Web Service的安全访问【SoapHeader身份认证】

web service安全访问方式可以以下安全措施：

（1）是谁调用？-----soapheader身份认证

（2）来自哪里？-----访问IP认证

（3）加密传输？-----SSL安全访问

本文主要讲解通过SoapHeader来增强Web Service的安全性

(1)自定义soapheader派生类

/// <summary>
    /// SoapHeader安全验证
    /// </summary>
    public class CredentialSoapHeader : SoapHeader
    {
        private string m_username;
        private string m_password;

        public string Username
        {
            get { return m_username; }

            set { m_username = value; }
        }

        public string Password
        {
            get { return m_password; }

            set { m_password = value; }
        }

        public bool VerifyCredentials(string name, string pwd, out string msg)
        {
            msg = "";
            try
            {
                if (name == "test" && pwd == "test")
                {
                    return true;
                }
                else
                {
                    msg = "对不起，您无权限调用此web服务";
                    return false;
                }
            }
            catch
            {
                msg = "对不起，您无权限调用此web服务";
                return false;
            }
        }
    }

(2)添加基于SoapHeader验证的web service接口方法：

CredentialSoapHeader soap = new CredentialSoapHeader();
        string msg = string.Empty;

        #region 退款
        /// <summary>
        /// 统计退款个数
        /// </summary>
        /// <param name="itemid">项目ID</param>
        /// <param name="productid">产品ID</param>
        /// <param name="state">退款状态：待处理，处理中，已退款</param>
        /// <returns></returns>
        [WebMethod]
        [SoapHeader("soap")]
        public int RefundCount(int itemid, int productid, int state)
        {
            if (soap.VerifyCredentials(soap.Username, soap.Password, out msg))
            {
                int count = 0;
                return count;
            }
            else
            {
                return 0;
            }
        }

（3）客户端调用

/// <summary>
        /// 获取安全凭证
        /// </summary>
        /// <returns></returns>
        private static CTOCInterface.CredentialSoapHeader GetInterfaceSoapHeader()
        {
            CTOCInterface.CredentialSoapHeader header = new CTOCInterface.CredentialSoapHeader();
            header.Username = MODEL.SystemConfigInfo.KEY_WTCTOCServiceUsername;
            header.Password = MODEL.SystemConfigInfo.KEY_WTCTOCServicePassword;
            return header;
        }

        /// <summary>
        /// 统计退款个数
        /// </summary>
        /// <param name="userlogin"></param>
        /// <returns></returns>
        protected static int RefundCount(int itemid, int productid, int state)
        {
            using (CTOCInterface.CTOCGroupPurchaseSoapClient client = new CTOCInterface.CTOCGroupPurchaseSoapClient())
            {
                try
                {
                    return client.RefundCount(GetInterfaceSoapHeader(), itemid,productid,state);
                }
                catch
                {
                    return null;
                }

            }
        }