asp.net – 经过身份验证的服务不支持跨域javascript回调. AJAX通过SSL代理查询WCF服务

asp.Net 前端之家
前端之家收集整理的这篇文章主要介绍了asp.net – 经过身份验证的服务不支持跨域javascript回调. AJAX通过SSL代理查询WCF服务，前端之家小编觉得挺不错的，现在分享给大家，也给大家做个参考。
我有一个WCF / SVC Web服务,通​​过 AJAX进行 JavaScript调用.
该页面通过位于DMZ中的SSL代理(https://gate.company.com/MyPage)访问,然后将请求转发到内部Web服务器(http：// myLocalWebServer / MyPage).

经过大量的googeling和尝试,我能够使它工作,使用参数crossDomainScriptAccessEnabled和Access-Control-Allow-Origin.虽然,它仅在身份验证模式设置为false或用户尚未登录时才有效.一旦从您需要登录的页面内进行调用(表单身份验证),它就不再起作用了.我得到的错误消息是：

cross domain javascript callback is not supported in authenticated services

但是,一旦我注销并从非受保护页面进行调用,它确实会再次起作用.

我的服务看起来像这样

namespace MyNameSpace
{
   [ServiceContract(Namespace = "MyNameSpace")]
   [AspNetCompatibilityRequirements(RequirementsMode = AspNetCompatibilityRequirementsMode.Allowed)]
   public class Service
   {
      [OperationContract]
       public string[] GetDropDownData(string id)
      {
         List<string> resultList = new List<string>();
         ...
         return resultList.ToArray();
      }
   }
}

JavaScript中的服务调用和回调方法：

function fillDropdwon(dropId){
    jQuery.ajax({
        type: "POST",dataType: "jsonp",contentType: "application/json; charset=utf-8",cache: true,url: "Service.svc/GetDropDownData",data: '{"dropId":"' + dropId + '"}',jsonpCallback: "onDone",error: function (a,b,c) {
            alert("error");
        }
    });
}

// Callback-Methode after ServiceCall
function onDone(result) {
   var theDropDown = jQuery("#<%= cboSelection.ClientID %>");
    if (theDropDown.length > 0) {
        //Clear the old entries
        theDropDown.empty();

        //Add an empty entry
        if ("<%= cboSelection.ShowEmptyRow %>".toLowerCase() == "true") {
            theDropDown.append($('<option></option>'));
        }

        // Add the found items
        for (var i = 0; i < result.length; i++) {
            var text = result[i];
            theDropDown.append($('<option></option>').val(text).html(text));
        }
    }
}

涉及服务的web.config部分：

<system.serviceModel>
  <behaviors>
    <endpointBehaviors>
      <behavior name="MyNameSpace.ServiceAspNetAjaxBehavior">
        <enableWebScript />
      </behavior>
    </endpointBehaviors>
    <serviceBehaviors>
      <behavior>
        <serviceMetadata httpGetEnabled="true" />
      </behavior>
    </serviceBehaviors>
  </behaviors>
  <serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />
  <standardEndpoints>
    <webScriptEndpoint>
      <standardEndpoint crossDomainScriptAccessEnabled="true" name=""/>
    </webScriptEndpoint>
  </standardEndpoints>
  <services>
    <service name="MyNameSpace.Service">
      <!-- Service endpoint for HTTPS -->
      <endpoint address="" behaviorConfiguration="MyNameSpace.ServiceAspNetAjaxBehavior" binding="webHttpBinding" bindingConfiguration="jsonpBinding" contract="MyNameSpace.Service" /> -->
    </service>
  </services>
  <bindings>
    <webHttpBinding>
      <binding name="jsonpBinding" crossDomainScriptAccessEnabled="true">
        <security mode="None" />
      </binding>
      <binding name="jsonpSslBinding" crossDomainScriptAccessEnabled="true">
        <security mode="Transport" />
      </binding>
    </webHttpBinding>
  </bindings>
</system.serviceModel>

