我已经使用 [ScriptService] 属性启动并运行了 ASP.NET Web 服务。从我从这篇文章中读到的内容：
http://weblogs.asp.net/scottgu/archive/2007/04/04/json-hijacking-and-how-asp-net-ajax-1-0-mitigates-这些攻击。 aspx
ASP.NET 默认情况下不允许 JSONP 请求（通过注入 DOM 来拒绝跨域请求。它通过采取 2 种措施来做到这一点：
1）仅接受 POST 请求（通过 GET 进行脚本注入）
2) 拒绝发送除“Content-type: application/json”（浏览器不会发送）之外的 HTTP 标头 Content-type 的连接。
我熟悉跨域问题，我知道 JSONP 是什么，并且我完全理解为什么 ASP.NET 默认受到这种方式的限制。
但现在，我的网络服务是公共的，应该向所有人开放。因此，我明确需要通过 Javascript 向我的 Web 服务启用跨域请求，以便外部网站可以通过我的 Web 服务从 jquery 等检索数据。
我已经介绍了步骤 (1)，通过这种方式修改 ScriptMethod 属性来允许通过 GET 发出请求：[ScriptMethod(UseHttpGet=true)]。我已经检查过 jQuery，GET 请求现在可以工作（在同一域上）。但如何才能解决点（2）呢？
我知道一些浏览器支持的Allow-Origin-*标头，但据我所知它还不是标准的，我不想强迫我的用户/客户修改他们的HTTP标头以使用我的网络服务。
总结一下：我需要良好的实践来通过 JSON 为公共 Web 服务启用 ScriptingService 的跨域请求。我的意思是必须有一种方法来公开 Web 服务，这就是大多数 Web 服务的目的吗？
I've got a ASP.NET Webservice up and running using the [ScriptService] Attribute. From what I've read from this article:
http://weblogs.asp.net/scottgu/archive/2007/04/04/json-hijacking-and-how-asp-net-ajax-1-0-mitigates-these-attacks.aspx
ASP.NET by defaults does not allow JSONP requests (injected into the DOM via to deny cross-domain-requests. Its does so by taking 2 measures:
1) only accept POST requests (script injection via always does GET)
2) deny connections sending a HTTP header Content-type other than "Content-type: application/json" (which browsers will not send).
I am familiar with the cross-domain issues and I know what JSONP is and I fully understand, why ASP.NET is by default restricted in that way.
But now, I have my webservice which is a public one, and should be open to everybody. So I explicitly need to enable cross-domain requests via Javascript to my Webservice, so that external websites can retrieve data via my webservice from jquery and alike.
I've already covered step (1) to allow requests via GET by modifiying the ScriptMethod Attribute this way: [ScriptMethod(UseHttpGet=true)]. I've checked with jQuery, GET requests now work (on same-domain). But how to get to fix point (2)?
I know about the Allow-Origin-* headers some browsers support, but afaik its not standard yet, and I don't want to force my users / customers to modify their HTTP headers for using my webservice.
To sum it up: I need the good practice to enable Cross-domain requests for ScriptingService for public Webservices via JSON. I mean there MUST be a way to have a Webservice public, that is what most webservices are about?
发布评论
评论（2）
使用旧版 ASMX 服务来做这样的事情似乎是注定失败的。 尝试 WCF由于其可扩展性，它很容易成为 JSONP已启用。因此，如果您寻求最佳实践，WCF 就是您应该在 .NET 平台上构建 Web 服务的技术。
或者，如果您目前确实无力迁移到 .NET 3.5，您也可以编写自定义 http 处理程序 (
.ashx) 来完成这项工作。Using legacy ASMX services for something like this seems like a lost cause. Try WCF which due to its extensible nature could very easily be JSONP enabled. So if you are asking for best practices, WCF is the technology that you should be building web services on the .NET platform.
Or if you really can't afford migrating to .NET 3.5 at the moment you could also write a custom http handler (
.ashx) to do the job.jQuery ajax() 函数确实有一个“crossDomain”属性。
粘贴自 jQuery.ajax()
crossDomain（已添加 1.5）
默认：同域请求为 false，跨域请求为 true
如果您希望在同一域上强制执行跨域请求（例如 JSONP），请将 crossDomain 的值设置为 true。例如，这允许服务器端重定向到另一个域
The jQuery ajax() function does have a 'crossDomain' property.
Pasted from jQuery.ajax()
crossDomain(added 1.5)
Default: false for same-domain requests, true for cross-domain requests
If you wish to force a crossDomain request (such as JSONP) on the same domain, set the value of crossDomain to true. This allows, for example, server-side redirection to another domain