webapi框架搭建-安全机制（二）-身份验证
webapi框架搭建系列博客
身份验证（authentication）的责任是识别出http请求者的身份，除此之外尽量不要管其它的事。webapi的authentication我用authentication filter技术去解决。
参考资料：
https://docs.microsoft.com/en-us/aspnet/web-api/overview/security/authentication-filters
步骤如下
创建authentication filter
在项目里新建文件夹Security，并在此文件夹里创建IdentityBasicAuthentication类，代码如下
using System;
using System.Threading;
using System.Threading.Tasks;
using System.Web.Http.Filters;
namespace webapi.Security
{
public class IdentityBasicAuthentication:IAuthenticationFilter
{
public bool AllowMultiple { get; }
public Task AuthenticateAsync(HttpAuthenticationContext context, CancellationToken cancellationToken)
{
throw new NotImplementedException();
}
public Task ChallengeAsync(HttpAuthenticationChallengeContext context, CancellationToken cancellationToken)
{
throw new NotImplementedException();
}
}
}
继承自IauthenticationFilter，实现自己的业务代码（后面再实现）
注册authentication filter
在webapi的config里加入filter，修改项目代码如下
/// <summary>
/// 返回webapi的httpconfiguration配置
/// 用于webapi应用于owin技术时使用
/// </summary>
/// <returns></returns>
public static HttpConfiguration OwinWebApiConfiguration(HttpConfiguration config)
{
config.MapHttpAttributeRoutes();//开启属性路由
config.Routes.MapHttpRoute(
name: "DefaultApi",
routeTemplate: "api/{controller}/{id}",
defaults: new { id = RouteParameter.Optional }
);
config.Filters.Add(new WebApiExceptionFilterAttribute());
config.Filters.Add(new IdentityBasicAuthentication());
return config;
}
即上一句：config.Filters.Add(new IdentityBasicAuthentication());
现在webapi的authentication机制的结构已经完成，剩下要做的就是在结构里填其它的代码了。
加入JWT机制
其实jwt的代码我们要写的很少，不要自己去实现jwt规范，可以用已经有的jwt的.net包。
在nuget里添加jwt.net包
修改authentication filter代码，加入jwt逻辑
using System.Linq;
using System.Net;
using System.Net.Http;
using System.Security.Claims;
using System.Threading;
using System.Threading.Tasks;
using System.Web.Http.Filters;
using System.Web.Http.Results;
using webapi.Common;
using webapi.Configs;
namespace webapi.Security
{
public class IdentityBasicAuthentication:IAuthenticationFilter
{
public bool AllowMultiple { get; }
/// <summary>
/// 请求先经过AuthenticateAsync
/// </summary>
/// <param name="context"></param>
/// <param name="cancellationToken"></param>
/// <returns></returns>
public Task AuthenticateAsync(HttpAuthenticationContext context, CancellationToken cancellationToken)
{
// 1、获取token
context.Request.Headers.TryGetValues("token", out var tokenHeaders);
// 2、如果没有token，不做任何处理
if (tokenHeaders == null || !tokenHeaders.Any())
{
return Task.FromResult(0);
}
// 3、如果token验证通过，则写入到identity，如果未通过则设置错误
var jwtHelper=new JWTHelper();
var payLoadClaims=jwtHelper.DecodeToObject(tokenHeaders.FirstOrDefault(),Config.JWTKey, out bool isValid, out string errMsg);
if (isValid)
{
var identity = new ClaimsIdentity("jwt", "userId", "roles");//只要ClaimsIdentity设置了authenticationType，authenticated就为true，后面的authority根据authenticated=true来做权限
foreach (var keyValuePair in payLoadClaims)
{
identity.AddClaim(new Claim(keyValuePair.Key, keyValuePair.Value.ToString()));
}
// 最好是http上下文的principal和进程的currentPrincipal都设置
context.Principal = new ClaimsPrincipal(identity);
Thread.CurrentPrincipal = new ClaimsPrincipal(identity);
}
else
{
context.ErrorResult = new ResponseMessageResult(new HttpResponseMessage()
{
StatusCode = HttpStatusCode.ProxyAuthenticationRequired,
Content = new StringContent(errMsg)
});
}
return Task.FromResult(0);
}
/// <summary>
/// 请求后经过AuthenticateAsync
/// </summary>
/// <param name="context"></param>
/// <param name="cancellationToken"></param>
/// <returns></returns>
public Task ChallengeAsync(HttpAuthenticationChallengeContext context, CancellationToken cancellationToken)
{
return Task.FromResult(0);
}
}
}
附上JWTHelper.cs代码
JWT.net的用法参考：https://github.com/jwt-dotnet/jwt
