All geek questions in one place

Securing WCF so that it can only be called by Silverlight

I am writing a Silverlight application that will read and write data to a server database through some WCF web services.

What is the best way to protect these web services?

My goal is to make sure that services cannot be called by other applications and potentially spam requests to add items to the database. A Silverlight application must have access to them.

+3
source share
2 answers

In general, you cannot assume anything about the client. If you try not to use applications other than Silverlight from your site, an attacker can easily pretend to be a Silverlight application, and you will return to the square.

That is, this is not an effective way to protect the server. To protect your server, assume that all and all clients will get to your site and start from there.

Edit:

Let me fix this by saying that if you want to get into the world of mutual authentication, you can configure PKI to manage certificates, issue user certificates to all your users, and then you know who your users are. However, one of them can be harmful (and talented) and introduce a certificate to another client.

+4
source

, , Silverlight.

, , : , , , . ( ) , , , .

:

  • . - ? SSL.
  • . -, ? (Forms Auth, ). Silverlight ( , Silverlight), WCF. , SSL ( , ) .
+8

Source: https://habr.com/ru/post/1711399/

More articles:


All Articles