.net core 认证

认证、登录与注销

认证是一个旨在确定请求访问者真实身份的过程，与认证相关的还有其他两个基本操作——登录和注销。要真正理解认证、登录和注销这 3个核心操作的本质，就需要对 ASP.NET Core采用的基于“票据”的认证机制有基本的了解。

认证票据

ASP.NET Core应用的认证实现在一个名为AuthenticationMiddleware的中间件中，该中间件在处理分发给它的请求时会按照指定的认证方案（Authentication Scheme）从请求中提取能够验证用户真实身份的数据，我们一般将该数据称为安全令牌（Security Token）。ASP.NET Core 应用下的安全令牌被称为认证票据（Authentication Ticket），所以 ASP.NET Core 应用采用基于票据的认证方式。

3种针对认证票据的操作，即认证票据的颁发、检验和撤销。我们将这 3 个操作所涉及的 3 种角色称为票据颁发者（Ticket Issuer）、验证者（Authenticator）和撤销者（Ticket Revoker），在大部分场景下这 3种角色由同一个主体来扮演。

颁发认证票据的过程就是登录（Sign In）操作。一般来说，用户试图通过登录应用以获取认证票据的时候需要提供可用来证明自身身份的用户凭证（User Credential），最常见的用户凭证类型是“用户名+密码”。认证方在确定对方真实身份之后，会颁发一个认证票据，该票据携带着与该用户有关的身份、权限及其他相关的信息。
一旦拥有了由认证方颁发的认证票据，我们就可以按照双方协商的方式（如通过 Cookie或者报头）在请求中携带该认证票据，并以此票据声明的身份执行目标操作或者访问目标资源。认证票据一般都具有时效性，一旦过期将变得无效。我们有的时候甚至希望在过期之前就让认证票据无效，以免别人使用它冒用自己的身份与应用进行交互，这就是注销（Sign Out）操作。
ASP.NET Core 的认证系统旨在构建一个标准的模型，用来完成针对请求的认证以及与之相关的登录和注销操作。

 

如下面的代码片段所示，我们调用IApplicationBuilder接口的UseAuthentication扩展方法就是为了注册用来实现认证的 AuthenticationMiddleware 中间件。该中间件的依赖服务是通过调用IServiceCollection 接口的 AddAuthentication 扩展方法注册的。在注册这些基础服务时，我们还设置了默认采用的认证方案，静态类型 CookieAuthenticationDefaults的 AuthenticationScheme属性返回的就是Cookie认证方案的默认方案名称。

ASP.NET Core 提供了一个极具扩展性的认证模型，我们可以利用它支持多种认证方案，对认证方案的注册是通过AddAuthentication方法返回的一个AuthenticationBuilder对象来实现的。在上面提供的代码片段中，我们调用AuthenticationBuilder对象的AddCookie扩展方法完成了针对Cookie认证方案的注册。演示实例的主页是通过如下所示的 RenderHomePageAsync 方法来呈现的。由于我们要求浏览主页必须是经过认证的用户，所以该方法会利用 HttpContext 上下文的 User 属性返回的ClaimsPrincipal对象判断当前请求是否经过认证。对于经过认证的请求，我们会响应一个简单的HTML文档，并在其中显示用户名和一个注销链接。

对于匿名请求，我们希望应用能够自动重定向到登录路径。从如上所示的代码片段可以看出，我们仅仅调用当前HttpContext上下文的ChallengeAsync扩展方法就完成了针对登录路径的重定向。前面提及，注册的登录和注销路径是基于 Cookie的认证方案采用的默认路径，所以调用 ChallengeAsync方法时根本不需要指定重定向路径。

 

