保护对 WCF 服务的 JSON 调用的安全
我的 WCF 服务中有一个可以删除用户的方法。通过对我的 WCF 方法进行 JSON 调用，可以使用此功能。 （即：Users/Delete/20 将删除用户 20。）我怎样才能使输入 Users/Delete/20 的人无权删除该用户？或者有人伪造 JSON 请求。我已经阅读了 ValidateAntiForgeryToken 属性，但这似乎对我没有帮助。难道是我用错了？
I have a method in my WCF service which can delete a user. This functionality is available VIA a JSON call to my WCF method. (IE: Users/Delete/20 will delete user 20.) How can I make it so someone typing in Users/Delete/20 will not have access to delete the user? Or someone faking a JSON request. I have read up on the ValidateAntiForgeryToken attribute, but that doesn't seem to help me. Am I using it wrong?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
删除用户的功能可能已经实现了，因为确实允许某些人删除用户。您的服务需要的是身份验证（识别用户）和授权（检查只有获得许可的用户才能执行某些方法）。
如果您有适当的身份验证和授权，那么您无需担心哪些客户端访问您的服务。
如果您提供更多信息，我可以更具体。谁有权删除用户？他们使用什么客户端？谁不允许删除用户？有权删除用户的人可以删除任何用户吗？或者他们只能删除某些用户（例如属于同一部门的用户）？
（并且请使您的删除方法只能作为 POST 请求执行，而不能作为 GET 请求执行。）
The function to delete a user has probably been implemented because certain people are indeed allowed to delete a user. What your service needs is authentification (identifying the user) and authorization (checking that only permissioned user can execute certain methods).
If you have authentication and authorization in place, then you don't need to worry about what client access your service.
I could be more specific if you provide more information. Who's allow to delete users? What client are they using for that? Who's not allowed to delete users? Can those who are allowed to delete users delete any users? Or can they only delete certain users (such as those belonging to the same department)?
(And please make your delete method a method that can only be executed as a POST request and not as a GET request.)