如何保护我的WCF数据服务服务

Question

I have already read this thread http://msdn.microsoft.com/en-us/library/dd728284(v=vs.110).aspx

I understand the micanizme and approach to secure my webservice.

My question is how to do that?

I mean: I don't want everyone on the web to access this service

https://SOMETHING/SMS

So, should I send the username and password with every serivce? then I check for these username and password. if correct i return the response?

Answer 1

You can try configuring your IIS to enable Basic or Digest Authentication http://www.asp.net/web-api/overview/security/basic-authentication Turning on SSL will encrypt your messages.

Doing that, IIS will handle authentication and you wont need to perform any further in your code.

Another approach, without any IIS configuration would be:

1. Define Username and password
2. Append your HTTP headers for the request to include this username:password field. This one can also be encrypted (eg base64 encoding)
3. In your server software, read your http headers to find your username:password. If it is not there, then return an HTTP 401 Unauthorized error. If username:password matches the one you defined, then the user is authenticated.

Both ways are almost the same thing.