WCF RIA 和实体框架的安全性如何？

Question

我正在查看一些在后端使用 WCF RIA 和实体框架的 Silverlight 应用程序。 Visual Studio 生成的代码是

public IQueryable<someEntity> GetSomeEntity()
{
    return this.ObjectContext.someEntity;
}

现在，假设我设置了正确的身份验证，以便只有经过身份验证的用户才能调用此 Web 服务。我还对 Sliverlight 客户端进行了用户访问控制，因此他们只能访问他们被允许访问的数据。除了在 Web 服务本身上实施访问控制之外，是什么阻止经过身份验证的用户伪造 Web 服务请求（即绕过 Silverlight 客户端上的访问控制）？

Answer 1

这是如何使用 Silverlight 保护 RIA 服务的完整解决方案。希望对你有帮助。

网络项目

编写自定义会员提供程序

public class CustomMembershipProvider : MembershipProvider
{
    public override bool ValidateUser(string username, string password)
    {
        using(Model.YourDomainModel context = new Model.YourDomainModel())
        {
            var usr = context.Users.Where(u => u.Login == username &&
                u.Password == password).FirstOrDefault();

            return usr != null;
        }
    }

    public override string ApplicationName
    {
        get
        {
            return "Your app name";
        }
        set
        {
            throw new NotImplementedException();
        }
    }

    // Other overrides not implemented
    #region Other overrides not implemented
    public override bool ChangePassword(string username, string oldPassword, string newPassword)
    {
        throw new NotImplementedException();
    }

    public override bool ChangePasswordQuestionAndAnswer(string username, string password, string newPasswordQuestion, string newPasswordAnswer)
    {
        throw new NotImplementedException();
    }

    public override MembershipUser CreateUser(string username, string password, string email, string passwordQuestion, string passwordAnswer, bool isApproved, object providerUserKey, out MembershipCreateStatus status)
    {
        throw new NotImplementedException();
    }

    public override bool DeleteUser(string username, bool deleteAllRelatedData)
    {
        throw new NotImplementedException();
    }

    public override bool EnablePasswordReset
    {
        get { throw new NotImplementedException(); }
    }

    public override bool EnablePasswordRetrieval
    {
        get { throw new NotImplementedException(); }
    }

    public override MembershipUserCollection FindUsersByEmail(string emailToMatch, int pageIndex, int pageSize, out int totalRecords)
    {
        throw new NotImplementedException();
    }

    public override MembershipUserCollection FindUsersByName(string usernameToMatch, int pageIndex, int pageSize, out int totalRecords)
    {
        throw new NotImplementedException();
    }

    public override MembershipUserCollection GetAllUsers(int pageIndex, int pageSize, out int totalRecords)
    {
        throw new NotImplementedException();
    }

    public override int GetNumberOfUsersOnline()
    {
        throw new NotImplementedException();
    }

    public override string GetPassword(string username, string answer)
    {
        throw new NotImplementedException();
    }

    public override MembershipUser GetUser(string username, bool userIsOnline)
    {
        throw new NotImplementedException();
    }

    public override MembershipUser GetUser(object providerUserKey, bool userIsOnline)
    {
        throw new NotImplementedException();
    }

    public override string GetUserNameByEmail(string email)
    {
        throw new NotImplementedException();
    }

    public override int MaxInvalidPasswordAttempts
    {
        get { throw new NotImplementedException(); }
    }

    public override int MinRequiredNonAlphanumericCharacters
    {
        get { throw new NotImplementedException(); }
    }

    public override int MinRequiredPasswordLength
    {
        get { throw new NotImplementedException(); }
    }

    public override int PasswordAttemptWindow
    {
        get { throw new NotImplementedException(); }
    }

    public override MembershipPasswordFormat PasswordFormat
    {
        get { throw new NotImplementedException(); }
    }

    public override string PasswordStrengthRegularExpression
    {
        get { throw new NotImplementedException(); }
    }

    public override bool RequiresQuestionAndAnswer
    {
        get { throw new NotImplementedException(); }
    }

    public override bool RequiresUniqueEmail
    {
        get { throw new NotImplementedException(); }
    }

    public override string ResetPassword(string username, string answer)
    {
        throw new NotImplementedException();
    }

    public override bool UnlockUser(string userName)
    {
        throw new NotImplementedException();
    }

    public override void UpdateUser(MembershipUser user)
    {
        throw new NotImplementedException();
    }
    #endregion

