Logo
programming4us
programming4us
programming4us
programming4us
Home
programming4us
XP
programming4us
Windows Vista
programming4us
Windows 7
programming4us
Windows Azure
programming4us
Windows Server
programming4us
Windows Phone
 
Windows Azure

Service-Orientation with .NET : Exception Shielding

5/19/2011 11:39:08 AM
- How To Install Windows Server 2012 On VirtualBox
- How To Bypass Torrent Connection Blocking By Your ISP
- How To Install Actual Facebook App On Kindle Fire
What is often overlooked as a source of potentially harmful information about the internal implementation of a service are exceptions or error messages. Services are sometimes designed to return detailed data about the nature of a given exception, thereby inadvertently disclosing information about their underlying architecture that can be abused by malicious consumer programs.

Exception Shielding  prescribes that exception information be sanitized prior to being sent to consumers. The sanitization of exception data is usually based on a process whereby some or all parts of the actual exception information are removed or replaced with data considered safe.

Note

The Exception Shielding pattern is considered a security pattern. It is covered here as it demonstrates a specialized application of the Service Abstraction principle.


In WCF there is a configuration setting that will make WCF replace all exceptions with a generic SOAP fault message, thereby not revealing anything unwanted to service consumers.

Here’s the statement that needs to be configured:

Example 1.
<serviceDebug includeExceptionDetailInFaults="False" />

Another alternative is to remove this configuration line altogether as the default behavior of WCF is to not include exception details in fault messages. This will still return a SOAP fault, but it will not be useful to consumers.

Here is how this type of fault message will look:

Example 2.
<s:Fault xmlns:s="http://schemas.xmlsoap.org/soap/envelope/">
<faultcode xmlns:a="http://schemas.microsoft.com/
net/2005/12/windowscommunicationfoundation/dispatcher">
a:InternalServiceFault
</faultcode>
<faultstring xml:lang="en-US">
The server was unable to process the request due
to an internal error. For more information about
the error, either turn on
IncludeExceptionDetailInFaults (either from
ServiceBehaviorAttribute or from the
&lt;serviceDebug&gt;configuration behavior)
on the server in order to send the
exception information back to the client,
or turn on tracing as per the Microsoft .NET
Framework SDK documentation and inspect the
server trace logs.
</faultstring>
</s:Fault>

You may actually want to provide more information in faults and even return different faults in different situations (for example when encountering a “Quota” error when a consumer has used the service more than the service’s SLA allows or a “Temporarily Unavailable” error when some of the service’s essential resources are offline).

Note also that the original exception produced by the service logic may contain information that is important for systems maintenance or customer support and therefore may need to be logged. For these types of situations, the sanitized fault message content can still include a unique ID that can be sent to the customer in order to allow for the correlation of the exception with the logged details.

In WCF, this type of behavior is built-in, in that all logs created within an activity (a service call) will have the same ActivityId. You can make sure that this ActivityId is propagated to composed services so that all logs in a service composition can be found using the same ActivityId.

To propagate the ActivityId to other WCF services and clients, you will need to add some configuration details because even when the propagateActivity attribute value is set to “true,” you may find that the ActivityId is still not propagated.

This is because you still need to configure a listener, as shown here:

Example 3.
<system.diagnostics>
<sources>
<source name="System.ServiceModel"
propagateActivity="true">
<listeners>
<add name="defaultListener"
type="System.Diagnostics.DefaultTraceListener" />
</listeners>
</source>
</sources>
</system.diagnostics>

These configuration settings need to be made on both ends of a message exchange (service and consumer). WCF passes the ActivityId around in a message header that is also added to fault messages.

Other -----------------
- Service-Orientation with .NET : Service Abstraction & Validation Abstraction
- Service-Orientation with .NET : Service Loose Coupling and Service Capability Granularity
- Service-Orientation with .NET : Service Façade
- Service-Orientation with .NET : Decoupled Contract
- Service-Orientation with .NET : Service Loose Coupling
- Service-Orientation with .NET : Service Contracts and Interoperability - Canonical Protocol
- Service-Orientation with .NET : Service Contracts and Interoperability - Data Model Transformation
- Service-Orientation with .NET : Service Contracts and Interoperability - Canonical Schema
- Service-Orientation with .NET : Standardized Service Contract
- Cloud Services with Windows Azure : Windows Azure Storage
 
 
25 Inspiring Game of Thrones Quotes
Top 10
- Microsoft Visio 2013 : Adding Structure to Your Diagrams - Finding containers and lists in Visio (part 2) - Wireframes,Legends
- Microsoft Visio 2013 : Adding Structure to Your Diagrams - Finding containers and lists in Visio (part 1) - Swimlanes
- Microsoft Visio 2013 : Adding Structure to Your Diagrams - Formatting and sizing lists
- Microsoft Visio 2013 : Adding Structure to Your Diagrams - Adding shapes to lists
- Microsoft Visio 2013 : Adding Structure to Your Diagrams - Sizing containers
- Microsoft Access 2010 : Control Properties and Why to Use Them (part 3) - The Other Properties of a Control
- Microsoft Access 2010 : Control Properties and Why to Use Them (part 2) - The Data Properties of a Control
- Microsoft Access 2010 : Control Properties and Why to Use Them (part 1) - The Format Properties of a Control
- Microsoft Access 2010 : Form Properties and Why Should You Use Them - Working with the Properties Window
- Microsoft Visio 2013 : Using the Organization Chart Wizard with new data
- First look: Apple Watch

- 3 Tips for Maintaining Your Cell Phone Battery (part 1)

- 3 Tips for Maintaining Your Cell Phone Battery (part 2)
programming4us programming4us
Popular tags
Microsoft Access Microsoft Excel Microsoft OneNote Microsoft PowerPoint Microsoft Project Microsoft Visio Microsoft Word Active Directory Biztalk Exchange Server Microsoft LynC Server Microsoft Dynamic Sharepoint Sql Server Windows Server 2008 Windows Server 2012 Windows 7 Windows 8 windows Phone 7 windows Phone 8
programming4us programming4us
 
programming4us
Natural Miscarriage
programming4us
Windows Vista
programming4us
Windows 7
programming4us
Windows Azure
programming4us
Windows Server
programming4us
Game Trailer