在Server上启用SSL
稍后我会想在IIS 7 上配置SSL，现在先往下看。
注意SSL URL的值,使用这个URL用于测试HTTPS连接。
执行SSL在Web API控制器
下面的代码显示了一个Web API检查SSL身份验证过滤器:
public class RequireHttpsAttribute : AuthorizationFilterAttribute
{
public override void OnAuthorization(HttpActionContext actionContext)
{
if (actionContext.Request.RequestUri.Scheme != Uri.UriSchemeHttps)
{
actionContext.Response = new HttpResponseMessage(System.Net.HttpStatusCode.Forbidden)
{
ReasonPhrase = "HTTPS Required"
};
}
else
{
base.OnAuthorization(actionContext);
}
}
}
这个过滤器添加到任何Web API需要SSL的操作:
public class ValuesController : ApiController
{
[RequireHttps]
public HttpResponseMessage Get() { ... }
}
SSL客户端证书
对于许多应用程序类型,这不会是一个很好的用户体验,但在某些环境中(例如,企业)可能是可行的。
| 优势 | 劣势 |
|---|---|
| SSL提供了一个完整的安全通道,与认证、消息完整性和消息加密。 | ————客户机平台必须支持SSL客户端证书。 |
配置IIS接受客户端证书,打开IIS管理器和执行以下步骤:
- Click the site node in the tree view.
- Double-click the SSL Settings feature in the middle pane.
-
Under Client Certificates, select one of these options:
- Accept: IIS will accept a certificate from the client, but does not require one.
- Require: Require a client certificate. (To enable this option, you must also select "Require SSL")
文件:
<system.webServer>
<security>
<access sslFlags="Ssl, SslNegotiateCert" />
<!-- To require a client cert: -->
<!-- <access sslFlags="Ssl, SslRequireCert" /> -->
</security>
</system.webServer>
为了测试创建一个客户端证书
MakeCert.exe to create a client certificate. First, create a test root authority:
makecert.exe -n "CN=Development CA" -r -sv TempCA.pvk TempCA.cer
Makecert will prompt you to enter a password for the private key.
- Open MMC.
- Under File, select Add/Remove Snap-In.
- Select Computer Account.
- Select Local computer and complete the wizard.
- Under the navigation pane, expand the "Trusted Root Certification Authorities" node.
- On the Action menu, point to All Tasks, and then click Import to start the Certificate Import Wizard.
- Browse to the certificate file, TempCA.cer.
- Click Open, then click Next and complete the wizard. (You will be prompted to re-enter the password.)
Now create a client certificate that is signed by the first certificate:
makecert.exe -pe -ss My -sr CurrentUser -a sha1 -sky exchange -n "CN=name"
-eku 1.3.6.1.5.5.7.3.2 -sk SignedByCA -ic TempCA.cer -iv TempCA.pvk
在Web API中使用客户端证书
GetClientCertificate on the request message. The method returns null if there is no client certificate. Otherwise, it returns an X509Certificate2 instance. Use this object to get information from the certificate, such as the issuer and subject. Then you can use this information for authentication and/or authorization.
X509Certificate2 cert = Request.GetClientCertificate();
string issuer = cert.Issuer;
string subject = cert.Subject;