如何在WCF服务令牌认证前拦截消息并获取客户端IP至自定义验证器

核心原因：消息检查器执行时机问题 #

你之前添加的消息/端点检查器没触发，是因为WCF的安全认证管道优先于常规消息检查器执行——默认的IDispatchMessageInspector是在令牌验证通过后才会被调用，所以无法在认证阶段拿到IP。

直接解决方案：在自定义令牌验证器中直接获取IP #

其实在UserNameSecurityTokenAuthenticator的ValidateTokenCore方法中，OperationContext已经初始化完成，可以直接通过RemoteEndpointMessageProperty获取客户端IP，不需要额外拦截消息：

public class CustomUserNameSecurityTokenAuthenticator : UserNameSecurityTokenAuthenticator
{
    protected override ReadOnlyCollection<IAuthorizationPolicy> ValidateTokenCore(SecurityToken token)
    {
        // 获取客户端IP
        var remoteEndpoint = OperationContext.Current.IncomingMessageProperties[RemoteEndpointMessageProperty.Name] as RemoteEndpointMessageProperty;
        string clientIp = remoteEndpoint?.Address;

        // 执行自定义验证逻辑，可结合IP做限制
        var userNameToken = token as UserNameSecurityToken;
        if (!ValidateCredentials(userNameToken.UserName, userNameToken.Password, clientIp))
        {
            throw new SecurityTokenValidationException("用户名密码或IP验证失败");
        }

        // 返回授权策略（示例）
        var policy = new CustomAuthorizationPolicy(userNameToken.UserName);
        return new ReadOnlyCollection<IAuthorizationPolicy>(new List<IAuthorizationPolicy> { policy });
    }

    private bool ValidateCredentials(string username, string password, string clientIp)
    {
        // 这里实现你的验证逻辑，比如结合IP校验
        return true;
    }
}

自定义ServiceCredentials的扩展用法 #

如果你需要在认证前做更多消息预处理，可以在自定义ServiceCredentials中重写CreateSecurityTokenManager，并结合IEndpointBehavior添加一个安全前执行的消息检查器：

1. 实现提前执行的消息检查器，把IP存入线程上下文供验证器调用：

public class PreAuthMessageInspector : IDispatchMessageInspector
{
    public object AfterReceiveRequest(ref Message request, IClientChannel channel, InstanceContext instanceContext)
    {
        var remoteEndpoint = OperationContext.Current.IncomingMessageProperties[RemoteEndpointMessageProperty.Name] as RemoteEndpointMessageProperty;
        if (remoteEndpoint != null)
        {
            // 用线程本地存储暂存IP
            Thread.CurrentPrincipal = new GenericPrincipal(new GenericIdentity(remoteEndpoint.Address), Array.Empty<string>());
            // 或用自定义上下文类存储
            ClientContext.Current.IpAddress = remoteEndpoint.Address;
        }
        return null;
    }

    public void BeforeSendReply(ref Message reply, object correlationState)
    {
        // 清理上下文避免污染
        ClientContext.Current = null;
    }
}

// 自定义上下文类示例
public static class ClientContext
{
    public static ClientInfo Current { get; set; } = new ClientInfo();
}

public class ClientInfo
{
    public string IpAddress { get; set; }
}

2. 在自定义ServiceCredentials中关联检查器并替换令牌验证器：

public class CustomServiceCredentials : ServiceCredentials
{
    public CustomServiceCredentials() : base() { }

    protected CustomServiceCredentials(CustomServiceCredentials other) : base(other) { }

    public override ServiceCredentials Clone()
    {
        return new CustomServiceCredentials(this);
    }

    public override SecurityTokenManager CreateSecurityTokenManager()
    {
        return new CustomSecurityTokenManager(this);
    }

    // 注册提前执行的消息检查器
    public void ApplyEndpointBehavior(ServiceEndpoint endpoint, EndpointDispatcher endpointDispatcher)
    {
        endpointDispatcher.DispatchRuntime.MessageInspectors.Add(new PreAuthMessageInspector());
    }
}

public class CustomSecurityTokenManager : ServiceCredentialsSecurityTokenManager
{
    public CustomSecurityTokenManager(CustomServiceCredentials credentials) : base(credentials) { }

    public override SecurityTokenAuthenticator CreateSecurityTokenAuthenticator(SecurityTokenRequirement tokenRequirement, out SecurityTokenResolver outOfBandTokenResolver)
    {
        if (tokenRequirement.TokenType == SecurityTokenTypes.UserName)
        {
            outOfBandTokenResolver = null;
            return new CustomUserNameSecurityTokenAuthenticator();
        }
        return base.CreateSecurityTokenAuthenticator(tokenRequirement, out outOfBandTokenResolver);
    }
}

3. 在服务配置中注册自定义ServiceCredentials：

<system.serviceModel>
  <behaviors>
    <serviceBehaviors>
      <behavior name="CustomServiceBehavior">
        <serviceCredentials type="YourNamespace.CustomServiceCredentials, YourAssembly">
          <userNameAuthentication userNamePasswordValidationMode="Custom" />
        </serviceCredentials>
      </behavior>
    </serviceBehaviors>
  </behaviors>
</system.serviceModel>

关键注意事项 #

• 确保WCF绑定配置支持获取远程IP：如basicHttpBinding或wsHttpBinding，无论传输层还是消息层安全，只要请求能进入服务端管道即可。
• 线程本地存储需及时清理，避免内存泄漏或上下文污染。

内容的提问来源于stack exchange，提问作者stockholm