WPF 应用程序中的 WCF 数据服务安全性
我正在开发一个解决方案，其中我有一个 WPF 项目，该项目使用位于另一个 ASP .NET 项目中的 WCF DataService 来访问数据。
我需要提供一定程度的安全性，确保只有经过身份验证的用户才能访问该服务。上网冲浪后，我为了实现这一目标而伤透了脑筋。实施该方法的正确方法是什么？
I'm working on a solution where I have a WPF project that is using a WCF DataService which is located in another ASP .NET project to access the data.
I need to provide a level of security which ensures that only authenticated users can access the service. Having surfed the net I've broken my head trying to accomplish that. What is the proper way to implement that?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
我过去这样做过，WCF 的
Login方法将创建一个用户对象，为该用户对象分配一个令牌（在我的例子中，它是一个 GUID），并将其内部存储在 WCF 服务器上AuthenticatedUsers列表。任何其他 WCF 调用都需要令牌作为参数。它将检查具有该令牌的
AuthenticatedUsers列表中是否存在用户，如果不存在具有该令牌的用户，则会返回错误。另一个好处是我总是知道谁发出了 WCF 调用，而不需要他们传递用户 ID。我还在服务器上存储了
LastActivityDateTime 和 User 对象。每个 WCF 调用都会刷新此值，并且提供 WCF 服务器上的 AuthenticatedUsers 列表至少有一个值，服务器上运行一个计时器来检查 AuthenticatedUsers 的 LastActivity 值如果用户处于非活动状态超过 20 分钟，则删除该用户。I did this in the past where the WCF's
Loginmethod would create a user object, assign the user object a Token (in my case, it was a GUID), and store it internally on the WCF server in anAuthenticatedUserslist.Any other WCF call required the token as a parameter. It would check if a user existed in the
AuthenticatedUserslist with that token, and would return an error if the no User with that token existed. An added benefit is I would always know who made the WCF call without needing them to pass in a User Id.I also stored a
LastActivityDateTime with the User objects on the server. Each WCF call would refresh this value, and providing theAuthenticatedUserslist on the WCF server had at least one value, a Timer ran on the server which would check the AuthenticatedUsersLastActivityvalue and delete the user if they had been inactive for over 20 minutes.