我想在SignalR中启用身份验证,而服务器托管在ASP.NET WebAPI中,我正在使用OAuth Bearer autrntication,客户端是AngularJS .
在客户端,我最初通过HTTP标头传递Bearer令牌,它适用于WebAPI . 但由于SignalR JavsScript不支持在 connection
中添加HTTP头(它支持指定HTTP头),我需要使用像 self.connection.qs = { Bearer: 'xxxxxx' };
这样的代码通过查询字符串传递Bearer令牌 .
问题出在WebAPI方面,我的SignalR总是返回401 Unauthorized .
以下是我在WebAPI方面所做的工作 .
1,我指定 OAuthBearerAuthenticationOptions.Provider
到 QueryStringEnabledOAuthBearerAuthenticationProvider
,这是我从 OAuthBearerAuthenticationProvider
继承的一个类,可以从查询字符串中检索Bearer令牌 . 代码如下 .
public class QueryStringEnabledOAuthBearerAuthenticationProvider : OAuthBearerAuthenticationProvider
{
private readonly string _name;
public QueryStringEnabledOAuthBearerAuthenticationProvider()
: this(OAuthDefaults.AuthenticationType)
{
}
public QueryStringEnabledOAuthBearerAuthenticationProvider(string name)
{
_name = name;
}
public override Task RequestToken(OAuthRequestTokenContext context)
{
// try to read token from base class (header) if possible
base.RequestToken(context).Wait();
if (string.IsNullOrWhiteSpace(context.Token))
{
// try to read token from query string
var token = context.Request.Query.Get(_name);
if (!string.IsNullOrWhiteSpace(token))
{
context.Token = token;
}
}
return Task.FromResult(null);
}
}
并在WebAPI启动时将其注册如下 .
var options = new OAuthBearerAuthenticationOptions
{
AuthenticationMode = AuthenticationMode.Active,
AuthenticationType = AuthenticationType,
Provider = new QueryStringEnabledOAuthBearerAuthenticationProvider(),
AccessTokenFormat = _accessTokenFormat,
};
config.SuppressDefaultHostAuthentication();
config.Filters.Add(new HostAuthenticationFilter(OAuthDefaults.AuthenticationType));
app.UseOAuthBearerAuthentication(options);
2,在SignalR部分,我创建了一个authorize属性,如下所示 . 没有任何改变只是用于添加断点 .
public class BearerAuthorizeAttribute : AuthorizeAttribute
{
public override bool AuthorizeHubConnection(HubDescriptor hubDescriptor, IRequest request)
{
return base.AuthorizeHubConnection(hubDescriptor, request);
}
public override bool AuthorizeHubMethodInvocation(IHubIncomingInvokerContext hubIncomingInvokerContext, bool appliesToMethod)
{
return base.AuthorizeHubMethodInvocation(hubIncomingInvokerContext, appliesToMethod);
}
}
并在WebAPI启动时注册它 .
app.Map("/signalr", map =>
{
// Setup the CORS middleware to run before SignalR.
// By default this will allow all origins. You can
// configure the set of origins and/or http verbs by
// providing a cors options with a different policy.
map.UseCors(CorsOptions.AllowAll);
var hubConfiguration = new HubConfiguration
{
// You can enable JSONP by uncommenting line below.
// JSONP requests are insecure but some older browsers (and some
// versions of IE) require JSONP to work cross domain
// EnableJSONP = true
EnableJavaScriptProxies = false
};
// Run the SignalR pipeline. We're not using MapSignalR
// since this branch already runs under the "/signalr"
// path.
map.RunSignalR(hubConfiguration);
// Require authentication for all hubs
var authorizer = new BearerAuthorizeAttribute();
var module = new AuthorizeModule(authorizer, authorizer);
GlobalHost.HubPipeline.AddModule(module);
});
我发现,当SignalR连接时,我的 QueryStringEnabledOAuthBearerAuthenticationProvider.RequestToken
被调用并且它成功检索了Bearer令牌 . 但是当调用SignalR BearerAuthorizeAttribute.AuthorizeHubConnection
时,参数 request.User
仍未经过身份验证 . 所以它返回401 .
谁能给我一些关于我做错了什么的想法,谢谢 .
2 回答
我正在使用 Headers ,这就是我解决它的方式
希望能帮助到你
我通过从AuthorizeAttribute中的查询字符串取消保护Bearer令牌来解决此问题,并将用户主体设置为新的ServerRequest . 有关详细信息,请查看http://blog.shaunxu.me/archive/2014/05/27/set-context-user-principal-for-customized-authentication-in-signalr.aspx
这可能不是最好的解决方案,但它有效 .