如何在RequestInterceptor（WCF REST入门工具包）中验证Content-MD5标头（根据实际内容）-REST Web服务

Question

I'm implementing REST web services by means of the WCF REST Starter Kit.

I get the request in a System.ServiceModel.Channels.RequestContext.

Specifically: the interceptor starts this way: Public Overrides Sub ProcessRequest(ByRef requestContext As RequestContext)

If the request includes the Content-MD5 header, I must validate the provided hash against the actual content body, right? Because this does not happen 'automatically'. Nobody (IIS, or whoever) is verifying this for me, as I first thought it would happen.

I thought doing this content verification would be easy. I just have to get the request body as a string and compare the result of my GenerateChecksumForContent() with the hash included in the header.

How to compute the MD5 from the content:

Public Shared Function GenerateChecksumForContent(ByVal content As String) As String
    ' Convert the input string to a byte array and compute the hash.
    Dim hashed As Byte() = MD5.Create().ComputeHash(Encoding.UTF8.GetBytes(content))
    ' Convert the hash to a Base64 Encoded string and return it
    Return Convert.ToBase64String(hashed)
End Function

How to get the Content-MD5 request Header value:

Dim message As Message = requestContext.RequestMessage
Dim reqProp As HttpRequestMessageProperty = DirectCast(message.Properties(HttpRequestMessageProperty.Name), HttpRequestMessageProperty)
Dim contentMD5HeaderValue As String = reqProp.Headers("Content-MD5")

My problem is that I don't know how to do something so apparently simple as compute the Content-MD5 of the request's body.

I could not find any built-in property telling me this information (the content's MD5 current hash value).

I've tried this, but it does not work:

Dim content As String = requestContext.RequestMessage.GetBody(Of String)()
Dim computedMD5 As String = GenerateChecksumForContent(content)

In addition, what would happen after the RequestInterceptor run and the 'real' method process the content? The content would be lost because it was already read?

Should I in addition do something like ".CreateBufferedCopy()" to keep the request body available for the post-RequestInterceptor processing?

I cannot understand why this is so complicated! It should be something trivial, but as you can see, I'm completely lost.

Please someone, help me...

Many thanks,

Horacio.-

Answer 1

Here are two MSDN pages that give an answer to your question:

• http://blogs.msdn.com/b/csharpfaq/archive/2006/10/09/how-do-i-calculate-a-md5-hash-from-a-string_3f00_.aspx

• http://msdn.microsoft.com/en-us/library/system.security.cryptography.md5.aspx

Hopefully one of them will be sufficient.