using JWT;
using JWT.Algorithms;
using JWT.Serializers;
using System;
using System.Collections.Generic;
namespace webapi.Common
{
public class JWTHelper
{
private IJsonSerializer _jsonSerializer;
private IDateTimeProvider _dateTimeProvider;
private IJwtValidator _jwtValidator;
private IBase64UrlEncoder _base64UrlEncoder;
private IJwtAlgorithm _jwtAlgorithm;
private IJwtDecoder _jwtDecoder;
private IJwtEncoder _jwtEncoder;
public JWTHelper()
{
//非fluent写法
this._jsonSerializer = new JsonNetSerializer();
this._dateTimeProvider = new UtcDateTimeProvider();
this._jwtValidator = new JwtValidator(_jsonSerializer, _dateTimeProvider);
this._base64UrlEncoder = new JwtBase64UrlEncoder();
this._jwtAlgorithm = new HMACSHA256Algorithm();
this._jwtDecoder = new JwtDecoder(_jsonSerializer, _jwtValidator, _base64UrlEncoder);
this._jwtEncoder = new JwtEncoder(_jwtAlgorithm, _jsonSerializer, _base64UrlEncoder);
}
public string Decode(string token, string key, out bool isValid, out string errMsg)
{
isValid = false;
var result = string.Empty;
try
{
result = _jwtDecoder.Decode(token, key, true);
isValid = true;
errMsg = "正确的token";
return result;
}
catch (TokenExpiredException)
{
errMsg = "token过期";
return result;
}
catch (SignatureVerificationException)
{
errMsg = "签名无效";
return result;
}
catch (Exception)
{
errMsg = "token无效";
return result;
}
}
public T DecodeToObject<T>(string token, string key, out bool isValid, out string errMsg)
{
isValid = false;
try
{
var result = _jwtDecoder.DecodeToObject<T>(token, key, true);
isValid = true;
errMsg = "正确的token";
return result;
}
catch (TokenExpiredException)
{
errMsg = "token过期";
return default(T);
}
catch (SignatureVerificationException)
{
errMsg = "签名无效";
return default(T);
}
catch (Exception)
{
errMsg = "token无效";
return default(T);
}
}
public IDictionary<string, object> DecodeToObject(string token, string key, out bool isValid, out string errMsg)
{
isValid = false;
try
{
var result = _jwtDecoder.DecodeToObject(token, key, true);
isValid = true;
errMsg = "正确的token";
return result;
}
catch (TokenExpiredException)
{
errMsg = "token过期";
return null;
}
catch (SignatureVerificationException)
{
errMsg = "签名无效";
return null;
}
catch (Exception)
{
errMsg = "token无效";
return null;
}
}
#region 解密
public string Encode(Dictionary<string, object> payload, string key, int expiredMinute = 30)
{
if (!payload.ContainsKey("exp"))
{
var exp = Math.Round((_dateTimeProvider.GetNow().AddMinutes(expiredMinute) - new DateTime(1970, 1, 1)).TotalSeconds);
payload.Add("exp", exp);
}
return _jwtEncoder.Encode(payload, key);
}
#endregion
}
}
测试结果
创建SecurityTestController.cs控制器
using System;
using System.Collections.Generic;
using System.Linq;
using System.Net;
using System.Net.Http;
using System.Security.Claims;
using System.Web.Http;
using webapi.Common;
namespace webapi.example
{
[RoutePrefix("api/security")]
public class SecurityTestController : ApiController
{
/// <summary>
/// 通过get请求里传过来的值生成token
/// </summary>
/// <returns></returns>
[Route("token"),HttpGet]
public IHttpActionResult GetToken()
{
var dic=new Dictionary<string,object>();
foreach (var queryNameValuePair in Request.GetQueryNameValuePairs())
{
dic.Add(queryNameValuePair.Key,queryNameValuePair.Value);
}
var token=new JWTHelper().Encode(dic, "shengyu",30);
return Ok(token);
}
/// <summary>
/// 返回token里加密的信息
/// </summary>
/// <returns></returns>
[Route("GetUserInfoFromToken"),HttpGet]
public IHttpActionResult GetUser()
{
var user = (ClaimsPrincipal)User;
var dic=new Dictionary<string,object>();
foreach (var userClaim in user.Claims)
{
dic.Add(userClaim.Type,userClaim.Value);
}
return Ok(dic);
}
}
}
获取一个测试token
现在将上面生成的token以附加到http request的head里，通过authentication机制，测试身份验证是否正常，结果如下
