研究嵌入式设备访问Asp.Net Core Web Api的简单认证方式

研究嵌入式设备访问Asp.Net Core Web Api的简单认证方式

Asp.Net Core可以采用JWT保护Web Api，但是有的嵌入式设备硬件性能比较低，缺乏交互界面，无法使用JWT这么复杂的方案。根据嵌入式设备的约束条件，可以采用一些简单的网络安全保护措施：

1，采用https传输；

2，在header自定义认证参数；

3，设备端定期更换秘钥，加密存储；

 

服务端可以采用中间件、自定义认证、筛选器等方式对Web Api进行保护。

创建项目

VS2022创建Asp.Net Core Web Api服务端项目DeviceAuth和控制台项目DevClient。

DeviceAuth服务端定义一个简单的控制器，上传WeatherForecast。

创建设备认证服务类DevAuthService，从HttpRequest获取认证头，解码得到设备端认证参数，并跟服务端认证参数比较。如果相等则认证成功，否则失败。

D:\Software\gitee\DeviceAuth\DeviceAuth\DevAuthService.cs

 

/// <summary>
/// 设备认证服务
/// </summary>
public class DevAuthService
{
    private readonly IConfiguration _configuration;
    private readonly ILogger<DevAuthService> _logger;

    public DevAuthService(IConfiguration configuration, ILogger<DevAuthService> logger)
    {
        _configuration = configuration;
        _logger = logger;
    }

    /// <summary>
    /// 处理设备认证
    /// </summary>
    /// <param name="request"></param>
    /// <returns></returns>
    public bool HandleDevAuth(HttpRequest request)
    {
        //获取设备认证头
        var devAuthHeader = request.Headers.Authorization.FirstOrDefault(x => !string.IsNullOrWhiteSpace(x) && x.StartsWith("DevAuth"));
        if (string.IsNullOrWhiteSpace(devAuthHeader))
        {
            _logger.LogWarning("找不到设备认证头");
            return false;
        }

        //获取设备认证参数base64，实际项目中应该用加密取代base64
        var devAuthHeaderValue = AuthenticationHeaderValue.Parse(devAuthHeader!);

        var paramBase64 = devAuthHeaderValue?.Parameter;
        if (string.IsNullOrWhiteSpace(paramBase64))
        {
            _logger.LogWarning("设备认证参数为空");
            return false;
        }

        //获取设备认证参数
        byte[] paramAry = Convert.FromBase64String(paramBase64!);
        var devSecretKey = Encoding.ASCII.GetString(paramAry);
        var serverSecretKey = _configuration["DevAuth:SecretKey"];

        if (devSecretKey == serverSecretKey)
        {
            _logger.LogInformation("设备认证成功");
            return true;
        }
        else
        {
            _logger.LogWarning("设备认证参数错误");
            return false;
        }
    }
}

 

DevClient设备端通过HttpClient上传数据，添加设备认证头。

D:\Software\gitee\DeviceAuth\DevClient\Program.cs

    /// <summary>
    /// 上传数据
    /// </summary>
    /// <param name="isWithDevAuthHeader">是否携带设备认证头</param>
    /// <returns></returns>
    private static async Task<bool> UploadData(bool isWithDevAuthHeader = true)
    {
        try
        {
            HttpClient client = new HttpClient
            {
                BaseAddress = new Uri("https://localhost:7259")
            };

            var forecast = new WeatherForecast()
            {
                Date = DateTimeOffset.Now,
                TemperatureC = System.Random.Shared.Next(0, 30),
                Summary = "多云"
            };
            JsonContent jsonContent = JsonContent.Create(forecast);

            if (isWithDevAuthHeader)
            {
                //添加设备认证头
                string authBase64 = Convert.ToBase64String(Encoding.ASCII.GetBytes("secret"));
                client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(DevAuthConst.DevAuth, authBase64);
            }

            for (int i = 1; i <= 3; i++)
            {
                string requestUri = $"/WeatherForecast/Add{i}";

                var response = await client.PostAsync(requestUri, jsonContent);

                response.EnsureSuccessStatusCode();

                string responseStr = await response.Content.ReadAsStringAsync();

                Console.WriteLine($"{requestUri}上传数据成功, {responseStr}");
            }

            return true;
        }
        catch (Exception ex)
        {
            Console.WriteLine($"上传数据失败, {ex}");

            return false;
        }
    }

中间件方案

创建DevAuthMiddleware设备认证中间件，从HttpContext获取端点属性，如果标记了DevAuthAttribute属性，就调用DevAuthService服务进行设备认证。

