使用API Key验证WCF Data Service

Ron Jacobs 有篇文章介绍如何在WCF Rest Service中使用API Key验证：http://blogs.msdn.com/b/rjacobs/archive/2010/06/14/how-to-do-api-key-verification-for-rest-services-in-net-4.aspx ，在WCF Data Service中怎么做呢？本文将介绍如何在WCF Data Service中使用API Key进行验证，主要代码来自于Ron Jacobs的这篇文章.

API Key作为一个参数在URL中传递， 在Rob Jacobs的WCFWebHttpLibrary.APIKeyAuthorization的方法string GetAPIKey(OperationContext operationContext)的代码如下：

public string GetAPIKey(OperationContext operationContext)
{
  // Get the request message
  var request = operationContext.RequestContext.RequestMessage;
  // Get the HTTP Request
  var requestProp =(HttpRequestMessageProperty)request.Properties[HttpRequestMessageProperty.Name];
  // Get the query string
  NameValueCollection queryParams =
      HttpUtility.ParseQueryString(requestProp.QueryString);

  // Return the API key (if present, null if not)
  string apiKey = queryParams[APIKEY];
  // Is the API Key available in the querystring?
  if (apiKey == null)
  {
    // Is the API Key available in the header?
    apiKey = requestProp.Headers[APIKEY];
  }
  return apiKey;
}

WCF Data Service的OnStartProcessingRequest 方法在处理每个请求之前调用。对于批处理请求，将会为顶级批处理请求调用一次，然后为批处理中的每个操作调用一次。 我们在这个方法里可以实施自定义验证的相关逻辑：

protected override void OnStartProcessingRequest(ProcessRequestArgs args)
{
   var queryParams = HttpUtility.ParseQueryString(args.OperationContext.AbsoluteRequestUri.Query);
   string apiKey = queryParams[APIKEY];
   if (apiKey == null)
   {
        apiKey = args.OperationContext.RequestHeaders[APIKEY];
   }
   if (CheckValidAPIKey(apiKey))
   {
      base.OnStartProcessingRequest(args);
   }
   else
   {
       throw new System.Web.Services.Protocols.SoapException();
   }

}

客户端调用的时候，可以在SendingRequest事件添加到请求的Header里头：

class Program
{
        static void Main(string[] args)
        {
            Uri serviceUri = new Uri("http://localhost/ProfilesDataService");

            ServiceReference.YUPEntities service = new ServiceReference.YUPEntities(serviceUri);
            service.SendingRequest += new EventHandler<System.Data.Services.Client.SendingRequestEventArgs>

(service_SendingRequest);

            var items = service.Execute<UserProfile>(new Uri(http://localhost/ProfilesDataService/GetUserProfile?username='testvip')).ToList();
            foreach (UserProfile profile in items)
            {
                Console.WriteLine(profile.Title);
            }
        }

        static void service_SendingRequest(object sender,System.Data.Services.Client.SendingRequestEventArgs e)
        {
            // when using api in the header...
            e.Request.Headers.Add("APIkey", "918704ec-4811-45b6-a169-16bae3df69a8");

        }

}