AJAX对WCF服务身份验证的请求

Question

If anyone could assist me with this I'd be grateful. Currently I'm implementing some jQuery AJAX methods on our ASP.NET application to GET and POST data to our server. We would like some form of authentication on this that is lightweight and fairly fast to implement.

Currently with each AJAX request it sends the Forms Authentication cookie to our WCF service, as seen on Fiddler. When we receive a request to our WCF service, it has a method that decrypts the Forms Authentication cookie. Currently it will only give a response with data if the cookie is not null and it hasn't expired. This works fine and well, and the only way the cookie exists is if the user has passed our secure log-in system.

What I want to know is whether this is a valid form, albeit basic, of securing our AJAX calls.

Is it easy to imitate forms cookies? Is it possible to circumvent the forms cookie? Any advice would be appreciated as I'm a little out of my depth here.

EDIT: We currently have SSL and secure HTTPS transport enabled also.

Here's an example of our code:

private bool AuthenticateAJAXRequest()
{
    // assume user is not authenticated
    bool authenticated = false;
    if (HttpContext.Current != null)
    {
        if (HttpContext.Current.Request != null)
        {
            var authCookie = HttpContext.Current.Request.Cookies["authCookie"];
            if (authCookie != null)
            {
                FormsAuthenticationTicket fTicket = FormsAuthentication.Decrypt(authCookie.Value);
                if (fTicket != null)
                {
                    if (!fTicket.Expired)
                        authenticated = true;
                }
            }
        }
    }
    return authenticated;
}

Answer 1

First of all, AJAX (XHR - Xml Http Request) async request is bound by the "Same-Origin" policy. Which means a browser will implicitly refuse/restrict to make an AJAX calls to a server other than the one the page originated from. This takes care of cross-domain scripting attacks. (You could still make cross-domain async calls using JSONp or using script tags manually, but that's a whole other ball game not in the current scope of discussion.) From what I gather, if you just check for cookies and don't have a fall back then you are going be in trouble as some users could have turned the cookies off in their browsers. Instead, I recommend using user level unique ids that you can store and retrieve for each user session. Send this unique id(s) as part of the each Ajax request and validate it against your data store (either cached or persisted) on the server. This way you can rest assured that this system will still work regardless of the cookies. Also make sure you destroy the unique id after a user logs off so that any future request(s) (either full page or Ajax) is not honored. Hope this answers your question.