如何确保真实的 silverlight 客户端正在调用我的 azure 服务
我如何确信只有我们的 silverlight 应用程序正在调用我们的 azure 服务？
silverlight 客户端需要对用户进行身份验证并拥有执行操作的正确权限，但我不知道在这些 azure 服务调用上通常如何实现应用程序真实性。我知道您可以签署该应用程序（客户端更新所需）。这与 ssl 连接结合起来足够吗？我应该在客户端使用证书吗？
解决这个问题有哪些常见的方法？
How can I be confident that only our silverlight applications are calling our azure services?
The silverlight client will need to have a user authenticated and have the correct permissions to perform an action but I did not know how application authenticity is commonly implemented on these azure service calls. I know you can sign the application (required for client updates). Is this combined with ssl connections enough? Should I be using a cert at the client?
What are some common approaches to this problem?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
您可以将数据放入邮件标头中。使用 SOAP 时，您可以在 SOAP 标头中执行此操作；使用 REST 时，您可以在 HTTP 标头中执行此操作。完成此操作后，您可以使用安全的 SSL 通道进行通信，这样人们就无法嗅出您的包。
http:// /blogs.msdn.com/b/nathana/archive/2007/05/29/custom-soap-headers-wcf-and-asmx.aspx
当您使用 RIA 服务并且想要添加数据时HTTP标头然后查看我的博客：
http://strugglesofacoder.blogspot.com/2011/02/normal-0-21-false-false-false-nl-be-x.html
You can put data inside your message headers. You can do it in the SOAP header when using SOAP or in the HTTP header when using REST. Then when you've done this you can use a secure SSL channel to communicate so people can't sniff out your packages.
http://blogs.msdn.com/b/nathana/archive/2007/05/29/custom-soap-headers-wcf-and-asmx.aspx
When you're using RIA service and you want to add data in the HTTP header then see my blog:
http://strugglesofacoder.blogspot.com/2011/02/normal-0-21-false-false-false-nl-be-x.html
Silverlight 没有办法向服务标识自己的身份，即使可以，一个名为 Fiddler 的小工具也会公开所有这些信息，供任何人利用您的服务。
您不应该对客户做出任何假设。您的服务应该对传入请求进行验证，而不是尝试确定客户端是谁/什么。
我确实希望有人能找到解决方案，因为我还没有找到解决方案，而且我很想保护我的服务，以便只有 Silverlight 可以发出请求。
Silverlight does not have a way of identifying itself to the service, and even if it does, a little tool called Fiddler will expose all that information for anyone to exploit your services.
You should assume nothing about the client. Your services should perform validation on the incoming requests without trying to determine who/what the client is.
I do hope someone has a solution because I haven't found one yet, and I'd love to secure my services so that only Silverlight can make requests.
您可以使用访问控制服务来执行此操作，ACS 团队的某个人在 codeplex 上编写了一个很好的示例：
http://acs.codeplex.com/wikipage?title=ACS%20Windows%20Phone%20Sample&referringTitle=Samples
虽然它是 Windows Phone 7 客户端（这也是 silverligh），我认为你可以从中提取你需要的东西。
You could do this using the Access Control Service, there is a nice example on codeplex written by someone of the ACS team:
http://acs.codeplex.com/wikipage?title=ACS%20Windows%20Phone%20Sample&referringTitle=Samples
although it is a windows phone 7 client (which is also silverligh), i think you can distill what you need from it.
在与 ACS 集成时，Silverlight 是一个棘手的野兽，似乎从 Silverlight 写入标头以传递身份验证信息非常棘手 - 没有一种简单的方法来拦截调用以将它们与 auth 标头包装在一起Silverlight，就像您在 ASP.NET 应用程序中所做的那样。
您可以使用 ACS 将您的标识信息获取到 Silverlight，方法如下例所示：http: //channel9.msdn.com/Events/MIX/MIX10/SVC01
我最终所做的是将一些唯一标识符声明包装在 SWT 令牌中，并使用 Silverlight 和 Web 服务都知道的密钥进行签名，并且让 Web 服务验证该用户是否具有访问权限。通过将唯一标识符放在签名的 SWT 令牌中（过期时间非常短，以帮助减少人们复制有效请求并稍后再次发送的攻击），我可以更放心地相信该请求是真正来自我的 Silverlight 应用程序。
为了传递令牌，我刚刚创建了一个类，其中包含我想要传递的所有参数（这样我就不必继续重写函数定义），包括 SWT 令牌。
希望这有帮助。
Silverlight is a tricky beast when it comes to integrating with ACS, it seems that writing to the headers from Silverlight to pass authentication information along is very tricky - there isn't an easy way to intercept the calls to wrap them with the auth header in Silverlight, like you could do in an ASP.NET application.
You can use ACS to get your identifying information to Silverlight by using an approach like this example: http://channel9.msdn.com/Events/MIX/MIX10/SVC01
What I ended up doing is wrapping some unique identifier claim in a SWT token, signed with a key that's known by both Silverlight and the web service, and having the web service verify that that user has access. By placing the unique identifier in a signed SWT token (with an expiration time of a very short amount - to help reduce attacks where folks copy a valid request and send it again at a later time), I could more comfortably believe that the request was truly coming from my Silverlight app.
To pass the token, I just made a class that contains all the parameters I want to pass (that way I didn't have to keep rewriting the function definitions), including the SWT token.
Hope this helps.