c# – 使用wsHttpBinding的WCF服务 – 操作HTTP请求标头

即使我明确添加它,初始数据包也不包含授权标头.但是,每个后续数据包都包含它,因为我在授权模块处于非活动状态时进行了测试.所以我,为什么我不尝试将这个初始数据包与其他数据包区分开来？因此,如果我发现它是初始数据包,请将HTTP状态代码设置为200(OK),如果不是,请检查身份验证标头.这很容易,因为初始数据包在SOAP信封中发送了对安全令牌的请求(包含< t：RequestSecurityToken>标记).

好的,让我们来看看我的实现,以防其他人需要它.

这是BasicAuthenticationModule实现,它实现了IHTTPModule：

public class UserAuthenticator : IHttpModule
{
    public void Dispose()
    {
    }

    public void Init(HttpApplication application)
    {
        application.AuthenticateRequest += new EventHandler(this.OnAuthenticateRequest);
        application.EndRequest += new EventHandler(this.OnEndRequest);
    }

    public void OnAuthenticateRequest(object source,EventArgs eventArgs)
    {
        HttpApplication app = (HttpApplication)source;

        // Get the request stream
        Stream httpStream = app.Request.InputStream;

        // I converted the stream to string so I can search for a known substring
        byte[] byteStream = new byte[httpStream.Length];
        httpStream.Read(byteStream,(int)httpStream.Length);
        string strRequest = Encoding.ASCII.GetString(byteStream);

        // This is the end of the initial SOAP envelope
        // Not sure if the fastest way to do this but works fine
        int idx = strRequest.IndexOf("</t:RequestSecurityToken></s:Body></s:Envelope>",0);
        httpStream.Seek(0,SeekOrigin.Begin);
        if (idx != -1)
        {
            // Initial packet found,do nothing (HTTP status code is set to 200)
            return;
        }

        //the Authorization header is checked if present
        string authHeader = app.Request.Headers["Authorization"];
        if (!string.IsNullOrEmpty(authHeader))
        {
            if (authHeader == null || authHeader.Length == 0)
            {
                // No credentials; anonymous request
                return;
            }

            authHeader = authHeader.Trim();
            if (authHeader.IndexOf("Basic",0) != 0)
            {
                // the header doesn't contain basic authorization token
                // we will pass it along and
                // assume someone else will handle it
                return;
            }

            string encodedCredentials = authHeader.Substring(6);

            byte[] decodedBytes = Convert.FromBase64String(encodedCredentials);
            string s = new ASCIIEncoding().GetString(decodedBytes);

            string[] userPass = s.Split(new char[] { ':' });
            string username = userPass[0];
            string password = userPass[1];
            // the user is validated against the SqlMemberShipProvider
            // If it is validated then the roles are retrieved from 
            // the role provider and a generic principal is created
            // the generic principal is assigned to the user context
            // of the application

            if (Membership.ValidateUser(username,password))
            {
                string[] roles = Roles.GetRolesForUser(username);
                app.Context.User = new GenericPrincipal(new
                GenericIdentity(username,"Membership Provider"),roles);
            }
            else
            {
                DenyAccess(app);
                return;
            }
        }
        else
        {
            app.Response.StatusCode = 401;
            app.Response.End();
        }
    }

    public void OnEndRequest(object source,EventArgs eventArgs)
    {
        // The authorization header is not present.
        // The status of response is set to 401 Access Denied.
        // We will now add the expected authorization method
        // to the response header,so the client knows
        // it needs to send credentials to authenticate
        if (HttpContext.Current.Response.StatusCode == 401)
        {
            HttpContext context = HttpContext.Current;
            context.Response.AddHeader("WWW-Authenticate","Basic Realm");
        }
    }

    private void DenyAccess(HttpApplication app)
    {
        app.Response.StatusCode = 403;
        app.Response.StatusDescription = "Forbidden";

        // Write to response stream as well,to give the user 
        // visual indication of error 
        app.Response.Write("403 Forbidden");

        app.CompleteRequest();
    }
}

重要说明：为了使我们能够读取http请求流,不得启用ASP.NET兼容性.

要使IIS加载此模块,必须将其添加到< system.webServer> web.config的部分,如下所示：

<system.webServer>
  <modules runAllManagedModulesForAllRequests="true">
    <remove name="BasicAuthenticationModule" />
    <add name="BasicAuthenticationModule" type="UserAuthenticator" />
  </modules>

但在此之前,您必须确保BasicAuthenticationModule部分未被锁定,并且默认情况下应该锁定它.如果锁定,您将无法更换它.

解锁模块:(注意：我使用的是IIS 7.5)

>打开IIS管理器
>在左侧窗格中,单击您的主机名
>在中间窗格的“管理”部分下,打开“配置编辑器”
>单击上部窗格部分“Section”标签旁边的组合框,展开“system.webServer”,然后导航到“modules”
>在“(收藏)”键下,单击“(计数= nn)”值,出现一个带“…”的小按钮.点击它.
>在“项目”列表中,找到“BasicAuthenticationModule”,然后在右侧窗格中单击“解锁项目”(如果存在！).
>如果更改了此设置,请关闭配置编辑器,保存更改.

在客户端,您需要能够向传出消息添加自定义HTTP标头.执行此操作的最佳方法是实现IClientMessageInspector并使用BeforeSendRequest函数添加标头.我不会解释如何实现IClientMessageInspector,在线提供了大量关于该主题的资源.

要在消息中添加“Authorization”HTTP标头,请执行以下操作：

public object BeforeSendRequest(ref Message request,IClientChannel channel)
    {    

        // Making sure we have a HttpRequestMessageProperty
        HttpRequestMessageProperty httpRequestMessageProperty;
        if (request.Properties.ContainsKey(HttpRequestMessageProperty.Name))
        {     
            httpRequestMessageProperty = request.Properties[HttpRequestMessageProperty.Name] as HttpRequestMessageProperty;
            if (httpRequestMessageProperty == null)
            {      
                httpRequestMessageProperty = new HttpRequestMessageProperty();
                request.Properties.Add(HttpRequestMessageProperty.Name,httpRequestMessageProperty);
            } 
        }
        else
        {     
            httpRequestMessageProperty = new HttpRequestMessageProperty();
            request.Properties.Add(HttpRequestMessageProperty.Name,httpRequestMessageProperty);
        } 
        // Add the authorization header to the WCF request    
        httpRequestMessageProperty.Headers.Add("Authorization","Basic " + Convert.ToBase64String(Encoding.ASCII.GetBytes(Service.Proxy.ClientCredentials.UserName.UserName + ":" + Service.Proxy.ClientCredentials.UserName.Password)));
        return null;
    }

你去了,需要一段时间才能解决,但这是值得的,因为我在整个网络上发现了许多类似的未解答的问题.