如何在 RESTful WCF API 中实现 HMAC 身份验证
我们正在使用 WCF（当前为 .Net 3.5，但很快将迁移到 .Net 4）构建 RESTful API。我们有一个功能框架，但目前不安全。需要可以从 .Net 应用程序以及 iOS、Android 和 Web 应用程序访问它。
我们希望使用此处和
任何人都可以解释如何在这些示例中生成/存储/检索/使用“用户密钥”/令牌，或者提供如何在 RESTful WCF 服务中使用 HMAC 授权的更好示例（如果可能的话，提供源代码）？
编辑： 经过更多研究，我们确定我们需要更多的“授权”技术，而不是“身份验证”技术（语义？）。我们实现了基本授权并保护 SSL 后面的 API。基本授权使用与 HMAC 身份验证方案相同的 Web 请求中的“授权”标头，但传递以 Base64 编码的用户名：密码字符串而不是令牌。这使我们能够根据数据库对用户进行自定义验证，以确定该用户是否获得许可并具有访问所需 API 方法的适当安全权限。
我们当然愿意听到有关如何完成自定义用户名/密码验证以及其他保护 API 的方法的其他选项。
We are building a RESTful API using WCF (currently .Net 3.5, but will be moving to .Net 4 soon). We have a functional framework in place, but it is currently unsecured. It will need to be accessible from .Net applications as well as iOS, Android, and web applications.
We would like to use an HMAC Authentication scheme as described here and here, but both examples seem to fall apart when describing how to validate the hash. The first example fails to describe the UserKeys object (hashtable?) and the second example is missing the GetUserKey methods on the client- and server-side.
Can anyone provide an explanation of how the "User Key"/token is generated/stored/retrieved/used in those examples or provide a better example (with source code, if possible) of how to use HMAC Authorization in a RESTful WCF service?
Edit:
After more research, we determined that we needed more of an "Authorization" technique rather than an "Authentication" technique (semantics?). We implemented Basic Authorization and secured the API behind SSL. The Basic Authorization uses the same "Authorization" header from the web Request as the HMAC Authentication scheme, but passes a username:password string encoded in Base64 instead of a token. This allowed us to custom-validate a user against our database to determine if the user is licensed for and has appropriate security rights to access the desired API method.
We're certainly open to hearing other options on how to accomplish custom username/password validation and other methods for securing the API.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
检索用户密钥只是一个实现细节，您可以按照自己喜欢的方式进行操作，但在服务器上，它通常与用户名一起存储在数据库中。
基本方法非常简单。
实际上，唯一棘手的部分是与用户共享密钥并保证其安全。这就是为什么某些服务允许生成具有有限生命周期的共享密钥，这样您就可以将密钥交给第三方来暂时代表您工作。
Retrieving the user key is just an implementation detail you can do any way you like but on the server it is often stored in a database along with the user name.
The basic approach is real simple.
Really the only tricky part is sharing a secret key with the user and keeping that secure. That is why some services allow for generation of shared keys with a limited life time so you can give the key to a third party to temporarily work on your behalf.
找到 HMAC 的实现
我们可以在https://github.com/cuongle/WebAPI.Hmac
Implementation for HMAC we can find at
https://github.com/cuongle/WebAPI.Hmac