首页 文章

核心2授权API控制器

提问于
浏览 次
2

我有一个Web应用程序，我使用.NET Core 2 MVC和个人用户帐户构建 . 该应用程序正常工作，控制器上的授权工作得很好，只显示允许的视图等 .

它是标准的，在线提供各种教程的指导 . 它没有做任何太聪明的基本形式进行CRUD操作 .

我想添加一些REST endpoints ，将JSON交换到此应用程序，并使用JWT作为授权（Bearer）头来授权 endpoints . 根据所有教程，这应该是相当简单的，因为它们已经合并但我似乎无法得到任何工作 .

似乎发生了什么，MVC授权覆盖了JWTBearer授权，因此当我有登录的cookie时，我只能访问API动作（我想要路由为/ api / ） .

  • 我需要将MVC内容与授权单独放在一起 . 这很好用 .

  • 我想在/ api / / / 添加API endpoints 我不介意这是在同一个控制器还是不同的控制器

  • / api上的授权应该通过JWT承载令牌和MVC内容通过登录cookie作为标准 . 但是，两者都映射到同一个用户（ownerID）

谁能指出我正确的方向？我一直在尝试实施一个简单的GET方法3天，我一直在打砖墙 .

EDIT: 进一步的测试揭示了一些有趣的东西 . 我已经安装了Swagger来测试请求 .

我添加了第二个控制器来处理我的API方法 . 这是关于api / Races . 该控制器具有JWTBearerDefaults作为认证方案 .

[Authorize(AuthenticationSchemes = JwtBearerDefaults.AuthenticationScheme)]
[Route("api/[controller]")]

  • 如果我没有通过MVC应用程序登录，并且在没有持票人令牌的情况下发出请求，则会将我重定向到登录状态 .

  • 如果我没有通过MVC应用程序登录，并使用（有效）令牌发出请求，则会将我重定向到登录状态 .

  • 当我通过MVC登录并在没有Bearer令牌的情况下执行我的请求时，我收到401 Unauthorized（预期）

  • 当我（仍然）登录并使用有效的承载令牌执行我的请求时，我收到有效的响应 .

  • 当我仍然使用无效的承载令牌登录执行我的请求时，我获得401未授权（预期）

因此，似乎它使用令牌身份验证作为第二层授权 . 我想要它做的是，在/ api控制器上，使用它作为授权的唯一方法 .

这是我的代码 startup.cs

using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Identity;
using Microsoft.EntityFrameworkCore;
using Microsoft.AspNetCore.Hosting;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using TechsportiseOnline.Data;
using TechsportiseOnline.Models;
using TechsportiseOnline.Services;
using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc.Authorization;
using TechsportiseOnline.Authorization;
using TechsportiseOnline.Helpers;
using Swashbuckle.AspNetCore.Swagger;
using System.IO;
using Microsoft.Extensions.PlatformAbstractions;
using static TechsportiseOnline.Helpers.Swagger;
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.IdentityModel.Tokens;
using System.Text;

namespace TechsportiseOnline
{
    public class Startup
    {
        public Startup(IConfiguration configuration)
        {
            Configuration = configuration;
        }

        public IConfiguration Configuration { get; }

        // This method gets called by the runtime. Use this method to add services to the container.
        public void ConfigureServices(IServiceCollection services)
        {
            services.AddDbContext<ApplicationDbContext>(options =>
                options.UseSqlServer(Configuration.GetConnectionString("TechsportiseDB")));
                                                        //options.UseInMemoryDatabase("Teschsportise"));

            services.AddIdentity<ApplicationUser, IdentityRole>(config =>
                {
                    config.SignIn.RequireConfirmedEmail = true;
                })
                .AddEntityFrameworkStores<ApplicationDbContext>()
                .AddDefaultTokenProviders();

            services.Configure<IdentityOptions>(options =>
            {
                // Password settings
                options.Password.RequireDigit = true;
                options.Password.RequiredLength = 6;
                options.Password.RequireNonAlphanumeric = false;
                options.Password.RequireUppercase = false;
                options.Password.RequireLowercase = false;
                options.Password.RequiredUniqueChars = 2;

                // Lockout settings
                options.Lockout.DefaultLockoutTimeSpan = TimeSpan.FromMinutes(30);
                options.Lockout.MaxFailedAccessAttempts = 10;
                options.Lockout.AllowedForNewUsers = true;

