Re: Need for encryption in WSE 3.0 if using SS-avoid man-in-middle
- From: stcheng@xxxxxxxxxxxxxxxxxxxx (Steven Cheng[MSFT])
- Date: Fri, 20 Oct 2006 04:34:01 GMT
Hi John,
Yes, your concern that some malicious user may redirect the user to a fake
server is reasonable. However, this can be detected by SSL/HTTPS client in
almost every webclient implementation. For example, in IE browser, when
you visit a ssl/https protected site, if the server certificate is not in
your client machine's trust storage, IE will raise dialog to alert you and
only if you proof to continue will the https/ssl connection successfully
establish.
When you use .net network API(such as webservice proxy or webrequest class)
to access remote SSL/https service, there also exist programming interface
to do the validation. I've mentioned the
"ServicePointManager.ServerCertificateValidationCallback" event in my first
reply, is there any particular reason or difficulty that this is not
suitable in your scenario?
This event is firing everytime at the initialize time of a https/ssl
connection between client and server(when the client just receive server's
SSL certificate), you can query the certificate's attributes to determine
whether it is your expected one(this validation logic is up to you since
you know what certificate is expected ....). Surely, at that time, the
webservice hasn't send any message since SSL/HTTPS connection is even not
established, if you found that the server certificate is not expected one,
just return false for the function or even through exception.
Here is my original message in first reply
==============================
If your concern is that some malicious one else may redirect the request
to a fake server with SSL/certificates, then you can add codelogic in your
client application to valiate the server certificate exposed from the
SSL/HTTPS server. The ServicePointManager class in .net framework provide
ServerCertificateValidationCallback event that can let us add custom code
logic to verify the server (which provide the SSL/HTTPS service hannel).
And this event will occur at the initial time when your webservice (or
other webclient) which connect to HTTPS/SSL server through .net webrequest
components:
#ServicePointManager.ServerCertificateValidationCallback Property
http://msdn2.microsoft.com/en-us/library/system.net.servicepointmanager.serv
ercertificatevalidationcallback.aspx
#RemoteCertificateValidationCallback Delegate
http://msdn2.microsoft.com/en-us/library/system.net.security.remotecertifica
tevalidationcallback.aspx
=============================
Anyway, I think https/ssl the prefered approach if possible since it is
much simpler and strong for secure channel over http.
Sincerely,
Steven Cheng
Microsoft MSDN Online Support Lead
This posting is provided "AS IS" with no warranties, and confers no rights.
.
- Follow-Ups:
- References:
- Re: Need for encryption in WSE 3.0 if using SS-avoid man-in-middle att
- From: Dominick Baier
- Re: Need for encryption in WSE 3.0 if using SS-avoid man-in-middle
- From: Dominick Baier
- Re: Need for encryption in WSE 3.0 if using SS-avoid man-in-middle
- From: John K
- Re: Need for encryption in WSE 3.0 if using SS-avoid man-in-middle
- From: Steven Cheng[MSFT]
- Re: Need for encryption in WSE 3.0 if using SS-avoid man-in-middle
- From: Dominick Baier
- Re: Need for encryption in WSE 3.0 if using SS-avoid man-in-middle
- From: John K
- Re: Need for encryption in WSE 3.0 if using SS-avoid man-in-middle att
- Prev by Date: RE: LoginName in .vb
- Next by Date: RE: Membership - Database Security
- Previous by thread: Re: Need for encryption in WSE 3.0 if using SS-avoid man-in-middle
- Next by thread: Re: Need for encryption in WSE 3.0 if using SS-avoid man-in-middle
- Index(es):
Relevant Pages
|
