单个功能免遭未经授权的使用。这里有一篇关于使用 SOAP 标头的主题的好文章：
如何：使用 SOAP 标头执行自定义身份验证
这可以与除 Windows 集成之外的任何形式的身份验证混合使用。要使用 Windows 身份验证，您需要有一个单独的库，可以通过 DirectoryServices 命名空间访问 Active Directory。
As @BrokenGlass said, SSL only encrypts the traffic between points. It doesn't handle securing individual functions from usage without authorization. Here is a good article on just such a topic using SOAP headers:
How to: Perform Custom Authentication Using SOAP Headers
This can be mixed with any form of authentication except Windows Integrated. To use Windows authentication, you'll need to have a separate library which accesses the Active Directory through the DirectoryServices namespace.
假设您控制基础设施，然后将提供 Web 服务的服务器置于防火墙后面，以便只能从 Web 服务器访问它，并且实施 IPSec 应该提供必要的安全性。
从软件的角度来看，本文包含您需要了解的所有内容关于保护服务交互。
Assuming you control the infrastructure then keeping the server that is providing the web services behind a firewall so it's accessible only from the web servers and implementing IPSec should provide the necessary security.
From the software point of view, this article contains all you need to know about protecting the service interactions.
HTTPS/SSL 工作正常。只需确保及时更新您的证书，以避免向您的客户发出警告和消息。
HTTPS/SSL works fine. Just make sure to renew your certificate in time to avoid warnings and messages for your client.
HTTPS/SSL 只解决了您想要实现的“中间人”部分。您仍然需要在网络服务上进行适当的身份验证。您可以使用内置的 表单身份验证 来执行此操作并提供一个返回您的身份验证票证的登录方法。
HTTPS/SSL only solves the "middle man" part of what you want to achieve. You would still need proper authentication in place on your web service. You could do this i.e by using the built in Forms authentication and providing a Login method that returns your authentication ticket.