                // User settings
                options.User.RequireUniqueEmail = true;
            });

            services.Configure<AuthMessageSenderOptions>(Configuration);

            services.ConfigureApplicationCookie(options =>
            {
                // Cookie settings
                options.Cookie.HttpOnly = true;
                options.Cookie.Expiration = TimeSpan.FromDays(150);
                options.LoginPath = "/Account/Login"; // If the LoginPath is not set here, ASP.NET Core will default to /Account/Login
                options.LogoutPath = "/Account/Logout"; // If the LogoutPath is not set here, ASP.NET Core will default to /Account/Logout
                options.AccessDeniedPath = "/Account/AccessDenied"; // If the AccessDeniedPath is not set here, ASP.NET Core will default to /Account/AccessDenied
                options.SlidingExpiration = true;
            });

            // Add application services.
            services.AddTransient<IEmailSender, Email>();
            //services.AddTransient<ICreateContact>();
            //services.AddTransient<IUpdateContact>();

            services.AddSwaggerGen(c =>
            {
                c.SwaggerDoc("v1", new Info { Title = "Techsportise API", Version = "v1" });
                c.OperationFilter<AddRequiredHeaderParameter>();
                var filePath = Path.Combine(PlatformServices.Default.Application.ApplicationBasePath, "Techsportise.xml");
                c.IncludeXmlComments(filePath);
            });

            services.Configure<JWTSettings>(Configuration.GetSection("JWTSettings"));


            services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
            .AddJwtBearer(options =>
            {
                options.RequireHttpsMetadata = false;
                options.IncludeErrorDetails = true;

                var secretKey = Configuration.GetSection("JWTSettings:SecretKey").Value;
                var signingKey = new SymmetricSecurityKey(Encoding.ASCII.GetBytes(secretKey));

                options.TokenValidationParameters = new TokenValidationParameters
                {

                    ValidateIssuer = true,
                    ValidIssuer = Configuration.GetSection("JWTSettings:Issuer").Value,
                    ValidateAudience = true,
                    ValidAudience = Configuration.GetSection("JWTSettings:Audience").Value,
                    ValidateIssuerSigningKey = true,
                    IssuerSigningKey = signingKey,

                };
            });

            services.AddMvc();

            var skipSSL = Configuration.GetValue<bool>("LocalTest:skipSSL");
            // requires using Microsoft.AspNetCore.Mvc;
            services.Configure<MvcOptions>(options =>
            {
                // Set LocalTest:skipSSL to true to skip SSL requrement in 
                // debug mode. This is useful when not using Visual Studio.
                if (!skipSSL)
                {
                    options.Filters.Add(new RequireHttpsAttribute());
                }
            });


            services.AddMvc(config =>
            {
                var policy = new AuthorizationPolicyBuilder()
                                 .RequireAuthenticatedUser()
                                 .Build();
                config.Filters.Add(new AuthorizeFilter(policy));
            });

            services.AddScoped<IAuthorizationHandler,
                      OwnerRaceAuthorizationHandler>();

            services.AddSingleton<IAuthorizationHandler,
                                  AdminRaceAuthorizationHandler>();

            services.AddScoped<IAuthorizationHandler,
                      OwnerRaceEntriesAuthorizationHandler>();

            services.AddSingleton<IAuthorizationHandler,
                                  AdminRaceEntriesAuthorizationHandler>();

        }

        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IHostingEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
                app.UseBrowserLink();
                app.UseDatabaseErrorPage();
            }
            else
            {
                app.UseExceptionHandler("/Home/Error");
            }

            app.UseStaticFiles();

            app.UseAuthentication();

            app.UseMvc(routes =>
            {
                routes.MapRoute(
                    name: "default",
                    template: "{controller=Home}/{action=Index}/{id?}");
            });

            // Enable middleware to serve generated Swagger as a JSON endpoint.
            app.UseSwagger();

            // Enable middleware to serve swagger-ui (HTML, JS, CSS etc.), specifying the Swagger JSON endpoint.
            app.UseSwaggerUI(c =>
            {
                c.SwaggerEndpoint("/swagger/v1/swagger.json", "Techsportise API V1");
            });


        }
    }
}

UPDATED startup.cs以反映评论中的更改 .