D:\Software\gitee\DeviceAuth\DeviceAuth\DevAuthMiddleware.cs

 

/// <summary>
/// 设备认证中间件
/// </summary>
public class DevAuthMiddleware
{
    //将服务注入中间件的 Invoke 或 InvokeAsync 方法。 使用构造函数注入会引发运行时异常
    //private readonly DevAuthService _devAuthService;
    private readonly RequestDelegate _next;
    private readonly ILogger<DevAuthMiddleware> _logger;

    public DevAuthMiddleware(RequestDelegate next,
        //DevAuthService devAuthService,
        ILogger<DevAuthMiddleware> logger)
    {
        _next = next;
        //_devAuthService = devAuthService;
        _logger = logger;
    }

    public async Task InvokeAsync(HttpContext context, DevAuthService devAuthService)
    {
        bool isAuthSuccess = false;

        try
        {
            //如果端点标记了DevAuthAttribute属性，需要做设备认证
            var devAuthAttr = context.GetEndpoint()?.Metadata?.GetMetadata<DevAuthAttribute>();
            if (devAuthAttr is not null)
                isAuthSuccess = devAuthService.HandleDevAuth(context.Request);
            else
                isAuthSuccess = true;
        }
        catch (Exception ex)
        {
            _logger.LogWarning(ex, "设备认证错误");
            isAuthSuccess = false;
        }

        if (isAuthSuccess)
        {
            //继续请求管道
            await _next(context);
        }
        else
        {
            _logger.LogWarning($"{context.Request.Path}, 设备认证失败");
            context.Response.StatusCode = (int)HttpStatusCode.Unauthorized;
        }
    }

}

public static class DevAuthMiddlewareExtensions
{
    public static IApplicationBuilder UseDevAuth(this IApplicationBuilder app)
    {
        ///使用设备认证中间件
        return app.UseMiddleware<DevAuthMiddleware>();
    }
}

 

定义一个简单的DevAuthAttribute属性。

D:\Software\gitee\DeviceAuth\DeviceAuth\DevAuthAttribute.cs

D:\Software\gitee\DeviceAuth\DeviceAuth\DevAuthAttribute.cs
/// <summary>
/// 需要设备认证
/// </summary>
[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
public class DevAuthAttribute : Attribute
{
}

 

在控制器函数上面标记DevAuthAttribute属性，表明需要做设备认证。

D:\Software\gitee\DeviceAuth\DeviceAuth\Controllers\WeatherForecastController.cs
        /// <summary>
        /// 采用中间件对标记了DevAuth属性的端点进行认证
        /// </summary>
        /// <param name="weatherForecast"></param>
        /// <returns></returns>
        [DevAuth]
        [HttpPost("Add1")]
        public int Add1(WeatherForecast weatherForecast)
        {
            _logger.LogInformation($"{DateTimeOffset.Now}: Add1收到数据{weatherForecast}");

            return 1;
        }

Program使用中间件app.UseDevAuth()。

 

自定义认证方案

创建DevAuthorizationHandler自定义设备认证处理器，获取Request的认证头，如果认证通过，创建一个AuthenticationTicket身份标识，包含设备角色Claim(ClaimTypes.Role, DevAuthConst.DevRole)。

D:\Software\gitee\DeviceAuth\DeviceAuth\DevAuthorizationHandler.cs

 

/// <summary>
/// 自定义设备认证处理器
/// </summary>
public class DevAuthorizationHandler : AuthenticationHandler<AuthenticationSchemeOptions>
{
    public const string DevAuthSchemeName = "DevAuthScheme";
    public const string DevAuthPolicyName = "DevAuthPolicy";

    private readonly IServiceScopeFactory _serviceScopeFactory;
    private readonly DevAuthService _devAuthService;
    private readonly ILogger<DevAuthorizationHandler> _logger;

    public DevAuthorizationHandler(IOptionsMonitor<AuthenticationSchemeOptions> options, ILoggerFactory loggerFactory, UrlEncoder encoder, ISystemClock clock, IServiceScopeFactory serviceScopeFactory, DevAuthService devAuthService) : base(options, loggerFactory, encoder, clock)
    {
        _serviceScopeFactory = serviceScopeFactory;
        _devAuthService = devAuthService;
        _logger = loggerFactory.CreateLogger<DevAuthorizationHandler>();
    }

    protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
    {
        await Task.CompletedTask;

        bool isAuthSuccess = false;

        try
        {
            //处理设备认证
            isAuthSuccess = _devAuthService.HandleDevAuth(Request);
        }
        catch (Exception ex)
        {
            _logger.LogWarning(ex, "设备认证错误");
            isAuthSuccess = false;
        }

