ICredentialPolicy 接口


定义凭据策略,该凭据策略将用于使用 WebRequest 及其派生类发出的资源请求。Defines the credential policy to be used for resource requests that are made using WebRequest and its derived classes.

public interface class ICredentialPolicy
public interface ICredentialPolicy
type ICredentialPolicy = interface
Public Interface ICredentialPolicy


下面的代码示例演示了此接口的一个实现,该实现允许只发送针对特定主机的请求的凭据。The following code example shows an implementation of this interface that permits credentials to be sent only for requests that target specific hosts.

public ref class SelectedHostsCredentialPolicy: public ICredentialPolicy

   virtual bool ShouldSendCredential( Uri^ challengeUri, WebRequest^ request, NetworkCredential^ /*credential*/, IAuthenticationModule^ /*authModule*/ )
      Console::WriteLine( L"Checking custom credential policy." );
      if ( request->RequestUri->Host->Equals( L"www.contoso.com" ) || challengeUri->IsLoopback == true )
            return true;

      return false;
public class SelectedHostsCredentialPolicy: ICredentialPolicy
    public SelectedHostsCredentialPolicy()
    public virtual bool ShouldSendCredential(Uri challengeUri, 
        WebRequest request, 
        NetworkCredential credential, 
        IAuthenticationModule authModule)
        Console.WriteLine("Checking custom credential policy.");
        if (request.RequestUri.Host == "www.contoso.com" ||
            challengeUri.IsLoopback == true)
            return true;

        return false;


凭据策略确定为网络资源(如网页的内容)发送 WebRequest 时是否发送凭据。The credential policy determines whether to send credentials when sending a WebRequest for a network resource, such as the content of a Web page. 如果发送了凭据,则需要客户端身份验证的服务器可以尝试在收到请求时对客户端进行身份验证,而不是发送指示需要客户端凭据的响应。If credentials are sent, servers that require client authentication can attempt to authenticate the client when the request is received instead of sending a response that indicates that the client's credentials are required. 尽管这会在服务器上保存一次往返,但这种性能提升必须与通过网络发送凭据的固有安全风险相平衡。While this saves a round trip to the server, this performance gain must be balanced against the security risk inherent in sending credentials across the network. 当目标服务器不需要客户端身份验证时,最好不要发送凭据。When the destination server does not require client authentication, it is best not to send credentials.


仅当与请求关联的 WebRequestWebProxy 具有不 null的凭据时,才会调用 ICredentialPolicy 策略。ICredentialPolicy policies are invoked only if the WebRequest or the WebProxy that is associated with the request has credentials that are not null. 设置此策略不会影响未指定凭据的请求。Setting this policy has no effect on requests that do not specify credentials.

使用 AuthenticationManager.CredentialPolicy 属性设置 ICredentialPolicy 策略。Use the AuthenticationManager.CredentialPolicy property to set an ICredentialPolicy policy. 处理请求身份验证的 IAuthenticationModule 将调用 ShouldSendCredential 方法,然后再执行身份验证。The IAuthenticationModule that handles authentication for the request will invoke the ShouldSendCredential method before performing the authentication. 如果该方法返回 false,则不会执行身份验证。If the method returns false, authentication is not performed.

ICredentialPolicy 策略会影响当前应用程序域中具有非 null 凭据 WebRequest 的所有实例。An ICredentialPolicy policy affects all instances of WebRequest with non-null credentials in the current application domain. 无法在单个请求中重写此策略。The policy cannot be overridden on individual requests.


ShouldSendCredential(Uri, WebRequest, NetworkCredential, IAuthenticationModule)

返回一个 Boolean,该值指示客户端的凭据是否随使用 WebRequest 类的实例发出的资源请求一起发送。Returns a Boolean that indicates whether the client's credentials are sent with a resource request made using an instance of the WebRequest class.