using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Identity;
using Microsoft.EntityFrameworkCore;
using Microsoft.AspNetCore.Hosting;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using TechsportiseOnline.Data;
using TechsportiseOnline.Models;
using TechsportiseOnline.Services;
using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc.Authorization;
using TechsportiseOnline.Authorization;
using TechsportiseOnline.Helpers;
using Swashbuckle.AspNetCore.Swagger;
using System.IO;
using Microsoft.Extensions.PlatformAbstractions;
using static TechsportiseOnline.Helpers.Swagger;
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.IdentityModel.Tokens;
using System.Text;

namespace TechsportiseOnline
{
    public class Startup
    {
        public Startup(IConfiguration configuration)
        {
            Configuration = configuration;
        }

        public IConfiguration Configuration { get; }

        // This method gets called by the runtime. Use this method to add services to the container.
        public void ConfigureServices(IServiceCollection services)
        {
            services.AddDbContext<ApplicationDbContext>(options =>
                options.UseSqlServer(Configuration.GetConnectionString("TechsportiseDB")));
                                                        //options.UseInMemoryDatabase("Teschsportise"));

            services.AddIdentity<ApplicationUser, IdentityRole>(config =>
                {
                    config.SignIn.RequireConfirmedEmail = true;
                })
                .AddEntityFrameworkStores<ApplicationDbContext>()
                .AddDefaultTokenProviders();

            services.Configure<IdentityOptions>(options =>
            {
                // Password settings
                options.Password.RequireDigit = true;
                options.Password.RequiredLength = 6;
                options.Password.RequireNonAlphanumeric = false;
                options.Password.RequireUppercase = false;
                options.Password.RequireLowercase = false;
                options.Password.RequiredUniqueChars = 2;

                // Lockout settings
                options.Lockout.DefaultLockoutTimeSpan = TimeSpan.FromMinutes(30);
                options.Lockout.MaxFailedAccessAttempts = 10;
                options.Lockout.AllowedForNewUsers = true;

                // User settings
                options.User.RequireUniqueEmail = true;
            });

            services.Configure<AuthMessageSenderOptions>(Configuration);

            //services.ConfigureApplicationCookie(options =>
            //{
            //    // Cookie settings
            //    options.Cookie.HttpOnly = true;
            //    options.Cookie.Expiration = TimeSpan.FromDays(150);
            //    options.LoginPath = "/Account/Login"; // If the LoginPath is not set here, ASP.NET Core will default to /Account/Login
            //    options.LogoutPath = "/Account/Logout"; // If the LogoutPath is not set here, ASP.NET Core will default to /Account/Logout
            //    options.AccessDeniedPath = "/Account/AccessDenied"; // If the AccessDeniedPath is not set here, ASP.NET Core will default to /Account/AccessDenied
            //    options.SlidingExpiration = true;
            //});

            // Add application services.
            services.AddTransient<IEmailSender, Email>();
            //services.AddTransient<ICreateContact>();
            //services.AddTransient<IUpdateContact>();

            services.AddSwaggerGen(c =>
            {
                c.SwaggerDoc("v1", new Info { Title = "Techsportise API", Version = "v1" });
                c.OperationFilter<AddRequiredHeaderParameter>();
                var filePath = Path.Combine(PlatformServices.Default.Application.ApplicationBasePath, "Techsportise.xml");
                c.IncludeXmlComments(filePath);
            });

            services.Configure<JWTSettings>(Configuration.GetSection("JWTSettings"));


            //services.AddAuthentication()
            //    .AddCookie()
            //    .AddJwtBearer(options =>
            //    {
            //        options.RequireHttpsMetadata = false;
            //        options.IncludeErrorDetails = true;

            //        var secretKey = Configuration.GetSection("JWTSettings:SecretKey").Value;
            //        var signingKey = new SymmetricSecurityKey(Encoding.ASCII.GetBytes(secretKey));

            //        options.TokenValidationParameters = new TokenValidationParameters
            //        {

            //            ValidateIssuer = true,
            //            ValidIssuer = Configuration.GetSection("JWTSettings:Issuer").Value,
            //            ValidateAudience = true,
            //            ValidAudience = Configuration.GetSection("JWTSettings:Audience").Value,
            //            ValidateIssuerSigningKey = true,
            //            IssuerSigningKey = signingKey,

