RIA 服务身份验证 - 什么类型？防止“复制”？
我有一个 Silverlight 应用程序，它将在开放的互联网上运行，基本上每个曾经生活过的人都可以使用。
该应用程序利用 RIA 服务来操作服务器上数据库中的数据。
该应用程序创建、读取、更新和删除不同种类的数据，但我只希望这些操作在应用程序内部发生。
这就带来了两个问题：
- 对于使用哪种类型的身份验证有具体建议吗？表单还是 Windows？
- 有没有办法阻止某人“链接”到该应用程序？也就是说，从包含页面复制 HTML，将其粘贴到本地计算机上自己的 HTML 页面中并运行它？最终目标是仅允许应用程序在嵌入直接从我的服务器请求的页面中时运行，并且仅允许我的服务器运行？
I've got a Silverlight application that will be running out on the open internet, available to basically everyone who has ever lived.
The application makes use of RIA Services to manipulate data in a database on the server.
The application creates, reads, updates, and deletes data of different varieties, however I only want these operations to occur from within the application.
This brings about two questions:
- Is there a particular recommendation for what type of Authentication to use? Forms or Windows?
- Is there a way to prevent someone from "linking" to the application? That is to say, copying the HTML from the containing page, pasting it in their own HTML page on their local machine and running it? The end goal would be to only allow the application to be run when it is embedded in a page requested directly from my server and my server alone?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
如果您的应用程序在内部网络上使用，那么 Windows 身份验证是最好的。否则（如您的情况）请使用表单身份验证。
Silverlight 自动阻止应用程序（除非它们以更高的信任度运行）访问 Internet 上不来自应用程序起源的域的资源（Web 服务、HTML 等），除非该域具有跨域访问权限。域策略文件位于其根目录中。 Silverlight 运行时会阻止这种情况（而不是服务器），因此这是基于客户端的安全功能，而不是基于服务器的安全功能。如果您的服务器上没有跨域策略文件，您的应用程序将只能在从您的服务器运行时才能与您的域服务进行通信（正如您之后的情况）。应用程序将运行，但对这些服务的调用将失败。
如果您想阻止应用程序从其他域运行，您始终可以在代码中检查应用程序源自哪个域，并将其与硬编码的域名相匹配。
希望这有帮助......
克里斯
If your application is being used on an internal network, then Windows authentication is best. Otherwise (as is your case) use Forms authentication.
Silverlight automatically prevents applications (unless they're running with elevated trust) from accessing resources on the Internet (web services, HTML, etc) that are not from the domain that the application originated from, unless that domain has a cross-domain policy file in its root. The Silverlight runtime prevents this (not the server), so this a client based security feature - not server based. By not having a cross-domain policy file in place on your server, your application will only be able to communicate with your domain services when it is run from your server (as you are after). The application will run, but calls to those services will fail.
You could always do a check for what domain the application originated from in code, and match it to a hard-coded domain name if you want to prevent the application running at all from other domains.
Hope this helps...
Chris