Question

我在IIS6（以及开发环境中的7个）中托管了一个WCF应用程序，其中包含一个wsHttp（SOAP）和两个webHttp（REST）绑定。

我想在发布到生产站点时保护服务并禁用元数据和webHttp帮助页面以及绑定的ENABLE SSL。同时我想禁用HTTP。我知道IIS中的选项是“要求安全通道”，但我想知道在web.config中是否可以实现相同的效果？

我的印象是

<security mode="Transport">

将“禁用”http访问（即需要https）但在我的情况下它没有。

她是web.config的ServiceModel部分：

<system.serviceModel>
<bindings>
  <wsHttpBinding>
    <binding name="SoapTransportSecurityBinding">
      <security mode="Transport">
        <transport clientCredentialType="None"/>
        <message establishSecurityContext="false"/>
      </security>
    </binding>
  </wsHttpBinding>
  <webHttpBinding>
    <binding name="RestTransportSecurityBinding">
      <security mode="Transport">
        <transport clientCredentialType="None"/>
      </security>
    </binding>
  </webHttpBinding>
</bindings>
<services>
  <service name="CustomerWcfService" behaviorConfiguration="Web.ServiceBehavior">
    <endpoint address="" binding="wsHttpBinding" bindingConfiguration="SoapTransportSecurityBinding" contract="ICustomerWcfService">
      <identity>
        <dns value="ws.somecompany.com"/>
      </identity>
    </endpoint>
  </service>
  <service name="SentShipmentsWcfRestService" behaviorConfiguration="webHttpServiceBehavior">
    <endpoint address="" binding="webHttpBinding" bindingConfiguration="RestTransportSecurityBinding" contract="ISentShipmentsWcfRestService"
      behaviorConfiguration="RestEndpointBehavior"/>
  </service>
  <service name="InsuranceInfoWcfRestService" behaviorConfiguration="webHttpServiceBehavior">
    <endpoint address="" binding="webHttpBinding" bindingConfiguration="RestTransportSecurityBinding" contract="IInsuranceInfoWcfRestService"
      behaviorConfiguration="RestEndpointBehavior"/>
  </service>
</services>
<behaviors>
  <serviceBehaviors>
    <behavior name="Web.ServiceBehavior">
      <serviceDebug includeExceptionDetailInFaults="false"/>
    </behavior>
    <behavior name="webHttpServiceBehavior">
      <serviceDebug includeExceptionDetailInFaults="false"/>
    </behavior>
  </serviceBehaviors>
  <endpointBehaviors>
    <behavior name="RestEndpointBehavior">
      <webHttp helpEnabled="false"/>
    </behavior>
  </endpointBehaviors>
</behaviors>

Answer 1

看起来无法在web.config中实现。但在绑定设置中，您可以设置

      <security mode="Transport">

在这种情况下，如果不需要SSL，端点将无效。

IIS中的WCF + SSL / HTTPS（6）。如何在web.config中禁用HTTP访问？

1 个答案: