webservice加密，通过SoapHeader来增强Web Service的安全性

（通常webservice 加密都是加Token.其实就是在SOAP包的包头里面加个用户名和密码...
在C#封完包后,操作包头好了）

?

7.9? 如何保证Web Service的安全

要以安全的方式访问Web服务方法，可以考虑以下安全措施：

是谁调用？--SoapHeader身份认证。

来自哪里？--访问IP认证。

加密传输 --SSL安全访问。

这些安全保护措施常常是配合使用的。

7.9.1? 通过SoapHeader来增强Web Service的安全性

通过SoapHeader我们可以让具有指定用户口令的用户来访问我们的Web服务接口。（完整代码示例位置：光盘codech07WebAppClientWebForm-SoapHeader.aspx）

1．Web Service实现步骤

（1）定义自己的SoapHeader派生类。

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;

//<summary>?
//定义自己的SoapHeader派生类
//</summary>
public class MySoapHeader : System.Web.Services.Protocols.SoapHeader?
{???
??? private string _UserID = string.Empty;?????
??? private string _PassWord = string.Empty;?????
??? //<summary>????
??? //构造函数????
??? //</summary>?????
??? public MySoapHeader()?????
??? {????? }?????
??? //<summary>?????
??? //构造函数?????
??? //</summary>????
??? //<param name="nUserID">用户ID</param>?????
??? //<param name="nPassWord">加密后的密码</param>?????
??? public MySoapHeader(string nUserID,string nPassWord)????
??? {?????????
??????? Initial(nUserID,nPassWord);?????
??? }????
??? #region 属性????
??? //<summary>?????
??? //用户名?????
??? //</summary>?????
??? public string UserID?????
??? {?????????
??????? get { return _UserID;}?????????
??????? set { _UserID = value; }????
??? }????
??? //<summary>?????
??? //加密后的密码????
??? //</summary>?????
??? public string PassWord?????
??? {?????????
??????? get { return _PassWord; }????????
??????? set { _PassWord = value; }????
??? }????????????
??? #endregion????
??? #region 方法?????
??? //<summary>?????
??? //初始化????
??? //</summary>????
??? //<param name="nUserID">用户ID</param>?????
??? //<param name="nPassWord">加密后的密码</param>????
??? private void Initial(string nUserID,string nPassWord)???
??? {????????
??????? UserID = nUserID;????????
??????? PassWord = nPassWord;??
??? }?????
??? //<summary>????
??? //验证用户名密码是否正确?????
??? //</summary>?????
??? //<param name="nUserID">用户ID</param>????
??? //<param name="nPassWord">加密后的密码</param>???
??? //<param name="nMsg">返回的错误信息</param>???
??? //<returns>用户名密码是否正确</returns>????
??? private bool IsValid(string nUserID,string nPassWord,out string nMsg)??
??? {????????
??????? nMsg = "";????????
??????? try????????
??????? {????????????
??????????? //判断用户名密码是否正确?????????????
??????????? if (nUserID == "admin" && nPassWord == "admin")?????????
??????????? {????????????????? return true;????????????? }?????????????
??????????? else????????
??????????? {???????????????
??????????????? nMsg = "对不起，你无权调用此Web服务。";???
??????????????? return false;????????????
??????????? }????????
??????? }????????
??????? catch??????
??????? {????????????
??????????? nMsg = "对不起，调用异常，你无权调用此Web服务。";?????
??????????? return false;??????
??????? }???
??? }???
??? //<summary>????
??? //验证用户名密码是否正确????
??? //</summary>????
??? //<returns>用户名密码是否正确</returns>???
??? public bool IsValid(out string nMsg)???
??? {????????
??????? return IsValid(_UserID,_PassWord,out nMsg);????
??? }???
??? #endregion
}

?

（2）添加基于SoapHeader验证的Web Service接口方法：

using System;using System.Collections.Generic;using System.Linq;using System.Web;using System.Web.Services;using System.Web.Services.Protocols;

/// <summary>///CabinDutyLeaderInfoWS 的摘要说明/// </summary>[WebService(Namespace = "http://tempuri.org/")][WebServiceBinding(ConformsTo = WsiProfiles.BasicProfile1_1)]//若要允许使用 ASP.NET AJAX 从脚本中调用此 Web 服务，请取消对下行的注释。 // [System.Web.Script.Services.ScriptService]public class CabinDutyLeaderInfoWS : System.Web.Services.WebService {

??? //声明Soap头实例????? ??? public MySoapHeader myHeader = new MySoapHeader();?????????

??? public CabinDutyLeaderInfoWS () {

??????? //如果使用设计的组件，请取消注释以下行 ??????? //InitializeComponent(); ??? }

??? //需要SoapHeader验证??? ??? [SoapHeader("myHeader")] ??? [WebMethod]??? public string HelloWorld() {??????? string msg = "";? ??????? //验证是否有权访问???????? ??????? if (!myHeader.IsValid(out? msg))??????? ??????? {???????????? ??????????? return msg;//返回错误信息????????? ??????? }? ??????? return "Hello World";??? }??? }

?

?2．客户端调用具有SoapHeader的Web Service

//创建myService对象?
??????? DutyLeaderWebReference.CabinDutyLeaderInfoWS service = new CabinDutyLeaderInfoWS();
??????
??????? //创建soap头对象?
??????? DutyLeaderWebReference.MySoapHeader header = new DutyLeaderWebReference.MySoapHeader();?

??????? //设置soap头变量?
??????? header.PassWord = "admin";?
??????? header.UserID = "admin";?
??????? service.MySoapHeaderValue = header;?
??????? //调用web 方法?
??????? string strPrice = service.HelloWorld();
??????? this.lblTtxt.Text = strPrice;

?

通过SoapHeader对用户口令进行验证，只有授权的用户才可以使用该接口。确保了访问接口用户的安全性。

?

转自：http://book.51cto.com/art/200906/129769.htm