            //        };
            //    });

            services.AddAuthentication()
                .AddCookie() 
                .AddJwtBearer(options =>
                {
                    options.Audience = "xyz";
                    options.Authority = "yzx";
                });

            services.AddMvc();

            var skipSSL = Configuration.GetValue<bool>("LocalTest:skipSSL");
            // requires using Microsoft.AspNetCore.Mvc;
            services.Configure<MvcOptions>(options =>
            {
                // Set LocalTest:skipSSL to true to skip SSL requrement in 
                // debug mode. This is useful when not using Visual Studio.
                if (!skipSSL)
                {
                    options.Filters.Add(new RequireHttpsAttribute());
                }
            });


            services.AddMvc(config =>
            {
                var policy = new AuthorizationPolicyBuilder()
                                 .RequireAuthenticatedUser()
                                 .Build();
                config.Filters.Add(new AuthorizeFilter(policy));
            });

            services.AddScoped<IAuthorizationHandler,
                      OwnerRaceAuthorizationHandler>();

            services.AddSingleton<IAuthorizationHandler,
                                  AdminRaceAuthorizationHandler>();

            services.AddScoped<IAuthorizationHandler,
                      OwnerRaceEntriesAuthorizationHandler>();

            services.AddSingleton<IAuthorizationHandler,
                                  AdminRaceEntriesAuthorizationHandler>();

        }

        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IHostingEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
                app.UseBrowserLink();
                app.UseDatabaseErrorPage();
            }
            else
            {
                app.UseExceptionHandler("/Home/Error");
            }

            app.UseStaticFiles();


            app.UseAuthentication();

            app.UseMvc(routes =>
            {
                routes.MapRoute(
                    name: "default",
                    template: "{controller=Home}/{action=Index}/{id?}");
            });

            // Enable middleware to serve generated Swagger as a JSON endpoint.
            app.UseSwagger();

            // Enable middleware to serve swagger-ui (HTML, JS, CSS etc.), specifying the Swagger JSON endpoint.
            app.UseSwaggerUI(c =>
            {
                c.SwaggerEndpoint("/swagger/v1/swagger.json", "Techsportise API V1");
            });


        }
    }
}

添加了全新的 TestController ，复制您的代码 .

using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;

namespace TechsportiseOnline.Controllers
{
    public class TestController : Controller
    {
        [Authorize(AuthenticationSchemes = JwtBearerDefaults.AuthenticationScheme)] //Based on Scheme it will auth, for cookie mention [Authorize(AuthenticationSchemes = CookieAuthenticationDefaults.AuthenticationScheme)]
        [Route("api/[controller]")]
        public IActionResult About()
        {
            ViewData["Message"] = "Your application description page.";
            return View();
        }
    }
}
c# asp.net-mvc asp.net-core asp.net-core-webapi asp.net-core-2.0

2 回答

  • 0

    你的意思是，没有登录，有效令牌的请求应该通过？您可以通过在 ConfigureServices() 级别删除cookie身份验证方案或JWTbearer方案来实现此目的 .

    services.AddAuthentication(   // no Authenticationschemes mentioned here  )
                .AddCookie() //CookieAuthentication
                .AddJwtBearer(options =>
                {
                    options.Audience = "xyz";
                    options.Authority = "yzx";
                });

    如果你有有效的令牌然后没有登录，你可以点击任何mvc控制器或web api控制器，而无需重定向到任何登录页面 . 喜欢;

    [Authorize(AuthenticationSchemes = JwtBearerDefaults.AuthenticationScheme)] //Based on Scheme it will auth, for cookie mention [Authorize(AuthenticationSchemes = CookieAuthenticationDefaults.AuthenticationScheme)]
        public IActionResult About()
        {
            ViewData["Message"] = "Your application description page.";
            return View();
        }
    回复于
  • 0

    我发现了这个问题 . 当与应用程序的空白版本进行比较时，我发现了这个AuthorizationBuilder .

    services.AddMvc(config =>
    {
        var policy = new AuthorizationPolicyBuilder()
                         .RequireAuthenticatedUser()
                         .Build();
        config.Filters.Add(new AuthorizeFilter(policy));
    });

    我添加了这个，而我在我的应用程序中添加了不同的角色 . 取消这个问题可以解决问题，但似乎仍然只能将我的应用程序限制为授权用户 .

    回复于

相关问题