我首先尝试使用ASP.NET AJAX代理来调用服务,但这不起作用,因为直接调用了web服务器,这不是SSL,我得到的错误或多或少：’Page https：/ /gate.company.com/MyPage尝试加载不保存来自页面http：// myLocalWebServer / MyPage …’的内容.这就是我使用上面列出的AJAX调用的原因.

function fillDropdwon(dropId){
   var service = new MyNameSpace.Service();
   service.GetDropDownData(dropId,onDone);
}

我还尝试在web.config中添加以下内容

<system.webServer>
  <httpProtocol>
    <customHeaders>
      <!-- Enable Cross Domain AJAX calls -->
      <remove name="Access-Control-Allow-Origin" />
      <add name="Access-Control-Allow-Origin" value="https://gate.company.com"/>
    </customHeaders>
  </httpProtocol>
</system.webServer>

我检查了发送到服务器的标头,看到当我没有登录时,标题看起来像这样：

Request URL:`https://gate.company.com/MyPage/Servic.svc/GetDropDownData?callback=onDone`
Request Method:POST
Status Code:200 OK
Request Headersview source
Accept:text/javascript,application/javascript,application/ecmascript,application/x-ecmascript,*/*; q=0.01
Accept-Encoding:gzip,deflate,sdch
Accept-Language:de-DE,de;q=0.8,en-US;q=0.6,en;q=0.4,fr-CH;q=0.2,fr;q=0.2
Connection:keep-alive
Content-Length:161
Content-Type:application/json; charset=UTF-8
Cookie:__utma=174172730.1157990369.1360852643.1381229705.1383150435.9; __utmc=174172730; __utmz=174172730.1369635484.4.3.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided); promopost=oaezz3fzzj0o4l3fccxh0ss1;
ASP.NET_SessionID=
Host:`gate.company.com`
Origin:`https://gate.company.com`
Referer:`https://gate.company.com/MyPage/QuickCalculator.aspx?ObjectIdentity=47a93f52-6be6-4bd6-9600-e8eb9c8ff360`
User-Agent:Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML,like Gecko) Chrome/31.0.1650.48 Safari/537.36
X-Requested-With:XMLHttpRequest
Query String Parametersview sourceview URL encoded
callback:onDone
Request Payloadview source
{dropId:123}
dropId: "123"
Response Headersview source
Cache-Control:private
Connection:Keep-Alive
Content-Encoding:gzip
Content-Length:1339
Content-Type:application/x-javascript
Date:Sun,01 Dec 2013 15:14:25 GMT
Keep-Alive:timeout=15,max=97
Server:Microsoft-IIS/7.5
Vary:Accept-Encoding
X-AspNet-Version:4.0.30319
X-Powered-By

并且响应看起来像这样.

onDone(["result1","result2"]);

当我从受保护的页面中调用服务时,我得到了这个：

Request URL:`https://gate.company.com/MyPage/Servic.svc/GetDropDownData?callback=onDone`
Request Method:POST
Status Code:200 OK
Request Headersview source
Accept:text/javascript,fr;q=0.2
Connection:keep-alive
Content-Length:161
Content-Type:application/json; charset=UTF-8
Cookie:__utma=174172730.1157990369.1360852643.1381229705.1383150435.9; __utmc=174172730; __utmz=174172730.1369635484.4.3.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided); promopost=oaezz3fzzj0o4l3fccxh0ss1;
**ASP.NET_SessionID=; .ASPXAUTH=AB5ADCE12C7847CA452DD54D903E6787C7D1F0009B9E3277D2EC50DE9C421D1331B87A6DCA2432993933794AB9BDE833E44EC58E217D5AA1D588132C6E1C67D4AD7692840359D9A719EC2A53826CF54FDC0943B4E0AB29093920143E1E987080AC7C35E63594FD678535972D06AEC0AAF74AF8BE8DFC3746B499CB032E7771F10B924110DB344824B3253F9BECB3CDD8**
Host:`gate.company.com`
Origin:`https://gate.company.com`
Referer:`https://gate.company.com/MyPage/QuickCalculator.aspx?ObjectIdentity=47a93f52-6be6-4bd6-9600-e8eb9c8ff360`
User-Agent:Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML,01 Dec 2013 15:14:25 GMT
**jsonerror:true**
Keep-Alive:timeout=15,max=97
Server:Microsoft-IIS/7.5
Vary:Accept-Encoding
X-AspNet-Version:4.0.30319
**X-Powered-By:ASP.NET**

