通过在SOAP Header中携带认证ID，可避免调用WebService时对HTTP Cookie的依赖，实现自定义的认证和Session管理。具体实现方法如下：
public
class
SessionHeader : SoapHeader
{
public string SessionId;
}
[AttributeUsage(AttributeTargets.Method)]
public
class
SessionExtensionAttribute : SoapExtensionAttribute
{
int _priority = 1;
public override int Priority
{
get
{ return _priority; }
set
{ _priority = value; }
}
public override Type ExtensionType
{
get
{ return typeof(SessionExtension); }
}
}
public
class
SessionExtension : SoapExtension
{
public override void ProcessMessage(SoapMessage message)
{
if (message.Stage == SoapMessageStage.AfterDeserialize)
{
//Check for an SessionHeader containing valid credentials
foreach (SoapHeader header in message.Headers)
{
if (header is SessionHeader)
{
SessionHeader credentials = (SessionHeader)header;
// Check SessionId
break;
}
}
// Fail the call if we get to here. Either the header
// isn't there or it contains invalid credentials.
throw new SoapException("Invalid SessionId",
SoapException.ClientFaultCode);
}
}
public override Object GetInitializer(Type type)
{
return GetType();
}
public override Object GetInitializer(LogicalMethodInfo info,
SoapExtensionAttribute attribute)
{
return null;
}
public override void Initialize(Object initializer)
{
}
}
- 在WebService的WebMethod方法中添加属性
[WebService(Namespace
=
"
http://tempuri.org/
"
)]
[WebServiceBinding(ConformsTo
=
WsiProfiles.BasicProfile1_1)]
public
class
EDocService : System.Web.Services.WebService
{
public SessionHeader Credentials;
[SessionExtension]
[SoapHeader("Credentials")]
[WebMethod]
public void Method1()
{
string sid = credentials.sessionid;
}
}
当调用Method1时，如果SOAP Header中没有合法的SessionID，则调用方会收到HTTP 500错误，无法执行Method1的代码。