如下所示的代码片段是用于处理登录请求的 SignInAsync方法的定义，而 RenderLoginPage Async方法用来呈现登录页面。如下面的代码片段所示，对于GET请求，SignInAsync方法会直接调用 RenderLoginPageAsync方法来呈现登录界面。对于 POST请求，我们会从提交的表单中提取用户名和密码，并对其实施验证。如果提供的用户名与密码一致，我们会根据用户名创建一个代表身份的GenericIdentity对象，并利用它创建一个代表登录用户的ClaimsPrincipal对象，RenderHomeAsync方法正是利用该对象来检验当前用户是否是经过认证的。有了 Claims Principal对象，我们只需要将它作为参数调用 HttpContext上下文的 SignInAsync扩展方法即可完成登录，该方法最终会自动重定向到初始方法的路径，也就是我们的主页。

 

一个细节，调用 HttpContext上下文的 ChallengeAsync方法会将当前路径（主页路径“/”，经过编码后为“%2F”）存储在一个名为 ReturnUrl的查询字符串中，SignInAsync方法正是利用它实现对初始路径的重定向的。
既然登录可以通过调用当前 HttpContext上下文的 SignInAsync扩展方法来完成，那么注销操作对应的自然就是 SignOutAsync扩展方法。如下面的代码片段所示，我们定义在 Program中的 SignOutAsync扩展方法正是调用这个方法来注销当前登录状态的。我们在完成注销之后将应用重定向到主页。

 

 

 

using ConsoleApp7;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.Extensions.Caching.Distributed;
using Microsoft.Extensions.Caching.Memory;
using Microsoft.Extensions.Caching.Redis;
using Microsoft.Extensions.FileProviders;
using Microsoft.Extensions.FileSystemGlobbing;
using Microsoft.Extensions.Options;
using System.Diagnostics;
using System.Net;
using System.Security.Claims;
using System.Security.Principal;
using System.Text;
Host.CreateDefaultBuilder().ConfigureWebHostDefaults(webHost =>
{
    webHost.ConfigureServices(services => { });
    webHost.Configure(config => { });
    webHost.UseStartup<StartUp>();
}).Build().Run();

public class StartUp
{
    public void ConfigureServices(IServiceCollection services)
    {
        //注册路由
        services.AddRouting();
        //注册认证
        services.AddAuthentication(configureOptions =>
        {
            //设置默认认证方案
            configureOptions.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
        }).AddCookie(configureOptions =>
        {
            //默认是/Account/Login 可以自定义配置
            configureOptions.LoginPath = "/baidu/Login";
            configureOptions.LogoutPath = "/baidu/Logout";
        });
    }
    public void Configure(IApplicationBuilder builder)
    {
        //使用认证
        builder.UseAuthentication();
        //使用路由
        builder.UseRouting();
        //使用终结点
        builder.UseEndpoints(endPoints =>
        {
            endPoints.Map("/", ServerSign.RenderHomeAsync);
            //默认是 Account 可以自由设置 baidu
            endPoints.Map("/baidu/Login", ServerSign.SignIn);
            endPoints.Map("/baidu/LoginOut", ServerSign.SignOut);
        });
    }
}

public class ServerSign
{
    public static async Task RenderHomeAsync(HttpContext httpContext)
    {
        if (httpContext?.User?.Identity?.IsAuthenticated == true)
        {
            httpContext.Response.ContentType = "text/html;charset=utf-8";
            string html = "<html><body>";
            html += "<p>认证通过</p>";
            html += "<a href='/baidu/LoginOut'>登出</p>";
            html += "</body></html>";
            await httpContext.Response.WriteAsync(html);
        }
        else
        {
            // 默认认证未通过跳转
            await httpContext.ChallengeAsync();
        }
    }