并且响应看起来像这样.

onDone({"ExceptionDetail":{"HelpLink":null,"InnerException":null,"Message":"Cross domain javascript callback is not supported in authenticated services.","StackTrace":"   bei System.ServiceModel.Dispatcher.JavascriptCallbackMessageInspector.AfterReceiveRequest(Message& request,IClientChannel channel,InstanceContext instanceContext)\u000d\u000a   bei System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.AfterReceiveRequestCore(MessageRpc& rpc)\u000d\u000a   bei System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage2(MessageRpc& rpc)\u000d\u000a   bei System.ServiceModel.Dispatcher.MessageRpc.Process(Boolean isOperationContextSet)","Type":"System.NotSupportedException"},"ExceptionType":"System.NotSupportedException",InstanceContext instanceContext)\u000d\u000a   bei System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.AfterReceiveRequestCore(MessageRpc& rpc)\u000d\u000a   bei System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage2(MessageRpc& rpc)\u000d\u000a   bei System.ServiceModel.Dispatcher.MessageRpc.Process(Boolean isOperationContextSet)"},500);

主要区别在于,对于“登录”版本,存在SessionID和jsonerror：true.

有办法解决这个问题吗？

是否无法通过在调用之前更改标头或“类似”来“禁用”AJAX请求的身份验证.或者我的代码web.config中是否有任何错误？

我很感激任何暗示,因为我在努力了很长时间.

解决方法

我终于找到了解决问题的方法.我写下了我为解决方案所采取的步骤,并希望这将有助于解决类似问题的任何人.

我首先使用ASP.NET AJAX代理并进行了这样的调用.

var service = new SDAG.Post.PPT.Website.Service();
service.GetDropDownData(dropId,onDone);

但是,这在我的环境配置中不起作用,SSL-Proxy通过端口80(上面列出)在内部转发到Web服务器.我收到了错误消息：

The page at <code>'https://gate.company.com/MyPage/Page.aspx?ObjectIdentity=f5c0c016-4828-4935-a7a9-73f3ba47a1ed'</code> was loaded over HTTPS,but displayed insecure content from <code>'http://myLocalWebServer.company.com/MyPage/Service.svc/GetDropDownData'</code>: this content should also be loaded over HTTPS.

ScriptResource.axd?d=8mniuUQAKIvBIxCF_O9BRQpND31cf-SHqs1HBOCcP0DdxGNo4-nOZcF0WZIDoCtTdw5mZIOSt0veif…:2

OPTIONS <code>http://myLocalWebServer.company.com/MyPage/Service.svc/GetDropDownData</code> 405 (Method Not Allowed) ScriptResource.axd?d=8mniuUQAKIvBIxCF_O9BRQpND31cf-SHqs1HBOCcP0DdxGNo4-nOZcF0WZIDoCtTdw5mZIOSt0veif…:2

OPTIONS <code>http://myLocalWebServer.company.com/MyPage/Service.svc/GetDropDownData</code> No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin <code>'https://gate.company.com'</code> is therefore not allowed access. ScriptResource.axd?d=8mniuUQAKIvBIxCF_O9BRQpND31cf-SHqs1HBOCcP0DdxGNo4-nOZcF0WZIDoCtTdw5mZIOSt0veif…:2

XMLHttpRequest cannot load <code>http://myLocalWebServer.company.com/MyPage/Service.svc/GetDropDownData</code>. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin <code>'https://gate.company.com'</code> is therefore not allowed access. Page.aspx?ObjectIdentity=f5c0c016-4828-4935-a7a9-73f3ba47a1ed:1

Refused to get unsafe header "jsonerror"

我发现通过在web.config中的webservice绑定配置中使用crossDomainScriptAccessEnabled并通过jQuery使用Jsonp Ajax调用,它确实有效(参见上面的代码)
但是：它只能在页面的非授权区域中工作.一旦用户在登录页面上进行了身份验证,呼叫就不再起作用了.它告诉我在经过身份验证的服务中不支持跨域javascript回调.

