是的,有必要保护WCF通道以防止模拟。WCF可以在您指示时自动加密您的通信,但您需要自己处理身份验证部分。
在WCF中,有两种保护消息的方法(如果您考虑到可以同时使用这两种方法,则为三种)。有一个很好的高级解释
here
. 你可以用这些方法中的哪一种
取决于我们所说的绑定
(对于不同的绑定,您将有不同的选项)。
此外,对于保护服务的每个方法,您可以在身份验证凭证类型(每个实体将向另一个端点证明其身份的实际方法)之间进行选择。
这取决于绑定和安全方法
.
要查看每个绑定的选项,可以检查其
Security
属性。对于每个绑定,此属性的类型不同(例如
NetTcpSecurity
);您可以查看msdn或intellisense以了解这一点。
我会用的
NetTcpBinding
以交通安全为例。
要在服务器和客户机部分设置安全性,首先必须使用安全模式和身份验证类型配置绑定,然后才能创建和打开通道,例如:
var binding = new NetTcpBinding { /* set props here */ };
// TLS security with X.509 certificates
binding.Security.Mode = SecurityMode.Transport;
binding.Security.Transport.ClientCredentialType = TcpClientCredentialType.Certificate;
然后,在服务器端(此示例特定于上面所做的选择):
// Load and set the server certificate
var serverCertificate = new X509Certificate2(/* parameters here */);
host.Credentials.ServiceCertificate.Certificate = serverCertificate;
// You can leave it at that and let Windows validate the client's certificate using
// the default method (which means that you either need to have added the client's
// certificate to the server machine's certificate store as "trusted", or rely on chain
// trust and have the client's certificate signed by a trusted authority.
// Or, you can use custom validation rules:
var authentication = host.Credentials.ClientCertificate.Authentication;
authentication.CertificateValidationMode = X509CertificateValidationMode.Custom;
authentication.CustomCertificateValidator = new AcceptAnythingCertificateValidator();
在客户端(这个示例也是特定的):
var clientCertificate = new X509Certificate2(/* parameters here */);
var factory = new ChannelFactory<IYourServiceInterface>(binding, endpoint);
factory.Credentials.ClientCertificate.Certificate = clientCertificate;
// You can leave it at that and let Windows validate the server's certificate using
// the default method (which means that you either need to have added the server's
// certificate to the client machine's certificate store as "trusted", or rely on chain
// trust and have the server's certificate signed by a trusted authority.
// Or, you can use custom validation rules:
var authentication = factory.Credentials.ServiceCertificate.Authentication;
authentication.CertificateValidationMode = X509CertificateValidationMode.Custom;
authentication.CustomCertificateValidator = new AcceptAnythingCertificateValidator();
var channel = factory.CreateChannel();
// Your channel is now ready for use! You can also cast to to IClientChannel
// to expose some more properties.
