ASMX Web服务Basic认证问题：凭据未传递至授权HttpModule

我之前也踩过ASMX服务用ClientCredentials设置Basic认证但服务端收不到凭据的坑，大概率是这几个关键点没处理到位，给你梳理下解决方案：

1. 确保客户端绑定配置启用Basic认证 #

ASMX客户端的ClientCredentials不会自动生效，必须先给绑定配置开启Basic认证支持。你可以通过两种方式配置：

方式1：通过配置文件（App.config/Web.config） #

找到客户端的绑定节点，修改为如下配置：

<bindings>
  <basicHttpBinding>
    <binding name="WebServiceSoap">
      <!-- 如果用HTTPS，把mode改成Transport；HTTP环境用TransportCredentialOnly（生产环境不推荐HTTP） -->
      <security mode="TransportCredentialOnly">
        <transport clientCredentialType="Basic" />
      </security>
    </binding>
  </basicHttpBinding>
</bindings>

方式2：通过代码动态配置绑定 #

如果不想改配置文件，也可以在代码里直接创建并配置绑定：

' 创建BasicHttpBinding并启用Basic认证
Dim binding As New BasicHttpBinding()
binding.Security.Mode = BasicHttpSecurityMode.TransportCredentialOnly
binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.Basic

' 指定服务端点地址
Dim endpoint As New EndpointAddress("http://你的服务地址/WebService.asmx")

' 用配置好的绑定和端点创建客户端
Dim svc As New WebServiceSoapClient(binding, endpoint)

' 再设置凭据
svc.ClientCredentials.UserName.UserName = "userId"
svc.ClientCredentials.UserName.Password = "i2awTieS0mdO"

2. 手动添加Authorization请求头（兜底方案） #

有时候ASMX客户端的ClientCredentials机制会因为版本或配置问题不生效，这时候可以直接手动构造Basic认证的请求头：

步骤1：定义请求头行为类 #

' 用于添加Basic认证头的端点行为
Public Class BasicAuthHeaderBehavior
    Implements IEndpointBehavior
    Private ReadOnly _credentials As String

    Public Sub New(credentials As String)
        _credentials = credentials
    End Sub

    Public Sub AddBindingParameters(endpoint As ServiceEndpoint, bindingParameters As BindingParameterCollection) Implements IEndpointBehavior.AddBindingParameters
    End Sub

    Public Sub ApplyClientBehavior(endpoint As ServiceEndpoint, clientRuntime As ClientRuntime) Implements IEndpointBehavior.ApplyClientBehavior
        clientRuntime.MessageInspectors.Add(New BasicAuthHeaderInspector(_credentials))
    End Sub

    Public Sub ApplyDispatchBehavior(endpoint As ServiceEndpoint, endpointDispatcher As EndpointDispatcher) Implements IEndpointBehavior.ApplyDispatchBehavior
    End Sub

    Public Sub Validate(endpoint As ServiceEndpoint) Implements IEndpointBehavior.Validate
    End Sub
End Class

' 消息检查器，负责在请求发送前添加Authorization头
Public Class BasicAuthHeaderInspector
    Implements IClientMessageInspector
    Private ReadOnly _credentials As String

    Public Sub New(credentials As String)
        _credentials = credentials
    End Sub

    Public Function AfterReceiveReply(ByRef reply As Message, correlationState As Object) As Object Implements IClientMessageInspector.AfterReceiveReply
        Return Nothing
    End Function

    Public Function BeforeSendRequest(ByRef request As Message, channel As IClientChannel) As Object Implements IClientMessageInspector.BeforeSendRequest
        Dim prop As HttpRequestMessageProperty = TryCast(request.Properties(HttpRequestMessageProperty.Name), HttpRequestMessageProperty)
        If prop Is Nothing Then
            prop = New HttpRequestMessageProperty()
            request.Properties(HttpRequestMessageProperty.Name) = prop
        End If
        ' 添加Basic认证头
        prop.Headers("Authorization") = $"Basic {_credentials}"
        Return Nothing
    End Function
End Class

步骤2：在客户端中使用该行为 #

Dim svc As New WebServiceSoapClient()
' 构造Base64编码的凭据
Dim credentials As String = Convert.ToBase64String(Encoding.ASCII.GetBytes("userId:i2awTieS0mdO"))
' 添加自定义行为
svc.Endpoint.Behaviors.Add(New BasicAuthHeaderBehavior(credentials))

3. 验证服务端HttpModule的读取逻辑 #

确保服务端的授权模块是从请求头中正确读取凭据的，示例代码如下（C#）：

public class AuthModule : IHttpModule
{
    public void Init(HttpApplication context)
    {
        context.AuthenticateRequest += Context_AuthenticateRequest;
    }

    private void Context_AuthenticateRequest(object sender, EventArgs e)
    {
        var authHeader = HttpContext.Current.Request.Headers["Authorization"];
        if (!string.IsNullOrEmpty(authHeader) && authHeader.StartsWith("Basic "))
        {
            // 解析Base64编码的凭据
            var credentialBytes = Convert.FromBase64String(authHeader.Substring(6));
            var credentials = Encoding.ASCII.GetString(credentialBytes).Split(':');
            var userName = credentials[0];
            var password = credentials[1];
            
            // 这里写你的验证逻辑
        }
    }

    public void Dispose() { }
}

同时要确保模块在web.config中正确注册：

<system.webServer>
  <modules>
    <add name="AuthModule" type="你的命名空间.AuthModule" />
  </modules>
</system.webServer>

4. 排查中间件/代理干扰 #

如果客户端和服务端之间有代理、负载均衡或其他中间件，需要确认这些组件允许传递Authorization请求头，有些中间件会默认过滤掉敏感头。

内容的提问来源于stack exchange，提问作者photo_tom