    public static async void SignIn(HttpContext httpContext)
    {
        //get请求
        if (httpContext.Request.Method.ToLower() == "get")
        {
            httpContext.Response.ContentType = "text/html;charset=utf-8";
            string html = "<html><body>";
            html += "<p>请登陆</p>";
            html += "<form method='post'> <p><label>用户名称:</label><input type='text' name='name' id ='name'></p>";
            html += "<input type='hidden'></input>";
            html += "<p><label>密码:</label><input type='password' name='password' id ='password'></p>";
            html += "<input type='submit'>登陆 </input> </form>";
            html += "</body></html>";
            await httpContext.Response.WriteAsync(html);
        }
        else
        {
            //post请求
            var name = httpContext.Request.Form["name"];
            var password = httpContext.Request.Form["password"];
            if (name.Equals("1") && password.Equals("1"))
            {
                var identity = new GenericIdentity(name, "password");
                await httpContext.SignInAsync(new ClaimsPrincipal(identity));
            }
            else
            {
                await RenderHomeAsync(httpContext);
            }
        }
    }
    public static async void SignOut(HttpContext httpContext)
    {
        //httpContext.Response.ContentType = "text/plain;charset=utf-8";
        //httpContext.Response.WriteAsync("登出");
        await httpContext.SignOutAsync();
        httpContext.Response.Redirect("/");
    }
}

 

 

测试结果
登陆成功跳转

 

登出 跳转

 

登出跳转

 

 

 

 

 

 

CookieAuthenticationDefaults 源码

 

// Licensed to the .NET Foundation under one or more agreements.
// The .NET Foundation licenses this file to you under the MIT license.
 
using Microsoft.AspNetCore.Http;
 
namespace Microsoft.AspNetCore.Authentication.Cookies;
 
/// <summary>
/// Default values related to cookie-based authentication handler
/// </summary>
public static class CookieAuthenticationDefaults
{
    /// <summary>
    /// The default value used for CookieAuthenticationOptions.AuthenticationScheme
    /// </summary>
    public const string AuthenticationScheme = "Cookies";
 
    /// <summary>
    /// The prefix used to provide a default CookieAuthenticationOptions.CookieName
    /// </summary>
    public static readonly string CookiePrefix = ".AspNetCore.";
 
    /// <summary>
    /// The default value used by CookieAuthenticationMiddleware for the
    /// CookieAuthenticationOptions.LoginPath
    /// </summary>
    public static readonly PathString LoginPath = new PathString("/Account/Login");
 
    /// <summary>
    /// The default value used by CookieAuthenticationMiddleware for the
    /// CookieAuthenticationOptions.LogoutPath
    /// </summary>
    public static readonly PathString LogoutPath = new PathString("/Account/Logout");
 
    /// <summary>
    /// The default value used by CookieAuthenticationMiddleware for the
    /// CookieAuthenticationOptions.AccessDeniedPath
    /// </summary>
    public static readonly PathString AccessDeniedPath = new PathString("/Account/AccessDenied");
 
    /// <summary>
    /// The default value of the CookieAuthenticationOptions.ReturnUrlParameter
    /// </summary>
    public static readonly string ReturnUrlParameter = "ReturnUrl";
}

 

UseAuthentication 源码

// Licensed to the .NET Foundation under one or more agreements.
// The .NET Foundation licenses this file to you under the MIT license.
 
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Http.Features.Authentication;
using Microsoft.Extensions.DependencyInjection;
 
namespace Microsoft.AspNetCore.Authentication;
 
/// <summary>
/// Middleware that performs authentication.
/// </summary>
public class AuthenticationMiddleware
{
    private readonly RequestDelegate _next;
 
    /// <summary>
    /// Initializes a new instance of <see cref="AuthenticationMiddleware"/>.
    /// </summary>
    /// <param name="next">The next item in the middleware pipeline.</param>
    /// <param name="schemes">The <see cref="IAuthenticationSchemeProvider"/>.</param>
    public AuthenticationMiddleware(RequestDelegate next, IAuthenticationSchemeProvider schemes)
    {
        ArgumentNullException.ThrowIfNull(next);
        ArgumentNullException.ThrowIfNull(schemes);
 
        _next = next;
        Schemes = schemes;
    }
 
    /// <summary>
    /// Gets or sets the <see cref="IAuthenticationSchemeProvider"/>.
    /// </summary>
    public IAuthenticationSchemeProvider Schemes { get; set; }
 