        if (isAuthSuccess)
        {
            var claims = new List<Claim>() { new Claim(ClaimTypes.Role, DevAuthConst.DevRole) };
            var identities = new List<ClaimsIdentity>() { new ClaimsIdentity(claims, Scheme.Name) };
            var principal = new ClaimsPrincipal(identities);
            var ticket = new AuthenticationTicket(principal, Scheme.Name);

            return AuthenticateResult.Success(ticket);
        }
        else
        {
            _logger.LogWarning($"{Request.Path}, 设备认证失败");
            return AuthenticateResult.Fail("设备认证失败");
        }
    }
}

 

在program注册自定义认证方案。

D:\Software\gitee\DeviceAuth\DeviceAuth\Program.cs

 

            builder.Services.TryAddScoped<DevAuthorizationHandler>();

            builder.Services.AddAuthentication(DevAuthorizationHandler.DevAuthSchemeName)
            //builder.Services.AddAuthentication(options =>
            //{
            //    options.DefaultAuthenticateScheme = DevAuthorizationHandler.DevAuthSchemeName;
            //    options.DefaultChallengeScheme = null;
            //})
                .AddScheme<AuthenticationSchemeOptions, DevAuthorizationHandler>(DevAuthorizationHandler.DevAuthSchemeName, null);

            app.UseAuthentication();
            app.UseAuthorization();

 

在控制器函数上面标记Authorize(Roles = DevAuthConst.DevRole)，表明需要设备角色的身份标记的认证。

D:\Software\gitee\DeviceAuth\DeviceAuth\Controllers\WeatherForecastController.cs

        /// <summary>
        /// 采用DevAuthorizationHandler自定义认证方案
        /// </summary>
        /// <param name="weatherForecast"></param>
        /// <returns></returns>
        [Authorize(Roles = DevAuthConst.DevRole)]
        //[Authorize(DevAuthorizationHandler.DevAuthPolicyName)]
        [HttpPost("Add2")]
        public int Add2(WeatherForecast weatherForecast)
        {
            _logger.LogInformation($"{DateTimeOffset.Now}: Add2收到数据{weatherForecast}");

            return 1;
        }

筛选器方案

创建DevAuthorizeFilter设备认证筛选器，检查HttpContext.Request的认证头。

D:\Software\gitee\DeviceAuth\DeviceAuth\DevAuthorizeFilter.cs

 

/// <summary>
/// 设备认证筛选器
/// </summary>
public class DevAuthorizeFilter : IAsyncAuthorizationFilter
{
    private readonly DevAuthService _devAuthService;
    private readonly ILogger<DevAuthorizeFilter> _logger;

    public DevAuthorizeFilter(DevAuthService devAuthService, ILogger<DevAuthorizeFilter> logger)
    {
        _devAuthService = devAuthService;
        _logger = logger;
    }

    public async Task OnAuthorizationAsync(AuthorizationFilterContext context)
    {
        await Task.CompletedTask;

        bool isAuthSuccess = false;

        try
        {
            //处理设备认证
            isAuthSuccess = _devAuthService.HandleDevAuth(context.HttpContext.Request);
        }
        catch (Exception ex)
        {
            _logger.LogWarning(ex, "设备认证错误");
            isAuthSuccess = false;
        }

        if (isAuthSuccess)
        {
        }
        else
        {
            _logger.LogWarning($"{context.HttpContext.Request.Path}, 设备认证失败");
            context.Result = new UnauthorizedResult();
        }
    }
}

 

在控制器函数上面标记ServiceFilter<DevAuthorizeFilter>筛选器，表明需要设备认证。

D:\Software\gitee\DeviceAuth\DeviceAuth\Controllers\WeatherForecastController.cs

        /// <summary>
        /// 采用DevAuthorizeFilter筛选器方案
        /// </summary>
        /// <param name="weatherForecast"></param>
        /// <returns></returns>
        [ServiceFilter<DevAuthorizeFilter>]
        [HttpPost("Add3")]
        public int Add3(WeatherForecast weatherForecast)
        {
            _logger.LogInformation($"{DateTimeOffset.Now}: Add3收到数据{weatherForecast}");

            return 1;
        }
    }

总结

测试3种认证方案都可以。中间件，自定义认证，筛选器都可以实现设备认证的目标。

中间件需要获取每次访问的端点，感觉比较麻烦。

自定义认证代码比较复杂。

推荐采用筛选器，代码简单。

 

DEMO代码地址：https://gitee.com/woodsun/deviceauth