.net webservice需要对Android客户端进行身份验证
我有一个 Android 应用程序，它使用 http get 与 .net 2 webservice (IIS7) 进行通信，并设法使其使用自签名服务器证书（但不需要客户端证书）在 https 上运行。 我看到所有 http 流量都已加密，看起来很安全。
现在我对如何验证客户端有什么选择？例如，我喜欢阻止 PC 上的 Internet Explorer 访问 Web 服务。
这里描述的客户端验证的 TLS 握手会是一种方法吗？ 那我怎样才能做到这一点呢？一些建议或例子将不胜感激。
I have Android app that talks to .net 2 webservice (IIS7) using http get and managed to make it run on https using self-signed server certificate (but not requiring client certificate).
I see all http traffic is encrypted and it looks secure.
Now what options would I have on how to authenticate client? For example, I like to block webservice access from internet explorer on PC.
Client-authenticated TLS handshake described here would be a way to go?
Then how can I accomplish that? Some advice or example will be appreciated.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
好吧，考虑到每个用户无论如何都应该进行身份验证，您可能出于各种原因想要设置某种每用户身份验证策略。首先，考虑到这可能是一个广泛分布的应用程序，拥有单个“金牌大师”身份验证证书或凭证最终将失败，因为有人会破解它 - 要么获取证书，要么获取帐户。然后你该怎么办？其次，它并不是特别难处理。您可以轻松地使用 ASP.NET 成员身份来支持它，然后根据服务的性质通过多种方式获取凭据。第三，它比客户端证书更容易管理。
Well, given that each user should authenticate anyhow, you probably want to setup some sort of per-user authentication strategy for a variety of reasons. First, given this might be a widely distributed app, having a single "gold master" authentication certificate or credentials will ultimately fail as someone will hack it -- either grabbing the cert or grabbing the account. And then what do you do? Second, its not particularly hard to handle. You can easily use ASP.NET membership to back it, and then take the credentials a number of ways depending on the nature of the service. Third, it is alot easier to manage than client certificates.