使用 Cookie 或替代方法保护 WFC/JSON 上的数据会话
我已经搜索了大约 5 个小时，以了解通过 WCF“保护”数据会话/登录会话的最佳方法。
一些事实：
- WCF 代码采用 C# 编写，并将在线托管供所有人使用（API）
- 将有一个单独的网站，使用 API 作为用户的 GUI
- 它也将被 iPhone、Android 和其他任何我使用的设备使用可以想到
- 数据将使用 JSON 发送
- 最重要的是：API 将通过 SSL 访问
选项 1 -
我一直在尝试使用 cookie 来保护对 API 系统的访问。我知道一种简单但粗糙的方法是像来自浏览器的 HTTP 请求一样提交请求并使用表单身份验证。我更愿意仅使用 JSON 和 Cookie 来完成此操作 - 假设我沿着这条路线走下去。
选项 2 -
关于 Cookie 的说法。我想到了另一种方法来实现这一点，也许这也是一种更安全的方法？我将通过 JSON 传递身份验证（自定义类）对象以及每次调用所需的对象。在此身份验证对象中，将有两个或多个成员：
- SessionID：这将是存储在 API 数据库中的 GUID
- HashValue：可能是 MD5 哈希，我还没有决定，将在每次调用时更新
更新的想法每次成功调用 API 时的 HashValue 都会更改客户端本地存储的身份验证对象，从而不会进行欺骗。至少我相信这一点，也许我错了？
注意： 该值将在服务器端生成、存储在数据库中并传回客户端。
我不确定该走哪条路。如果选项 2 是更好的方法，那么我就离开。
只有当选项 1 是最好的时候，我的问题是我实际上找不到如何在 API 端的 WCF 服务中设置 cookie。有什么指点吗？
感谢您的帮助。
I have search for roughly 5 hours now on what would be the best method to "secure" data sessions/login sessions over WCF.
Some facts:
- The WCF code is in C# and will be hosted online for all to use (API)
- There will be a separate website that uses the API as a GUI for users
- It will also be consumed by the iPhone , Android and anything else I can think of
- The data will be sent using JSON
- Most Importantly: The API will be accessed over SSL
Option 1 -
I have been toying with using cookies to secure access to the API system. I know an easy way, yet crude, is to submit a request as if it was a HTTP request from a browser and use Forms Authentication. I would prefer to do this using only JSON and Cookies - assuming I go down that route.
Option 2 -
That being said about Cookies. I thought of another way to accomplish this, maybe it is a more secure way also? I would to pass an authentication (custom class) object through JSON along with the object(s) required for each call. Within this authentication object there would be two or more members:
- SessionID: This would be a GUID which is stored in the API's database
- HashValue: Possible a MD5 Hash, I haven't decided, that will be updated on each call
The idea of updating the HashValue on each successful call made to the API is so that the client's locally stored authentication object will be changed so that no spoofing could be carried out. At least I believe this, maybe I am wrong?
Note: This value would be generated server side, stored in the database and passed back to the client.
I am unsure which way to go. If option 2 would be a better way then away I go.
Only if Option 1 is the best then my issue here is I actually cannot find how to set the cookie in the WCF service on the API side. Any pointers?
Thanks for your help.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
使用表单身份验证的优点是，您不必担心自己是否拥有安全/密码专业人士的专业知识。您可以使用已经强化的方法来安全地管理会话。此外，坚持使用 HTTP 协议可以限制防火墙问题，因为大多数地方都允许传出端口 80 和 443 流量。
您的选项 2 本质上是使用不断变化的哈希自行执行与表单身份验证相同的操作。通常，具有变化的值（哈希值或不可预测的值）称为随机数，并与 OAuth 一起使用。
考虑一下 OAuth 支持，因为它是独立于平台的，并且也已经为此编写了库。
但如果是我，并且我使用 C# 和 WCF，我会坚持使用表单身份验证，并将精力投入到 API 中的实际逻辑中，这是我的特殊专业知识。
The advantage of using Forms Authentication is that you then do not have to worry yourself with having the expertise of a security/cryptography professional. You can use an already hardened way to securely manage a session. Further, sticking with the HTTP protocol limits issues with firewalls as most places allow outgoing port 80 and 443 traffic.
Your option 2 is essentially doing the same thing as Forms Authentication yourself with a changing hash. Normally having a changing value (either hash or unpredictable value) is called a nonce and is use with OAuth.
Consider the OAuth support out there as it is platform independent and there are also already written libraries out there for that.
But if it were me and I'm using C# and WCF, I'd stick with Forms Authentication and put my effort into into the actual logic in the API that is my particular expertise.