Wcf中通过https进行的纯文本用户名密码身份验证

Question

我的问题可能很愚蠢，但事实确实如此。

我经历了这个问题。 jassuncao建议使用自定义绑定创建的Yaron Naveh。 现在这不是一种非常安全的身份验证方式，我的问题是，如果我使用Yaron的自定义绑定并将服务置于https后面怎么办？ 它将仍然是无抵押的吗？

Answer 1

如果使用SSL，则传输将是安全的。 不需要自定义绑定。

在您提到的介绍WCF ClearUsernameBinding的页面上：

Sachin said... 
How does this work in IIS hosted environment with SSL certificate. Also in order to provide interoperability how will the clients using non woindows environment will be able to provide the user credentioals? 

February 18, 2009 9:06 PM  
 Yaron Naveh said... 
Hi Sachin

When SSL is used there is no need for clearUsernameBinding - you can use the out of the box WCF configurations.

As for interoperability, clearUsernameBinding adheres to the WSS username profile.