Question

我已使用自定义用户名验证程序配置了新的Azure托管WCF服务。验证器类将验证Azure数据库中现有aspnetUsers表的用户名和密码。

我已使用TransportWithMessageCredentials绑定配置服务，因此客户端将在请求中以明文形式提供其用户名和密码。

然后，我的代码将查找用户并从数据库中获取其哈希密码，然后使用此密码来散列通过服务发送的密码。如果匹配则允许请求。

验证我使用此代码的密码。

 public static bool checkPassword(string hashedPassword, string password)
    {

        byte[] buffer4;
        if (hashedPassword == null)
        {
            return false;
        }
        if (password == null)
        {
            throw new ArgumentNullException("password");
        }
        byte[] src = Convert.FromBase64String(hashedPassword);
        if ((src.Length != 0x31) || (src[0] != 0))
        {
            return false;
        }
        byte[] dst = new byte[0x10];
        Buffer.BlockCopy(src, 1, dst, 0, 0x10);
        byte[] buffer3 = new byte[0x20];
        Buffer.BlockCopy(src, 0x11, buffer3, 0, 0x20);
        using (Rfc2898DeriveBytes bytes = new Rfc2898DeriveBytes(password, dst, 0x3e8))
        {
            buffer4 = bytes.GetBytes(0x20);
        }
        return ByteArraysEqual(buffer3, buffer4);
    }

所以我的问题是，用这种方式发送用户名和密码是否足够安全？由于一切都是通过https，我假设它是，但希望得到一些指导，因为我对安全性一般都是新手。

该服务也将受到IP限制。

这是我的服务模型配置。

 <system.serviceModel>
    <behaviors>
      <serviceBehaviors>
        <behavior name="MyServiceBehaviour">
          <serviceCredentials>
            <userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="MyValidatorClass,MyNameSpace" />
          </serviceCredentials>
          <!-- To avoid disclosing metadata information, set the values below to false before deployment -->
          <serviceMetadata httpGetEnabled="true" httpsGetEnabled="true" />
          <!-- To receive exception details in faults for debugging purposes, set the value below to true.  Set to false before deployment to avoid disclosing exception information -->
          <serviceDebug includeExceptionDetailInFaults="false" />
        </behavior>
      </serviceBehaviors>
    </behaviors>
    <bindings>
      <basicHttpBinding>
        <binding name="HttpBinding" maxReceivedMessageSize="2097152" receiveTimeout="00:02:00" sendTimeout="00:02:00">
        </binding>
        <binding name="HttpsBinding" maxReceivedMessageSize="2097152" receiveTimeout="00:02:00" sendTimeout="00:02:00">
          <security mode="TransportWithMessageCredential">
            <message clientCredentialType="UserName" />
          </security>
        </binding>
      </basicHttpBinding>
    </bindings>
    <services>
      <service name="MyService" behaviorConfiguration="MyServiceBehaviour">
        <endpoint address="" binding="basicHttpBinding" bindingConfiguration="HttpsBinding" contract="MyContract" />
        <host>
          <baseAddresses>
            <add baseAddress="https://MyServiceInAzure.net/" />
          </baseAddresses>
        </host>
      </service>
    </services>
    <protocolMapping>
      <add binding="basicHttpsBinding" scheme="https" />
    </protocolMapping>
    <serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />
</system.serviceModel>

以下是客户将使用的内容：

Client.Service call = new Client.ServiceClient();
        call.ClientCredentials.UserName.UserName = "MyUsername";
        call.ClientCredentials.UserName.Password = "MyPassword";

        var result = call.PostCall("Hello World");

谢谢

Answer 1

所以我的问题是，用这种方式发送用户名和密码是否足够安全？

是。由于通过HTTPS发送的所有内容都将被加密，因此您无需手动加密即可发送用户名和密码。根据我的意见，不建议每次向您的服务发送请求时都要发送用户名和密码。我建议您在第一时间生成令牌并使用令牌在一段时间内验证您的请求。

WCF服务TransportWithMessageCredentials客户验证器

1 个答案: