Web Service的安全访问【SoapHeader身份认证】

web service安全访问方式可以以下安全措施：

（1）是谁调用？-----soapheader身份认证

（2）来自哪里？-----访问IP认证

（3）加密传输？-----SSL安全访问

本文主要讲解通过SoapHeader来增强Web Service的安全性

(1)自定义soapheader派生类

/// <summary>
/// SoapHeader安全验证
/// </summary>
public class CredentialSoapHeader : SoapHeader
{
private string m_username;
private string m_password;

public string Username
{
get { return m_username; }

set { m_username = value; }
}

public string Password
{
get { return m_password; }

set { m_password = value; }
}

public bool VerifyCredentials(string name, string pwd, out string msg)
{
msg = "";
try
{
if (name == "test" && pwd == "test")
{
return true;
}
else
{
msg = "对不起，您无权限调用此web服务";
return false;
}
}
catch
{
msg = "对不起，您无权限调用此web服务";
return false;
}
}
}

(2)添加基于SoapHeader验证的web service接口方法：

CredentialSoapHeader soap = new CredentialSoapHeader();
string msg = string.Empty;

#region 退款
/// <summary>
/// 统计退款个数
/// </summary>
/// <param name="itemid">项目ID</param>
/// <param name="productid">产品ID</param>
/// <param name="state">退款状态：待处理，处理中，已退款</param>
/// <returns></returns>
[WebMethod]
[SoapHeader("soap")]
public int RefundCount(int itemid, int productid, int state)
{
if (soap.VerifyCredentials(soap.Username, soap.Password, out msg))
{
int count = 0;
return count;
}
else
{
return 0;
}
}

（3）客户端调用

/// <summary>
/// 获取安全凭证
/// </summary>
/// <returns></returns>
private static CTOCInterface.CredentialSoapHeader GetInterfaceSoapHeader()
{
CTOCInterface.CredentialSoapHeader header = new CTOCInterface.CredentialSoapHeader();
header.Username = MODEL.SystemConfigInfo.KEY_WTCTOCServiceUsername;
header.Password = MODEL.SystemConfigInfo.KEY_WTCTOCServicePassword;
return header;
}

/// <summary>
/// 统计退款个数
/// </summary>
/// <param name="userlogin"></param>
/// <returns></returns>
protected static int RefundCount(int itemid, int productid, int state)
{
using (CTOCInterface.CTOCGroupPurchaseSoapClient client = new CTOCInterface.CTOCGroupPurchaseSoapClient())
{
try
{
return client.RefundCount(GetInterfaceSoapHeader(), itemid,productid,state);
}
catch
{
return null;
}

}
}