编写自定义角色提供者

public class CustomRoleProvider  : RoleProvider
{
    public override string[] GetRolesForUser(string username)
    {
        using(Model.YourDomainModel context = new Model.YourDomainModel())
        {
            string[] roles = (from r in Roles
                           where r.User_name == username
                           select r.Role).ToArray();
            return roles;
        }
    }

    public override string ApplicationName
    {
        get
        {
            return "Your app name";
        }
        set
        {
            throw new NotImplementedException();
        }
    }

    //Other overrides not implemented
    #region Other overrides not implemented
    public override void AddUsersToRoles(string[] usernames, string[] roleNames)
    {
        throw new NotImplementedException();
    }

    public override void CreateRole(string roleName)
    {
        throw new NotImplementedException();
    }

    public override bool DeleteRole(string roleName, bool throwOnPopulatedRole)
    {
        throw new NotImplementedException();
    }

    public override string[] FindUsersInRole(string roleName, string usernameToMatch)
    {
        throw new NotImplementedException();
    }       

    public override string[] GetAllRoles()
    {
        throw new NotImplementedException();
    }

    public override string[] GetUsersInRole(string roleName)
    {
        throw new NotImplementedException();
    }

    public override bool IsUserInRole(string username, string roleName)
    {
        throw new NotImplementedException();
    }

    public override void RemoveUsersFromRoles(string[] usernames, string[] roleNames)
    {
        throw new NotImplementedException();
    }

    public override bool RoleExists(string roleName)
    {
        throw new NotImplementedException();
    }
    #endregion
}

编写您的 AuthenticationDomainService 类

[EnableClientAccess]
public class YourAuthenticationDomainService : AuthenticationBase<AuthUser>
{
}

public class AuthUser : UserBase
{
}

将 EnableClientAcces 添加到您的 DomainService 并检查角色

[EnableClientAccess()]
public class YourDomainService : DomainService
{
    public YourDomainService()
        : base()
    {
    }


    [RequiresRole("Role1, Role2")]
    public IQueryable<someEntity> GetSomeEntity()
    {
         return this.ObjectContext.someEntity;
    }
}

在 Web.Config 中添加：

<system.web>
    <authentication mode="Forms" />

    <membership defaultProvider="MyCustomProvider">
        <providers>
            <add name="MyCustomProvider" type="MyProject.Web.CustomMembershipProvider,MyProject.Web" />
        </providers>
    </membership>

    <roleManager enabled="true" defaultProvider="MyCustomProvider">
        <providers>
            <add name="MyCustomProvider" type="MyProject.Web.CustomRoleProvider,MyProject.Web" />
        </providers>
    </roleManager>
</system.web>

银光

在 App.xaml.cs 中将 WebContext 添加到 ApplicationLifetimeObjects

public partial class App : Application
{
    public App()
    {
        InitializeComponent();

        WebContext context = new WebContext();
        context.Authentication = new FormsAuthentication();
        ApplicationLifetimeObjects.Add(context);
    }
}

像这样写你的登录表单/对话框

LoginDialog.xaml

<Grid x:Name="LayoutRoot" Margin="2">
    <Grid.RowDefinitions>
        <RowDefinition Height="Auto" />
        <RowDefinition Height="Auto" />
        <RowDefinition Height="Auto" />
    </Grid.RowDefinitions>
    <Grid.ColumnDefinitions>
        <ColumnDefinition Width="Auto" />
        <ColumnDefinition />
    </Grid.ColumnDefinitions>

    <TextBlock Grid.Column="0" Grid.Row="0" Text="Login:" />
    <TextBlock Grid.Column="0" Grid.Row="0" Text="Password:" />
    <TextBox x:Name="txtLogin" Grid.Column="1" Grid.Row="0" />
    <PasswordBox x:Name="txtPassword" Grid.Column="1" Grid.Row="1" />
    <Button x:Name="btnLogin" Click="btnLogin_Click" Grid.Column="1" Grid.Row="2" />
</Grid>

LoginDialog.xaml.cs

private void btnLogin_Click((object sender, RoutedEventArgs e))
{
    LoginOperation loginOp = WebContext.Current.Authentication.Login(
        new LoginParameters(txtLogin.Text, txtPassword.Password));
    loginOp.Completed += (s2, e2) =>
    {
        if (loginOp.HasError)
        {
            //HANDLE ERROR
            loginOp.MarkErrorAsHandled();
        }
        else if (!loginOp.LoginSuccess)
        {
            MessageBox.Show("Wrong login or password.");
        }
        else
        {
            DialogResult = true;
        }
    };
}