关于 hangfire 的权限问题

hangfire 是一个分布式后台执行服务。

官网：http://hangfire.io/

 

我看中hangfire的地方是

1：使用简单

2：多种持久化保存方案。支持sqlserver ，msmq等 ，其他的redis 等持久化方案要收费。不过自己扩展不是难事。hangfire基于net3.5的extension扩展。

3：有监控系统，并且可以和其他监控系统集成。 

 

回顾正题：

hangfire在部署到iis环境上，通过地址访问的时候会出现401未授权错误。通过代码分析是由于hangfire内建授权机制造成的问题。

在分析源码前，建议先对owin做个了解：

http://www.cnblogs.com/dudu/p/what-is-owin.html

http://owin.org/

hangfire继承了OwinMiddleware，在每次请求的时候会去执行IAuthorizationFilter的实现。

   internal class DashboardMiddleware : OwinMiddleware
    {
        private readonly JobStorage _storage;
        private readonly RouteCollection _routes;
        private readonly IEnumerable<IAuthorizationFilter> _authorizationFilters;

     
        public override Task Invoke(IOwinContext context)
        {
            var dispatcher = _routes.FindDispatcher(context.Request.Path.Value);
            
            if (dispatcher == null)
            {
                return Next.Invoke(context);
            }
             
            foreach (var filter in _authorizationFilters)
            {
                if (!filter.Authorize(context.Environment))
                {
                    context.Response.StatusCode = (int) HttpStatusCode.Unauthorized;
                    return Task.FromResult(false);
                }
            }

            var dispatcherContext = new RequestDispatcherContext(
                _storage,
                context.Environment,
                dispatcher.Item2);

            return dispatcher.Item1.Dispatch(dispatcherContext);
        }
    }

 

hangfire默认加载了 LocalRequestsOnlyAuthorizationFilter 

    public class LocalRequestsOnlyAuthorizationFilter : IAuthorizationFilter
    {
        public bool Authorize(IDictionary<string, object> owinEnvironment)
        {
            var context = new OwinContext(owinEnvironment);
            var remoteAddress = context.Request.RemoteIpAddress;

            // if unknown, assume not local
            if (String.IsNullOrEmpty(remoteAddress))
                return false;

            // check if localhost
            if (remoteAddress == "127.0.0.1" || remoteAddress == "::1")
                return true;

            // compare with local address
            if (remoteAddress == context.Request.LocalIpAddress)
                return true;

            return false;
        }
    }

可以看出来对remoteaddress做了限制。

 

如果不考虑安全的场合，可以采用以下做法：

    public class Startup
    {
        public void Configuration(IAppBuilder app)
        {
            app.UseHangfire(config =>
            {
                config.UseAuthorizationFilters(new DontUseThisAuthorizationFilter());

                config
                    .UseSqlServerStorage(@"server=xxxxx;database=Hangfire;uid=sa;pwd=123.com")
                    .UseMsmqQueues(@".\Private$\hangfire{0}", "default", "critical");
            });

             app.MapHangfireDashboard();
        }
    }

 

    public class DontUseThisAuthorizationFilter : IAuthorizationFilter
    {
        public bool Authorize(IDictionary<string, object> owinEnvironment)
        {
            return true;
        }
    }

 

 

如果需要结合现有系统权限机制的场合，也是实现IAuthorizationFilter：

 GlobalContext.Current.UserInfo是我们系统内部的一个上下文class。

    public class CustomAuthorizationFilter : IAuthorizationFilter
    {
        public bool Authorize(IDictionary<string, object> owinEnvironment)
        {
            var context = new OwinContext(owinEnvironment);
            if ( GlobalContext.Current.UserInfo==null){
                string urls = "/Index/Login?url=" + context.Request.Uri.Host;
                context.Response.Redirect(urls);
                return false;  
            }
            return true; 
        }
    }