blocks|key|1651289|text|IIS中的基本身份验证不够吗？服务使用者很容易通过请求传递基本身份验证参数。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1651290|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

Is basic authentication in IIS not sufficient? It's easy for service consumers to pass basic authentication parameters with a request.

blocks|key|3204741|text|你最好的选择是升级到WCF，因为内置的选项要好得多。如果您被困在2.0/SOAP中，那么自定义SOAP头将在大多数平台上工作--我以前已经成功地从.NET、COM%2B和PHP中使用过它们。您可以使用典型的ASP.NET授权位(包括sql数据库)备份用户/传递。尽管如此，如果安全性的目的是减少垃圾邮件，并且您没有那么多的服务方法来“安全”，那么您可能只想在您的方法中添加一个"UserKey“参数，然后验证(或者至少是利率限制)。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3204742|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

Your best bet would be to upgrade to WCF as built-in options are much better there. If you are stuck in 2.0/SOAP land, then a custom SOAP header will work from most platforms -- I've successfully used them from .NET, COM+ and PHP before. You can back the user/pass with the typical ASP.NET authorization bits including the sql database. That said, if the point of security is to cut down on spam and you don't have that vast an array of service methods to "secure" then you might just want to add a "UserKey" parameter to your method then verify (or at least rate-limit) against that.

blocks|key|3204757|text|您应该将解决方案升级到WCF。如果可以，您可以轻松地为客户端选择凭证类型。另见确保WCF服务条款的安全|type|ordered-list-item|depth|inlineStyleRanges|entityRanges|offset|length|data|3204758|如果SOAP头可以为请求构造所需的xml，则SOAP头将适用于非.NET客户端。|3204759|使用这篇文章作为SOAP头的简单示例。|3204760|unstyled|entityMap|0|LINK|mutability|MUTABLE|url|http://msdn.microsoft.com/en-us/library/ms733836.aspx|1|http://www.theserverside.net/tt/articles/showarticle.tss?id=SecuringWCFService|2|http://www.wrox.com/WileyCDA/Section/Using-SOAP-Headers-with-ASP-NET-2-0-Web-Services.id-291722.html^0|W|4|0|13|C|1|0|0|2|4|2|0^^$0|@$1|2|3|4|5|6|7|U|8|@]|9|@$A|V|B|W|1|X]|$A|Y|B|Z|1|10]]|C|$]]|$1|D|3|E|5|6|7|11|8|@]|9|@]|C|$]]|$1|F|3|G|5|6|7|12|8|@]|9|@$A|13|B|14|1|15]]|C|$]]|$1|H|3|-4|5|I|7|16|8|@]|9|@]|C|$]]]|J|$K|$5|L|M|N|C|$O|P]]|Q|$5|L|M|N|C|$O|R]]|S|$5|L|M|N|C|$O|T]]]]

<ol>
<li>You should upgrade your solution to the WCF. If you can, you can easily select the <a href="http://msdn.microsoft.com/en-us/library/ms733836.aspx" rel="nofollow">Credential Type</a> for your clients. See also <a href="http://www.theserverside.net/tt/articles/showarticle.tss?id=SecuringWCFService" rel="nofollow">Securing WCF Service article</a></li>
<li>SOAP headers will work for non-.NET clients, if they can construct needed xml for request.</li>
<li>Use <a href="http://www.wrox.com/WileyCDA/Section/Using-SOAP-Headers-with-ASP-NET-2-0-Web-Services.id-291722.html" rel="nofollow">this article</a> for easy example of SOAP Header using.</li>
</ol>

How to secure a web service and make it easy for any platform to consume. 

Setup: Asp.NET 2.0, Dot Net 2.0, c# 2.0, Visual Studio 2005. Web server is IIS and uses https (SSL)

<ol>
<li>I would like to avoid installing anything like WSE 3.0. I prefer a pure c# method I can take with me to future versions of Visual Studio and IIS.</li>
<li>Everyone should be able to still visit the web service URL and description and see the WSDL without authentication.</li>
<li>The securing will help to stop people from sending junk to our web service methods.</li>
<li>Easy implementation: I do not want to manage certificates for clients or install anything.</li>
<li>client only sends a username and password.</li>
</ol>

Does this mean SOAP header authentication is the only way then? I found these links but don't know if they will work for non .NET clients? 
<a href="http://aspalliance.com/805" rel="nofollow">http://aspalliance.com/805</a> and <a href="http://www.codeproject.com/KB/webservices/SOAPHeaderAuthentication.aspx" rel="nofollow">http://www.codeproject.com/KB/webservices/SOAPHeaderAuthentication.aspx</a> 

I also see <a href="http://msdn.microsoft.com/en-us/library/9z52by6a%28VS.80%29.aspx#Y3962" rel="nofollow">this article</a> but don't know if and how to implement it (not a very good example). 

Please advise or give me a good link (no videos please).
Thanks!

How to secure a web service in c# 2.0 and make it easy for any platform to consume

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

如何确保web服务的安全，并使任何平台都易于使用。安装程序: Asp.NET 2.0，DotNet2.0，c# 2.0，Visual 2005。Web服务器是IIS，并使用https (SSL)我想避免安装类似WSE3.0的任何东西。与未来版本的Visual和IIS相比，我更喜欢我可以随身携带的纯c#方法。每个人都应该...

问如何在c# 2.0中保护web服务，并使任何平台都易于使用
EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何在c# 2.0中保护web服务，并使任何平台都易于使用EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何在c# 2.0中保护web服务，并使任何平台都易于使用
EN