WebService安全处理办法之一

发布时间：2020-12-17 02:40:00 所属栏目：安全来源：网络整理

导读：?平常我经常使用动态随机数加密验证的办法，可以验证客户端的合法性，不过这种方法也蛮不错的。 ? using ?System; using ?System.Collections; using ?System.ComponentModel; using ?System.Data; using ?System.Linq; using ?System.Web; using ?System.We

?平常我经常使用动态随机数加密验证的办法，可以验证客户端的合法性，不过这种方法也蛮不错的。

 
using?System;

using?System.Collections;

using?System.ComponentModel;

using?System.Data;

using?System.Linq;

using?System.Web;

using?System.Web.Services;

using?System.Web.Services.Protocols;

using?System.Xml.Linq;

namespace?TallyInfo.TIWebService
{

????///?<summary> 

????///?ClientAuthenticate?的摘要说明 

????///?</summary> 

????[WebService(Namespace?=?"http://tempuri.org/")]
????[WebServiceBinding(ConformsTo?=?WsiProfiles.BasicProfile1_1)]

????[ToolboxItem(false)]

????//?若要允许使用?ASP.NET?AJAX?从脚本中调用此?Web?服务，请取消对下行的注释。 

????//?[System.Web.Script.Services.ScriptService] 

????public?class?ClientAuthenticate?:?System.Web.Services.WebService

????{ 

????????#region?客户端身份认证 

????????#region?GetTicket 

????????[WebMethod]?//(Description?=?"票据产生方法，客户端在调用其它方法之前必须先调用该方法认证其身份，验证成功的结果就是返回一个票据") 

????????public?string?GetTicket(string?identity,?string?password)
????????{

????????????//Authenticate?the?client 

????????????if?(!Authenticate(identity,?password))
????????????{

????????????????throw?new?Exception("Invalid?identity/Password");
????????????}
????????????Guid?gTicket?=?Guid.NewGuid();

????????????this.Context.Cache.Insert(gTicket.ToString(),?true);

????????????return?gTicket.ToString();

????????} 

????????#endregion?GetTicket 

????????#region?Authenticate 

????????///?<summary> 

????????///?验证票据 

????????///?</summary> 

????????///?<param?name="ticket"></param> 

????????///?<returns></returns> 

????????private?bool?Authenticate(string?ticket)
????????{

????????????try
????????????{

????????????????bool?bRet?=?false;

????????????????if?((bool)Context.Cache.Get(ticket))
????????????????{

????????????????????bRet?=?true;
????????????????}

????????????????return?bRet;
????????????}

????????????catch?(NullReferenceException?NullEx)
????????????{

????????????????throw?NullEx;
????????????}

????????????catch?(Exception?Ex)
????????????{

????????????????throw?Ex;
????????????}

????????} 

????????#endregion?Authenticate 

????????#region?Authenticate 

????????///?<summary> 

????????///?获取票据之前到数据库验证客户身份 

????????///?</summary> 

????????///?<param?name="identity"></param> 

????????///?<param?name="password"></param> 

????????///?<returns></returns> 

????????private?bool?Authenticate(string?identity,?string?password)
????????{

????????????bool?retAuth?=?false;

????????????string?SQLString?=?"SELECT?*?FROM?DataProviders?WHERE?标识码?=?'"?+?identity?+?"'?AND?口令?=?'"?+?password?+?"'";

????????????//DataSet?ds?=?DbHelperSQL.Search(SQLString); 

????????????//if?(ds.Tables[0].Rows.Count?==?1) 

????????????retAuth?=?true;

????????????return?retAuth;

????????} 
????????

????????#endregion?Authenticate 

????????#endregion?客户端身份认证 

????????#region?SearchWithSQL???执行例程 
????????[WebMethod]

????????public?DataSet?SearchWithSQL(string?SQLString,?string?ticket)
????????{

????????????//在执行方法体响应之前验证票据有效性 

????????????if?(!Authenticate(ticket))
????????????{

????????????????throw?new?Exception("Invalid?Ticket");
????????????}

????????????return?null;

????????????//return?DbHelperSQL.Search(SQLString); 

????????} 

????????#endregion?SearchWithSQL????执行例程 
????}
}

（编辑：李大同）

【声明】本站内容均来自网络，其相关言论仅代表作者个人观点，不代表本站立场。若无意侵犯到您的权利，请及时与联系站长删除相关内容!