WebService的两种用户验证方式分析
1,使用SoapHeader传递和验证用户
Web Service端的代码: 1.1先创建一个继承自System.Web.Services.Protocols.SoapHeader CredentialSoapHeader类: public class CredentialSoapHeader : SoapHeader { private string _userName ; private string _userPassword ;public string UserName
{ get { return _userName ; } set { _userName = value ; } }public string UserPassword
{ get { return _userPassword ; } set { _userPassword = value ; } } }1.2创建对外发布的Web Service方法
public class MyService : System.Web.Services.WebService { private CredentialSoapHeader m_credentials ; public CredentialSoapHeader Credentails { get { return m_credentials ; } set { m_credentials = value ; } } //对外发布的服务 [WebMethod(BufferResponse = true,Description = "欢迎方法" ,CacheDuration = 0,EnableSession=false, MessageName = "HelloFriend",TransactionOption = TransactionOption.Required)] [SoapHeader("Credentails")] public string Welcome(string userName) { this.VerifyCredential(this) ; //验证方法 return "Welcome " + userName ; }//验证是否合法
private void VerifyCredential(MyService s) { if ( s.Credentails == null || s.Credentails.UserName == null || s.Credentails.UserPassword == null ) { throw new SoapException("验证失败",SoapException.ClientFaultCode,"Security") ; } //在这里可以进一步进行自定义的用户验证 } }创建使用MyService的客户端(本处使用WinForm来做实例)
先把MyService的引用添加进来 public class ClientForm : System.Windows.Forms.Form { public ClientForm() { MyService s = new MyService() ; this.InitWebServiceProxy(s) ; string temp = s.Welcome("test") ; MessageBox.Show(temp) ; }private void InitWebServiceProxy(MyService s)
{ CredentialSoapHeader soapHeader = new CredentialSoapHeader() ; soapHeader.UserName = "test" ; soapHeader.UserPassword = "test" ; s.CredentialSoapHeaderValue = soapHeader ;string urlSettings = null ; //这里可以从配置文件中获取
if (urlSettings != null )
{ s.Url = urlSettings ; }s.Credentials = (System.Net.NetworkCredential)CredentialCache.DefaultCredentials ;
} } 2,使用验证票(AuthorizationTicket) using System.Web.Security ; [WebMethod()] public string GetAuthorizationTicket(string userName , string password) { //这里可以做一些自定义的验证动作，比如在数据库里验证用户的合法性等 FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(userName, false, timeOut) ; string encryptedTicket = FormsAuthentication.Encrypt(ticket) ; Context.Cache.Insert(encryptedTicket, userName, null, DateTime.Now.AddMinutes(timeout), TimeSpan.Zero) ; return encryptedTicket ; }private bool IsTicketValid(string ticket, bool IsAdminCall)
{ if (ticket == null || Context.Cache[ticket] == null) { // not authenticated return false; } else { //这里再做一些验证，比如在数据库里验证用户的合法性等 } }[WebMethod()]
public Book GetBookByBookId(int bookId) { if (IsTicketValid) { //验证通过才可以执行特定操作了 } }