3

我有一个Web API Web 服务,它被许多具有不同技术(如Java、.NET 等)的客户端应用程序使用。因此,我的用户凭据存储在一个单独的数据库中。

我的 Web 服务托管在IIS中,并且我在服务器端配置并启用了SSL,以确保请求/响应消息被加密和签名。

我还配置了 IIS 的 IP 地址限制功能,以允许来自少数已知 IP 地址的请求。

我不喜欢使用基本身份验证,因为它在每条消息中都以纯文本形式发送凭据,尽管消息是使用 SSL 加密的。

我显然不能使用集成 Windows 身份验证,因为我的用户与我的服务器不在同一个域中。

我不能使用表单身份验证,因为我的客户端不是基于浏览器的。

那么为我的 Web 服务实现身份验证和授权的最佳方式是什么?

我在想一种方法是提供一个Authenticate(username, password) web 方法,它的行为类似于身份提供者/安全令牌服务,并生成特定于该用户的令牌,该令牌在特定时间后过期。然后客户端必须通过每个 Web 方法请求发送身份验证令牌,我通过为我的控制器创建自定义授权过滤器来确保它。

这种方法的优点是用户不必在每个请求中发送用户名/密码,而只是一个临时令牌。缺点显然是管理令牌寿命;什么时候到期?例如,如果在一小时内没有提出请求。

为我的 Web 服务实施身份验证和授权的最佳方式是什么?

4

4 回答 4

4

I will address options for authentication in my comments in respect to SOAP services. Authorization is implemented within the server application and mostly irrelevant to the authentication type selected. There are three (3) classifications of web services: -Private -Community -Public

It sounds like the web service you are providing is a community service because it is only available to trusted partners. I know this because you explained that an IP Address restriction was configured in IIS. Including an IP Address restriction is one of many good measures for implementing secure web services. Security is not a single thing. It is an accumulation of many defenses. IP Address restriction is a good start.

Web Services are stateless by nature. Therefore, it is typical that the credentials (username and password) must be included with every request when calling a web service. So, it is not a problem or concern.

HTTP Basic Authentication is not a bad choice. It is supported by all client and server applications and easy to implement. I like to think of HTTP Basic Authentication as the lowest common denominator. I would not rule it out. HTTP Basic Authentication includes the credentials in the http header in plain text so it’s always recommended to include SSL (HTTPS) to encrypt the transport channel.

WS-Security is a very common authorization standard for Web Services. It is an industry standard for Web Services and the specification is published by the Organization for the Advancement of Structured Information Standards (OASIS) organization. WS-Security includes a UsernameToken profile for including username/password. The WS-Security block is added to the header of the SOAP message. In comparison, HTTP Basic Authentication is added to the HTTP header. HTTP Basic Authentication is attached to the transport protocol. In comparison, WS-Security is attached to the SOAP message. WS-Security UsernameToken is in plain text so it’s always recommended to include SSL (HTTPS).

Another option is client certificate authentication. This option uses a digital certificate as the authentication token in lieu of a username/password. This method works well but requires that the web services team members and client application team members both be familiar with SSL digital certificates as a prerequisite. The learning curve for this method is higher than the others.

The custom solution you described is not necessary, because so many industry standards exist to implement and solve the solution you seek. For example, if you implement WS-Security in your web service, you do not have to provide the client app team with documentation and explain how to implement it in their client application. WS-Security is an industry standard that is well documented and supported by most modern SOAP servers and SOAP clients today. The same applies to HTTP Basic Authentication.

I hope this helps. Cheers, DCova

于 2013-04-07T20:18:02.447 回答
1

IP 地址很容易被欺骗,所以不要依赖它们来保护您的服务。

我建议您仅允许通过 HTTPS 进行访问,为了进一步保护它,请验证用于签署请求的证书。更好的是,拥有自己的证书服务器并为此目的颁发自己的证书。

于 2013-04-06T18:48:07.133 回答
0

在 facebook 中,他们向应用程序提供访问令牌,该令牌仅在更改密码或用户特别取消对应用程序的授权时才会更改。你们很多人考虑这种方法。这在 Google 的 Map API 中也是类似的。我能想到的唯一安全的方法是检查请求的来源(请求的 IP 地址),然后检查 apikey 然后做出响应。

于 2013-04-06T18:10:17.393 回答
0

我的 Web 服务托管在 IIS 中,并且我在服务器端配置并启用了 SSL,以确保请求/响应消息被加密和签名。

SSL 是传输安全而不是消息安全。它不会为您签署消息。它加密通道。

我觉得预共享密钥或 API 密钥的方法最适合您的情况。由于用户有用户名和密码,我假设他们在某个地方注册。作为该过程的一部分,生成一个密钥,该密钥可以是共享对称密钥,即双方(客户端和服务器)具有相同的密钥。客户端在某些自定义方案的 Authentication 标头中发送用户 ID,以及请求消息的特定部分的 SHA256 哈希。服务器获取用户 ID,检索密钥,计算消息相同部分的哈希值,如果哈希值匹配,则客户端进入。

查看我的书Pro ASP.NET Web API Security

于 2013-04-09T03:26:02.390 回答