保护WCF NetHttpBinding的最有效方法

Question

我将实现一个NetHttpBinding支持双工连接的Web服务.但问题是我不知道如何保护它.我试过用CostumUserNamePasswordValidationMode,这是我的web.config:

<behaviors>
      <serviceBehaviors>
        <behavior name="Behavior1">
          <serviceMetadata httpGetEnabled="true"/>
          <serviceDebug includeExceptionDetailInFaults="true"/>
          <serviceCredentials>
            <serviceCertificate findValue="MyWebSite"
                  storeLocation="LocalMachine"
                  storeName="My"
                  x509FindType="FindBySubjectName" />
            <userNameAuthentication userNamePasswordValidationMode="Custom"
             customUserNamePasswordValidatorType="WcfWSChat.UserNamePassValidator, WcfWSChat" />
          </serviceCredentials>
        </behavior>
      </serviceBehaviors>
    </behaviors>
    <bindings>
      <netHttpBinding>
        <binding name="Binding1">
          <security mode="Message">
            <message clientCredentialType="UserName"/>
          </security>
        </binding>
      </netHttpBinding>
    </bindings>
    <protocolMapping>
      <add scheme="http" binding="netHttpBinding"/>
    </protocolMapping>
    <services>
      <service name="WcfWSChat.WSChatService" 
               behaviorConfiguration="Behavior1" >
        <endpoint address="" 
                  binding="netHttpBinding"
                  bindingConfiguration="Binding1"
                  contract="WcfWSChat.IWSChatService" />
        <endpoint contract="IMetadataExchange" binding="mexHttpBinding" address="mex" />
      </service>
    </services>

我认为问题是<security mode="Message">,每当我运行项目时,无论是在IIS Express还是IIS 8.0上,我都会收到此错误:

无法找到与绑定NetHttpBinding的端点的方案https匹配的基址.注册的基地址方案是[http].

如果我更改mode属性None,我将不再看到错误,但验证不起作用!

我怎么解决这个问题？

Answer 1

我认为你几乎接近解决方案.我试图复制你的问题,这就是我的想法.

1. 在ServiceMetadata中添加httpsGetEnabled并将其设置为true.MetaData交换将在HTTPS中进行:

<serviceMetadata httpGetEnabled="True" httpsGetEnabled="True" />

2. 将mexHttpBinding更改为mexHttpsBinding:

<endpoint address="mex" binding="mexHttpsBinding" contract="IMetadataExchange"/>

3. 在你的绑定中添加:

<netHttpBinding>
   <binding name="netHttpBinding">
       <security mode="TransportWithMessageCredential">
           <message clientCredentialType="UserName"/>
       </security>
   </binding>
</netHttpBinding>

4. 由于netHttpBinding默认使用http,我们需要一些映射.

<protocolMapping>
    <add scheme="https" binding="netHttpBinding"/>
</protocolMapping>

5. 出于某种原因,即使我将protocolMapping更改为使用HTTPS进行netHttpBinding,我仍然会收到错误消息"无法找到与绑定NetHttpBinding的端点匹配方案https的基址.已注册的基址方案为[http]." .

所以我做的是,我在我的服务中添加了基于这样的地址:

<host>
    <baseAddresses>
       <add baseAddress="https://localhost/Services/"/>
    </baseAddresses>
</host>

如果您没有看到上面突出显示的任何错误消息,则可以转义第五步.我只是把它放在这里以防万一.

注意:我将证书安装在Personal下的证书存储区和受信任的根证书中的CA中.此示例仅在同一台计算机上运行,​​因为我的证书名称只是localhost.顺便说一句,我在这里使用.Net framework 4.5.

以下是我的完整配置:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <system.serviceModel>
    <services>
      <service name="WcfServiceLibrary1.Service1" behaviorConfiguration="ServiceBehavior">
        <host>
          <baseAddresses>
            <add baseAddress="https://localhost/Services/"/>
          </baseAddresses>
        </host>
        <endpoint address="" binding="netHttpBinding"  bindingConfiguration="netHttpBinding" contract="WcfServiceLibrary1.IService1" name="WcfServiceLibrary1.IService1"/>
        <endpoint address="mex" binding="mexHttpsBinding" contract="IMetadataExchange" listenUriMode="Explicit" />
      </service>
    </services>
    <behaviors>
      <serviceBehaviors >
        <behavior name="ServiceBehavior">
          <serviceCredentials>
            <serviceCertificate findValue="localhost" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName" />
            **<!-- Retain your custom username password validator here -->**
          </serviceCredentials>
          <serviceMetadata httpGetEnabled="True" httpsGetEnabled="True" />
          <serviceDebug includeExceptionDetailInFaults="False" />
        </behavior>
      </serviceBehaviors>
    </behaviors>
    <bindings>
      <netHttpBinding>
        <binding name="netHttpBinding">
          <security mode="TransportWithMessageCredential">
            <message clientCredentialType="UserName"/>
          </security>
        </binding>
      </netHttpBinding>
    </bindings>
    <protocolMapping>
      <add scheme="https" binding="netHttpBinding"/>
    </protocolMapping>
  </system.serviceModel>
</configuration>

Answer 2

看起来这可能与您注册为服务凭证的证书有关。

serviceCertificate我会尝试从 中删除serviceBehaviours.

如果您想通过该证书强制执行 SSL，那么我会将绑定部分中的安全模式更新为TransportWithMessageCredential并将协议映射方案更改为https。