wcf：添加用戶名到郵件頭是否安全？

Question

我正在連接到ASP.NET應用程序中的WCF服務。我使用一個用戶名和密碼登錄，並在消息頭中傳遞whoevever的實際用戶名登錄到ASP.NET Web應用程序中，如下所示。

using (OperationContextScope scope = new OperationContextScope(myService2.InnerChannel)) 
    { 
    Guid myToken = Guid.NewGuid(); 

    MessageHeader<string> messageHeader = new MessageHeader<string>(HttpContext.Current.User.Identity.Name); 
    MessageHeader untyped = messageHeader.GetUntypedHeader("token", "ns"); 

    OperationContext.Current.OutgoingMessageHeaders.Add(untyped); 

    lblResult.Text = myService2.GetData(1231); 
    } 

我還使用一個服務證書如下

 <serviceCredentials> 
     <serviceCertificate findValue="CN=tempCert" /> 
     <userNameAuthentication userNamePasswordValidationMode="MembershipProvider" 
      membershipProviderName="MySqlMembershipProvider" /> 
     </serviceCredentials> 

我擔心什麼是這個足夠的保護是否阻止人們越來越善於保存在郵件標題中的用戶名？

ASP.NET配置是

<system.serviceModel> 
    <behaviors> 
     <endpointBehaviors> 
      <behavior name="NewBehavior"> 
       <clientCredentials> 
        <serviceCertificate> 
         <authentication revocationMode="NoCheck"/> 
        </serviceCertificate> 
       </clientCredentials> 
      </behavior> 
     </endpointBehaviors> 
    </behaviors> 
    <bindings> 
     <wsHttpBinding> 
      <binding name="wsHttpEndpoint" closeTimeout="00:01:00" openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00" bypassProxyOnLocal="false" transactionFlow="false" hostNameComparisonMode="StrongWildcard" maxBufferPoolSize="524288" maxReceivedMessageSize="65536" messageEncoding="Text" textEncoding="utf-8" useDefaultWebProxy="true" allowCookies="false"> 
       <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384" maxBytesPerRead="4096" maxNameTableCharCount="16384"/> 
       <reliableSession ordered="true" inactivityTimeout="00:10:00" enabled="false"/> 
       <security mode="Message"> 
        <transport clientCredentialType="Windows" proxyCredentialType="None" realm=""/> 
        <message clientCredentialType="UserName" negotiateServiceCredential="true" algorithmSuite="Default" establishSecurityContext="true"/> 
       </security> 
      </binding> 
     </wsHttpBinding> 
    </bindings> 
    <client> 
     <endpoint address="http://localhost/WCFTestService/Service.svc" behaviorConfiguration="NewBehavior" binding="wsHttpBinding" bindingConfiguration="wsHttpEndpoint" contract="WCFTestService.IService" name="wsHttpEndpoint"> 
      <identity> 
       <certificate encodedValue=""/> 
      </identity> 
     </endpoint> 
    </client> 
</system.serviceModel> 

，並在服務端的

<system.serviceModel> 
<bindings> 
    <wsHttpBinding> 
    <binding name="wsHttpEndpointBinding"> 
     <security> 
     <message clientCredentialType="UserName" /> 
     </security> 
    </binding> 
    </wsHttpBinding> 
</bindings> 
<services> 
    <service behaviorConfiguration="ServiceBehavior" name="Service"> 
    <endpoint address="" binding="wsHttpBinding" bindingConfiguration="wsHttpEndpointBinding" 
     name="wsHttpEndpoint" contract="IService"> 
     <!--<identity> 
     <dns value="" /> 
     </identity>--> 
    </endpoint> 
    <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" /> 
    </service> 
</services> 
<behaviors> 
    <serviceBehaviors> 
    <behavior name="ServiceBehavior"> 
     <serviceMetadata httpGetEnabled="true" /> 
     <serviceDebug includeExceptionDetailInFaults="false" /> 
     <serviceCredentials> 
     <serviceCertificate findValue="CN=tempCert" /> 
     <userNameAuthentication userNamePasswordValidationMode="MembershipProvider" 
      membershipProviderName="MySqlMembershipProvider" /> 
     </serviceCredentials> 
    </behavior> 
    </serviceBehaviors> 
</behaviors> 

Answer 1

最大的問題是：你有什麼樣的交通工具級或MESSAGE-的您的綁定啓用了級別安全性？你使用什麼綁定？

如果您具有傳輸級別的安全性（通常通過使用SSL上的HTTPS），那麼您將擁有一個我認爲非常安全的點對點加密傳輸通道。

如果您在客戶端也有使用證書的消息級安全性，並且您對整個消息進行了加密，那麼您應該也是安全的。

這真的歸結爲您使用的綁定以及您在綁定中使用的安全設置。向我們展示服務器的配置！

Marc