我在asp.net web api
中设置了客户授权属性全球档案:
FilterConfig.RegisterHttpFilters(GlobalConfiguration.Configuration.Filters);
FilterConfig.cs
public static void RegisterHttpFilters(System.Web.Http.Filters.HttpFilterCollection filters)
{
filters.Add(new TokenAuthentication(""));
}
身份验证类:
public class TokenAuthentication : Attribute, IAuthenticationFilter
{
private readonly string realm;
public bool AllowMultiple { get { return false; } }
public TokenAuthentication(string realm)
{
this.realm = "realm=" + realm;
}
public Task AuthenticateAsync(HttpAuthenticationContext context, CancellationToken cancellationToken)
{
var request = context.Request;
// Receive token from the client. Here is the example when token is in header:
string token = null;
if (request.Headers.Contains("Token"))
{
token = request.Headers.GetValues("Token").FirstOrDefault();
}
if (token != null && token != "")
{
// Get your secret key from the configuration
var secretKey = ConfigurationManager.AppSettings["JWTSecurityKey"];
try
{
//Get the Payload from the token
string jsonPayload = JWT.JsonWebToken.Decode(token, secretKey);
int separatorIndex = jsonPayload.IndexOf(';');
string userId = "";
DateTime timeIssued = DateTime.MinValue;
if (separatorIndex >= 0)
{
//userId = UTF8Encoding.UTF8.GetString(Convert.FromBase64String(jsonPayload.Substring(0, separatorIndex)));
userId = jsonPayload.Substring(1, separatorIndex - 1);
string tmpTime = jsonPayload.Substring(separatorIndex + 1, (jsonPayload.Length - separatorIndex) - 2);
timeIssued = DateTime.Parse(tmpTime);
}
short TokenTTL = 10; //minuets
//Int16.TryParse(ConfigurationManager.AppSettings["TokenTTL"],TokenTTL);
// if ((DateTime.Now.Subtract(timeIssued).TotalMinutes >= TokenTTL))
if ((DateTime.Now.Subtract(timeIssued).TotalMinutes < 0))
{
context.ErrorResult = new UnauthorizedResult(new AuthenticationHeaderValue[0], context.Request);
}
else
{
//Save user in context
var claims = new List<Claim>()
{
new Claim(ClaimTypes.Name, userId)
};
var id = new ClaimsIdentity(claims, "Basic");
var principal = new ClaimsPrincipal(new[] { id });
// Set the user name to the user id in the httpcontext which is passed to the controller
context.Principal = principal;
}
}
catch (JWT.SignatureVerificationException)
{
context.ErrorResult = new UnauthorizedResult(new AuthenticationHeaderValue[0], context.Request);
}
}
else
{
return Task.FromResult(0);
}
return Task.FromResult(0);
}
/// <summary>
///
/// </summary>
/// <param name="context"></param>
/// <param name="cancellationToken"></param>
/// <returns></returns>
public Task ChallengeAsync(HttpAuthenticationChallengeContext context, CancellationToken cancellationToken)
{
context.Result = new ResultWithChallenge(context.Result, realm);
return Task.FromResult(0);
}
}
/// <summary>
///
/// </summary>
public class ResultWithChallenge : IHttpActionResult
{
private readonly IHttpActionResult next;
private readonly string realm;
/// <summary>
/// Constructor
/// </summary>
/// <param name="next"></param>
/// <param name="realm"></param>
public ResultWithChallenge(IHttpActionResult next, string realm)
{
this.next = next;
this.realm = realm;
}
/// <summary>
///
/// </summary>
/// <param name="cancellationToken"></param>
/// <returns></returns>
public async Task<HttpResponseMessage> ExecuteAsync(CancellationToken cancellationToken)
{
var res = await next.ExecuteAsync(cancellationToken);
if (res.StatusCode == HttpStatusCode.Unauthorized)
{
res.Headers.WwwAuthenticate.Add(
new AuthenticationHeaderValue("Basic", this.realm));
}
return res;
}
}
现在我的问题是,即使将[AllowAnonymous]
属性应用于我的控制器操作,也会调用此类。
由于用户还没有令牌,这给我带来了登录操作方面的麻烦。
我该如何纠正这个?
答案 0 :(得分:3)
AllowAnonymous
仅适用于授权过滤器。你在这里有一个身份验证过滤器。请改用System.Web.Http中的OverrideAuthentication
。
更新
在我的原始答案中,我说你必须实施身份验证?我所说的是,如果您不希望调用AuthenticateAsync
的{{1}}方法,请应用TokenAuthentication
,而不是OverrideAuthentication
。 AllowAnonymous
仅适用于authroization过滤器,而不适用于身份验证过滤器。因此,在您的AllowAnonymous
操作中,您需要Login
这样应用。
OverrideAuthentication