    /// <summary>
    /// Invokes the middleware performing authentication.
    /// </summary>
    /// <param name="context">The <see cref="HttpContext"/>.</param>
    public async Task Invoke(HttpContext context)
    {
        context.Features.Set<IAuthenticationFeature>(new AuthenticationFeature
        {
            OriginalPath = context.Request.Path,
            OriginalPathBase = context.Request.PathBase
        });
 
        // Give any IAuthenticationRequestHandler schemes a chance to handle the request
        var handlers = context.RequestServices.GetRequiredService<IAuthenticationHandlerProvider>();
        foreach (var scheme in await Schemes.GetRequestHandlerSchemesAsync())
        {
            var handler = await handlers.GetHandlerAsync(context, scheme.Name) as IAuthenticationRequestHandler;
            if (handler != null && await handler.HandleRequestAsync())
            {
                return;
            }
        }
 
        var defaultAuthenticate = await Schemes.GetDefaultAuthenticateSchemeAsync();
        if (defaultAuthenticate != null)
        {
            var result = await context.AuthenticateAsync(defaultAuthenticate.Name);
            if (result?.Principal != null)
            {
                context.User = result.Principal;
            }
            if (result?.Succeeded ?? false)
            {
                var authFeatures = new AuthenticationFeatures(result);
                context.Features.Set<IHttpAuthenticationFeature>(authFeatures);
                context.Features.Set<IAuthenticateResultFeature>(authFeatures);
            }
        }
 
        await _next(context);
    }
}

CookieAuthenticationOptions 源码

File: CookieAuthenticationOptions.cs
Web Access
Project: src\src\Security\Authentication\Cookies\src\Microsoft.AspNetCore.Authentication.Cookies.csproj (Microsoft.AspNetCore.Authentication.Cookies)
// Licensed to the .NET Foundation under one or more agreements.
// The .NET Foundation licenses this file to you under the MIT license.
 
using Microsoft.AspNetCore.DataProtection;
using Microsoft.AspNetCore.Http;
 
namespace Microsoft.AspNetCore.Authentication.Cookies;
 
/// <summary>
/// Configuration options for <see cref="CookieAuthenticationOptions"/>.
/// </summary>
public class CookieAuthenticationOptions : AuthenticationSchemeOptions
{
    private CookieBuilder _cookieBuilder = new RequestPathBaseCookieBuilder
    {
        // the default name is configured in PostConfigureCookieAuthenticationOptions
 
        // To support OAuth authentication, a lax mode is required, see https://github.com/aspnet/Security/issues/1231.
        SameSite = SameSiteMode.Lax,
        HttpOnly = true,
        SecurePolicy = CookieSecurePolicy.SameAsRequest,
        IsEssential = true,
    };
 
    /// <summary>
    /// Create an instance of the options initialized with the default values
    /// </summary>
    public CookieAuthenticationOptions()
    {
        ExpireTimeSpan = TimeSpan.FromDays(14);
        ReturnUrlParameter = CookieAuthenticationDefaults.ReturnUrlParameter;
        SlidingExpiration = true;
        Events = new CookieAuthenticationEvents();
    }
 
    /// <summary>
    /// Determines the settings used to create the cookie.
    /// </summary>
    /// <remarks>
    /// <list type="bullet">
    /// <item><description>The default value for cookie <see cref="CookieBuilder.Name"/> is <c>.AspNetCore.Cookies</c>.
    /// This value should be changed if you change the name of the <c>AuthenticationScheme</c>, especially if your
    /// system uses the cookie authentication handler multiple times.</description></item>
    /// <item><description><see cref="CookieBuilder.SameSite"/> determines if the browser should allow the cookie to be attached to same-site or cross-site requests.
    /// The default is <c>Lax</c>, which means the cookie is only allowed to be attached to cross-site requests using safe HTTP methods and same-site requests.</description></item>
    /// <item><description><see cref="CookieBuilder.HttpOnly"/> determines if the browser should allow the cookie to be accessed by client-side JavaScript.
    /// The default is <c>true</c>, which means the cookie will only be passed to HTTP requests and is not made available to JavaScript on the page.</description></item>
    /// <item><description><see cref="CookieBuilder.Expiration"/> is currently ignored. Use <see cref="ExpireTimeSpan"/> to control lifetime of cookie authentication.</description></item>
    /// <item><description><see cref="CookieBuilder.SecurePolicy"/> defaults to <see cref="CookieSecurePolicy.SameAsRequest"/>.</description></item>
    /// </list>
    /// </remarks>
    public CookieBuilder Cookie
    {
        get => _cookieBuilder;
        set => _cookieBuilder = value ?? throw new ArgumentNullException(nameof(value));
    }
 
