如何通过编程将WebForms中动态创建的WCF服务限制为仅HTTPS访问？

方案1：硬编码强制HTTPS（自定义HostFactory） #

通过自定义WebServiceHostFactory，在服务初始化阶段配置绑定安全规则，并添加强制HTTPS的服务行为，从根源上限制服务仅接受HTTPS请求。

1. 自定义HostFactory和安全行为类：

public class HttpsOnlyWebServiceHostFactory : WebServiceHostFactory
{
    protected override ServiceHost CreateServiceHost(Type serviceType, Uri[] baseAddresses)
    {
        var host = base.CreateServiceHost(serviceType, baseAddresses);
        
        // 配置所有WebHttpBinding的安全模式为Transport（即HTTPS）
        foreach (var endpoint in host.Description.Endpoints)
        {
            if (endpoint.Binding is WebHttpBinding webBinding)
            {
                webBinding.Security.Mode = WebHttpSecurityMode.Transport;
                webBinding.Security.Transport.ClientCredentialType = HttpClientCredentialType.None;
            }
        }
        
        // 添加强制HTTPS的服务行为
        host.Description.Behaviors.Add(new TransportSecurityEnforcer());
        
        return host;
    }
}

// 自定义行为，确保通道仅接受HTTPS请求
public class TransportSecurityEnforcer : IServiceBehavior
{
    public void AddBindingParameters(ServiceDescription serviceDescription, ServiceHostBase serviceHostBase, System.Collections.ObjectModel.Collection<ServiceEndpoint> endpoints, BindingParameterCollection bindingParameters)
    {
    }

    public void ApplyDispatchBehavior(ServiceDescription serviceDescription, ServiceHostBase serviceHostBase)
    {
        foreach (var dispatcher in serviceHostBase.ChannelDispatchers)
        {
            if (dispatcher is HttpChannelDispatcher httpDispatcher)
            {
                httpDispatcher.RequireHttps = true;
            }
        }
    }

    public void Validate(ServiceDescription serviceDescription, ServiceHostBase serviceHostBase)
    {
    }
}

2. 修改global.asax中的路由注册，替换原有的WebServiceHostFactory为自定义工厂：

RouteTable.Routes.Add(
    new ServiceRoute(
        "ECConfigService",
        new HttpsOnlyWebServiceHostFactory(),
        typeof(ECConfigService.ECConfigService)));

方案2：运行时动态判断（支持开关控制） #

如果需要根据环境或配置动态决定是否强制HTTPS，可以在自定义HostFactory中加入逻辑判断，比如读取Web.config中的配置项：

修改自定义HostFactory的CreateServiceHost方法：

protected override ServiceHost CreateServiceHost(Type serviceType, Uri[] baseAddresses)
{
    var host = base.CreateServiceHost(serviceType, baseAddresses);
    // 从Web.config的AppSettings中读取开关配置，默认强制HTTPS
    bool enforceHttps = bool.Parse(ConfigurationManager.AppSettings["EnforceWcfHttps"] ?? "true");

    if (enforceHttps)
    {
        // 应用HTTPS强制规则（同方案1的配置逻辑）
        foreach (var endpoint in host.Description.Endpoints)
        {
            if (endpoint.Binding is WebHttpBinding webBinding)
            {
                webBinding.Security.Mode = WebHttpSecurityMode.Transport;
                webBinding.Security.Transport.ClientCredentialType = HttpClientCredentialType.None;
            }
        }
        host.Description.Behaviors.Add(new TransportSecurityEnforcer());
    }
    else
    {
        // 允许HTTP访问，重置绑定安全模式
        foreach (var endpoint in host.Description.Endpoints)
        {
            if (endpoint.Binding is WebHttpBinding webBinding)
            {
                webBinding.Security.Mode = WebHttpSecurityMode.None;
            }
        }
    }

    return host;
}

备选方案：服务方法内检查（轻量但不够彻底） #

如果不想修改HostFactory，可以在服务的每个方法中直接检查请求是否为HTTPS，但这种方式需要逐个方法添加逻辑，适合简单场景：

public class ECConfigService : IECConfigService
{
    public string GetConfigValue(string key)
    {
        if (!HttpContext.Current.Request.IsSecureConnection)
        {
            throw new FaultException("该服务仅支持HTTPS访问");
        }
        // 业务逻辑...
        return "配置值";
    }
}

内容的提问来源于stack exchange，提问作者ShawnO