最后,我找到了解决方案.
该错误消息来自web.config中配置的crossDomainScriptAccessEnabled.当我删除它时,jsonp调用不再起作用.所以我做的是删除crossDomainScriptAccessEnabled并通过常规的json调用替换jsonp调用.

jQuery.ajax({
        type: "POST",dataType: "json",error: function (xhr,textStatus,errorThrown) {
            // Ignore in my case...
        },success: function (data,xhr) {
            fillSubList(data.d);
        }
    });

function fillSubList(result) {
    var theDropDown = jQuery("#<%= cboSelektion.ClientID %>");
    if (theDropDown.length > 0) {
        //Clear the old entries
        theDropDown.empty();

        //Add the empty one
        if ("<%= cboSelektion.ShowEmptyRow %>".toLowerCase() == "true") {
            theDropDown.append($('<option></option>'));
        }

        // Add the found items
        for (var i = 0; i < result.length; i++) {
            var text = result[i];
            theDropDown.append($('<option></option>').val(text).html(text));
        }
    }
}

猜你在找的asp.Net相关文章

.NetCore+WebUploader实现大文件分片上传
项目要求通过网站上传大文件，比如视频文件，通过摸索实现了文件分片来上传，然后后台进行...
CentOS7下让Asp.Net Core的网站自动运行
安装新版本的Nginx（vim /etc/yum.repos.d/nginx.repo） [nginx-stable] name=nginx stabl...
使用SignalR ASP.NET Core来简单实现一个后台实时推送数据给Echarts展示图表的功能
什么是 SignalR&#160;ASP.NET Core ASP.NET Core SignalR 是一种开放源代码库，可简化...
.NETCore项目在Windows下构建Docker镜像并本地导出分发到CentOS系统下
在Windows下使用Docker，我们选择Docker Desktop这个软件，非常方便。 ## Docker Desktop介...
C#编写运行在Linux环境下的采用Mediainfo来获取多媒体文件信息的代码
项目开始设计的是运行在windows下，所以一开始采用的是windows服务模式来获取多媒体文件信...
Blazor Server App Cannot find the fallback endpoint specified by route values
github官方issues中提到的解决方案，CreateBuilder时指定项目绝对路径可以解决。 1 // 指定...
ASP.NET CORE使用WebUploader对大文件分片上传，并通过ASP.NET CORE SignalR实时反馈后台处理进度给前端展示
本次，我们来实现一个单个大文件上传，并且把后台对上传文件的处理进度通过ASP.NET CORE S...
解决WPF+Avalonia在openKylin系统下默认字体问题
一、openKylin简介 openKylin（开放麒麟） 社区是在开源、自愿、平等和协作的基础上，由基...
WTM的项目中EFCore如何适配人大金仓数据库
一、WTM是什么 WalkingTec.Mvvm框架（简称WTM）最早开发与2013年，基于Asp.net MVC3 和 最...
实现ASP.Net Core3.1运行在DockeDesktop下并用Nginx实现负载均衡
一、首先去https://docs.docker.com/get-docker/下载Windows版本的Docker Desktop并安装（...
PHPJavaJava SEPythonC#C&C++RubyVBasp.NetGoPerlnettyDjangoDelphiJsp.NET CoreSpringFlaskSpringbootSpringMVCLuaLaravelMybatisAspGroovyThinkPHPYiiswoole
文件时间pythonm相等性PHP Warning时间问题问题解决pcntl_signal采样点wav模块动态文本调用频率限制对外暴露多个访问请求更新数据表模型结构type()方法比较速度手写体sobel算子保存模型Image类nn.Conv2dpytorch1.0kaggleDCGAN交并比range()用法打印模型反卷积卷积