    /// <summary>
    /// If set this will be used by the CookieAuthenticationHandler for data protection.
    /// </summary>
    public IDataProtectionProvider? DataProtectionProvider { get; set; }
 
    /// <summary>
    /// The SlidingExpiration is set to true to instruct the handler to re-issue a new cookie with a new
    /// expiration time any time it processes a request which is more than halfway through the expiration window.
    /// </summary>
    public bool SlidingExpiration { get; set; }
 
    /// <summary>
    /// The LoginPath property is used by the handler for the redirection target when handling ChallengeAsync.
    /// The current url which is added to the LoginPath as a query string parameter named by the ReturnUrlParameter.
    /// Once a request to the LoginPath grants a new SignIn identity, the ReturnUrlParameter value is used to redirect
    /// the browser back to the original url.
    /// </summary>
    public PathString LoginPath { get; set; }
 
    /// <summary>
    /// If the LogoutPath is provided the handler then a request to that path will redirect based on the ReturnUrlParameter.
    /// </summary>
    public PathString LogoutPath { get; set; }
 
    /// <summary>
    /// The AccessDeniedPath property is used by the handler for the redirection target when handling ForbidAsync.
    /// </summary>
    public PathString AccessDeniedPath { get; set; }
 
    /// <summary>
    /// The ReturnUrlParameter determines the name of the query string parameter which is appended by the handler
    /// during a Challenge. This is also the query string parameter looked for when a request arrives on the login
    /// path or logout path, in order to return to the original url after the action is performed.
    /// </summary>
    public string ReturnUrlParameter { get; set; }
 
    /// <summary>
    /// The Provider may be assigned to an instance of an object created by the application at startup time. The handler
    /// calls methods on the provider which give the application control at certain points where processing is occurring.
    /// If it is not provided a default instance is supplied which does nothing when the methods are called.
    /// </summary>
    public new CookieAuthenticationEvents Events
    {
        get => (CookieAuthenticationEvents)base.Events!;
        set => base.Events = value;
    }
 
    /// <summary>
    /// The TicketDataFormat is used to protect and unprotect the identity and other properties which are stored in the
    /// cookie value. If not provided one will be created using <see cref="DataProtectionProvider"/>.
    /// </summary>
    public ISecureDataFormat<AuthenticationTicket> TicketDataFormat { get; set; } = default!;
 
    /// <summary>
    /// The component used to get cookies from the request or set them on the response.
    ///
    /// ChunkingCookieManager will be used by default.
    /// </summary>
    public ICookieManager CookieManager { get; set; } = default!;
 
    /// <summary>
    /// An optional container in which to store the identity across requests. When used, only a session identifier is sent
    /// to the client. This can be used to mitigate potential problems with very large identities.
    /// </summary>
    public ITicketStore? SessionStore { get; set; }
 
    /// <summary>
    /// <para>
    /// Controls how much time the authentication ticket stored in the cookie will remain valid from the point it is created
    /// The expiration information is stored in the protected cookie ticket. Because of that an expired cookie will be ignored
    /// even if it is passed to the server after the browser should have purged it.
    /// </para>
    /// <para>
    /// This is separate from the value of <see cref="CookieOptions.Expires"/>, which specifies
    /// how long the browser will keep the cookie.
    /// </para>
    /// </summary>
    public TimeSpan ExpireTimeSpan { get; set; }
}
Document OutlineProject ExplorerNamespace Explorer