WCF 安全问题
首先，对这个虚拟问题表示抱歉。在互联网上找不到任何直接答案。
我是 WCF 新手（并且通常使用服务），希望获得一些有关我的安全问题的信息。
假设我有一个在 .Net 下编写的开源 Web 应用程序，它有一个 WCF 服务，可以通过 ajaxified 方法更改站点用户的配置文件数据。 （例如，当用户更改其位置时，将从客户端调用我的服务方法之一，该方法负责更新数据库中的用户数据。）
现在，我不明白的是，由于我的网络应用程序是开源的，所以每个人都可以看到该服务公开的方法。任何人都可以在其应用程序中调用这些方法或以某种方式使用其自定义值篡改数据吗？如果是这样，我应该采取什么安全措施，以便只有我的应用程序可以调用我的服务的方法？
First of all, sorry for the dummy question. Couldn't find any straight answer on the internet.
I'm new to WCF (and using services in general) and would like to get some information about my security concerns.
Suppose I have an open source web application written under .Net which has a WCF Service to change the site users' profile data in an ajaxified approach. (e.g. When a user changes his location, a call from the client side will be made to one of my service's methods which has the responsibility to update the user data in the database.)
Now, what I don't understand is that since my web app is open source, everyone can see the methods exposed by the service. Is it possible for anyone to call those methods within their applications or somehow tamper the data with their custom values? If so, what security measures should I take so that ONLY my application can call my service's methods?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您的应用程序是开源的这一事实不应使其本质上不那么安全。无论开放还是封闭，您仍然必须确保只有经过身份验证的用户才能访问私有数据。即使您可以将该应用程序设为您的 Web 服务的唯一用户，也无法阻止未经授权的用户在粗心的用户桌面上访问您的应用程序。您能做的最好的事情就是确保您的 Web 服务公开的数据只能根据您的安全策略进行访问。例如，您无法阻止用户将密码和用户 ID 敲到键盘上。
这里有一大堆 WCF 安全场景，应该阐明如何解决您的特定问题 - 最佳解决方案取决于您的应用程序环境。
The fact that your app is open source should not make it inherently less secure. Open or closed, you still have to make sure that only authenticated users access private data. Even if you could make the application your web service's sole user, there is nothing to stop an unauthorized user from accessing your application on a careless user's desktop. The best you can do is to ensure that the data your web service exposes is only accessed in accordance with your security policy. You cannot stop your users from taping their password and userid to their keyboard, say.
There are a whole bunch of WCF security scenarios here that should clarify how to resolve your particular issue - the best solution depends on your app's environment.
使用数字证书，您可以保护您的 WCF Web 服务，以便只有您可以使用它。数字证书用于识别、验证和授权用户。
有关使用数字证书的详细信息，请参阅此文章：http://msdn.microsoft.com /en-us/library/ms731899.aspx
Using digital certificates, you can secure your WCF web service so that only you can use it. Digital certificates are used to identify, authenticate and authorize users.
See this article for more on using digital certificates: http://msdn.microsoft.com/en-us/library/ms731899.aspx