SOAP请求Header中添加UsernameToken的最优方案及可复用动态实现

你的现有实现已经很好地完成了在SOAP请求中添加UsernameToken的核心功能，接下来我们可以从复用性、灵活性、可维护性三个维度进行优化，打造一个通用的、可动态配置的组件。

核心优化方向与代码实现 #

1. 抽象认证配置，实现配置驱动 #

把硬编码的用户名、密码、密码类型抽离成可配置的实体，支持从配置文件、环境变量或DI容器动态注入，避免每次修改认证信息都要改动代码。

// 定义认证配置类
public class WsSecurityConfig
{
    public string Username { get; set; } = string.Empty;
    public string Password { get; set; } = string.Empty;
    // 默认使用明文密码类型，支持动态切换为Digest
    public string PasswordType { get; set; } = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText";
}

2. 重构Behavior与Inspector，提升复用性 #

将原有的硬编码逻辑改为依赖配置类，同时缓存序列化器提升性能，避免每次请求都创建新的序列化实例。

// 重构后的EndpointBehavior，依赖配置类
public class WsSecurityEndpointBehavior : IEndpointBehavior
{
    private readonly WsSecurityConfig _securityConfig;

    // 支持直接传入配置或通过DI注入
    public WsSecurityEndpointBehavior(WsSecurityConfig securityConfig)
    {
        _securityConfig = securityConfig ?? throw new ArgumentNullException(nameof(securityConfig));
    }

    public void AddBindingParameters(ServiceEndpoint endpoint, BindingParameterCollection bindingParameters) { }

    public void ApplyClientBehavior(ServiceEndpoint endpoint, ClientRuntime clientRuntime)
    {
        clientRuntime.ClientMessageInspectors.Add(new WsSecurityMessageInspector(_securityConfig));
    }

    public void ApplyDispatchBehavior(ServiceEndpoint endpoint, EndpointDispatcher endpointDispatcher) { }

    public void Validate(ServiceEndpoint endpoint) { }
}

// 重构后的MessageInspector，缓存序列化器
public class WsSecurityMessageInspector : IClientMessageInspector
{
    private readonly WsSecurityConfig _securityConfig;
    // 全局缓存XmlSerializer，避免重复创建开销
    private static readonly XmlSerializer _usernameTokenSerializer = new XmlSerializer(typeof(UsernameToken));

    public WsSecurityMessageInspector(WsSecurityConfig securityConfig)
    {
        _securityConfig = securityConfig ?? throw new ArgumentNullException(nameof(securityConfig));
    }

    public object BeforeSendRequest(ref Message request, IClientChannel channel)
    {
        var usernameToken = new UsernameToken
        {
            Username = _securityConfig.Username,
            Password = new Password
            {
                Value = _securityConfig.Password,
                Type = _securityConfig.PasswordType
            }
        };

        var securityHeader = new Security(usernameToken);
        request.Headers.Add(securityHeader);

        return null;
    }

    public void AfterReceiveReply(ref Message reply, object correlationState) { }
}

// 重构Security Header，支持传入UsernameToken实例
public class Security : MessageHeader
{
    private readonly UsernameToken _usernameToken;

    public Security(UsernameToken usernameToken)
    {
        _usernameToken = usernameToken ?? throw new ArgumentNullException(nameof(usernameToken));
    }

    public override string Name => "Security";
    public override string Namespace => "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd";
    public override bool MustUnderstand => true;

    protected override void OnWriteHeaderContents(XmlDictionaryWriter writer, MessageVersion messageVersion)
    {
        _usernameTokenSerializer.Serialize(writer, _usernameToken);
    }
}

// 保留原有的UsernameToken和Password实体，无需修改
public class Password
{
    [XmlAttribute]
    public string Type { get; set; } = string.Empty;
    [XmlText]
    public string Value { get; set; } = string.Empty;
}

[XmlRoot(Namespace = "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd")]
public class UsernameToken
{
    [XmlElement]
    public string Username { get; set; } = string.Empty;
    [XmlElement]
    public Password Password { get; set; } = new Password();
}

3. 借助DI容器实现全局复用（以ASP.NET Core为例） #

将配置和Behavior注册到DI容器中，实现全局复用，避免每次创建客户端都重复实例化组件。

// 在Program.cs中注册配置与组件
builder.Services.Configure<WsSecurityConfig>(builder.Configuration.GetSection("WsSecurity"));
builder.Services.AddSingleton<WsSecurityEndpointBehavior>(sp => 
    new WsSecurityEndpointBehavior(sp.GetRequiredService<IOptions<WsSecurityConfig>>().Value));

4. 扩展方法简化客户端配置 #

添加扩展方法，让客户端添加认证Header的操作更简洁直观。

public static class SoapClientExtensions
{
    // 支持传入配置实例
    public static TClient AddWsSecurity<TClient>(this TClient client, WsSecurityConfig config) 
        where TClient : ClientBase
    {
        client.Endpoint.EndpointBehaviors.Add(new WsSecurityEndpointBehavior(config));
        return client;
    }

    // 支持从DI注入的Behavior
    public static TClient AddWsSecurity<TClient>(this TClient client, WsSecurityEndpointBehavior behavior) 
        where TClient : ClientBase
    {
        client.Endpoint.EndpointBehaviors.Add(behavior);
        return client;
    }
}

使用示例 #

全局复用场景（依赖DI） #

public class UserService
{
    private readonly WsSecurityEndpointBehavior _wsSecurityBehavior;

    public UserService(WsSecurityEndpointBehavior wsSecurityBehavior)
    {
        _wsSecurityBehavior = wsSecurityBehavior;
    }

    public async Task GetUserInfoAsync()
    {
        using var client = new TestClient().AddWsSecurity(_wsSecurityBehavior);
        await client.GetUserInfoAsync(new GetUserInfoRequest { token = "866-563-6746" });
    }
}

动态切换认证信息场景 #

public async Task GetUserInfoWithDynamicAuthAsync(string username, string password)
{
    var dynamicConfig = new WsSecurityConfig
    {
        Username = username,
        Password = password
    };

    using var client = new TestClient().AddWsSecurity(dynamicConfig);
    await client.GetUserInfoAsync(new GetUserInfoRequest { token = "866-563-6746" });
}

额外安全建议 #

• 避免明文存储密码：生产环境中建议使用配置加密（如ASP.NET Core机密管理器、环境变量加密）或从密钥管理服务（如Azure Key Vault）获取密码。
• 优先使用HTTPS：如果使用PasswordText类型，必须确保SOAP请求通过HTTPS传输，防止密码明文泄露。
• 可选支持PasswordDigest：如果需要更高安全性，可以扩展组件支持PasswordDigest类型，需要生成随机Nonce和Created时间戳，并对密码进行哈希处理。

内容的提问来源于stack exchange，提问作者codinges