设置建立安全性上下文=“假"的影响是什么?如果我使用https? [英] What are the impacts of setting establishSecurityContext="False" if i use https?

问题描述

我的WFC服务使用配置有以下内容的wsHttpBinding:

My WFC service uses wsHttpBinding configured with:

<security mode="TransportWithMessageCredential">
    <message establishSecurityContext="True" clientCredentialType="UserName"/>
    <transport clientCredentialType="None" proxyCredentialType="None"/>
</security>

我们的一个合作伙伴正在尝试使用java Metro库调用我们的服务.他们有此问题.我必须设置EstablishmentSecurityContext ="False"才能正常工作.我们进行了快速测试，当我将其设置为false时，它确实可以工作.

One of our partner is trying to invoke our services using the java the Metro library. They have this problem. I have to set establishSecurityContext="False" for this to work. We did a quick test and it works indeed when I set it to false.

不使用安全会话会产生什么影响(通过设置EstablishmentSecurityContext ="False").我已经在https上运行了.那么在安全性方面我可以吗?还有其他需要考虑的影响(也许是性能)吗?

What would be the impacts of not using secure sessions (by setting establishSecurityContext="False"). I'm already running on https. So will I be OK in terms of security? And are there other impacts to consider (performance maybe)?

谢谢

推荐答案

区别在于，在未启用SCT(安全上下文令牌)的端点上，密钥交换和验证必须按每次调用进行，而不是一次进行并为该会话进行缓存，并且仅在消息中传递了一个SCT. SCT基于对称密钥，这使它们在签名/加密消息时效率更高.当期望客户端连续拨打许多电话时，SCT的使用非常好，因为它减轻了每次交换和验证一次性密钥的需求.

The difference is that the on an non-SCT (security context token) enabled endpoint, key exchange and validation must be done per call as opposed to being done once and cached for the session and only a SCT passed around in the messages instead. SCTs are based on a symmetric key which makes them much more efficient for signing/encrypting the message. The use of a SCT is very good when the client is expected to make many calls in succession because it alleviates the need to do the exchange and validation of a one off key every time.

我建议您为不支持SCT的客户端公开另一个端点，并告诉他们使用该端点.您可以将使用SCT的客户端指向默认端点，并保留其附带的所有好处.

What I would recommend is that you just expose another endpoint for clients that don't support SCTs and tell them to use that. Clients that can use SCTs you keep pointed at the default endpoint and keep all the benefits that come with it.

有关此主题的更多信息，请查看

For more on the subject, check out section three of the WS-SecureConversation documentation.

这篇关于设置建立安全性上下文=“假"的影响是什么?如果我使用https?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！