如何安全地拦截自定义Owin中间件中的响应流

时间:2014-10-06 10:13:18

标签: c# stream owin katana owin-middleware

我试图编写一个简单的OWIN中间件,以拦截响应流。我尝试做的是用基于Stream的自定义类替换原始流,在那里我将能够拦截对响应流的写入。

但是,我遇到了一些问题,因为我无法知道链中的内部中间件组件何时完全写入了响应。永远不会调用Stream的Dispose覆盖。因此,我不知道何时需要执行我的处理,这应该发生在响应流的末尾。

以下是示例代码:

public sealed class CustomMiddleware: OwinMiddleware
{
    public CustomMiddleware(OwinMiddleware next)
        : base(next)
    {
    }

    public override async Task Invoke(IOwinContext context)
    {
        var request = context.Request;
        var response = context.Response;

        // capture response stream

        var vr = new MemoryStream();
        var responseStream = new ResponseStream(vr, response.Body);

        response.OnSendingHeaders(state =>
        {
            var resp = (state as IOwinContext).Response;
            var contentLength = resp.Headers.ContentLength;

            // contentLength == null for Chunked responses

        }, context);

        // invoke the next middleware in the pipeline

        await Next.Invoke(context);
    }
}

public sealed class ResponseStream : Stream
{
    private readonly Stream stream_; // MemoryStream
    private readonly Stream output_; // Owin response
    private long writtenBytes_ = 0L;

    public ResponseStream(Stream stream, Stream output)
    {
        stream_ = stream;
        output_ = output;
    }

    ... // System.IO.Stream implementation

    public override void Write(byte[] buffer, int offset, int count)
    {
        // capture writes to the response stream in our local stream
        stream_.Write(buffer, offset, count);

        // write to the real output stream
        output_.Write(buffer, offset, count);

        // update the number of bytes written

        writtenBytes_ += count;

        // how do we know the response is complete ?
        // we could check that the number of bytes written
        // is equal to the content length, but content length
        // is not available for Chunked responses.
    }

    protected override void Dispose(bool disposing)
    {
        // we could perform our processing
        // when the stream is disposed of.
        // however, this method is never called by
        // the OWIN/Katana infrastructure.
    }
}

正如我在上述代码的评论中所提到的,我可以考虑两种策略来检测响应是否完整。

a)我可以记录写入响应流的字节数,并将其与预期的响应长度相关联。但是,在使用Chunked Transfer Encoding的响应的情况下,长度是未知的。

b)我可以在响应流上调用Dispose时确定响应流已完成。但是,OWIN / Katana基础设施从不在替换流上调用Dispose。

我一直在研究Opaque Streaming,以便了解操纵底层HTTP协议是否是一种可行的方法,但我似乎并不知道Katana是否支持Opaque Streaming。

有没有办法达到我想要的目的?

1 个答案:

答案 0 :(得分:36)

我不认为您需要一个子类流,但接下来就是您如何阅读响应。只需确保此中间件是OWIN管道中的第一个,以便它是检查响应的最后一个。

using AppFunc = Func<IDictionary<string, object>, Task>;

public class CustomMiddleware
{
    private readonly AppFunc next;

    public CustomMiddleware(AppFunc next)
    {
        this.next = next;
    }

    public async Task Invoke(IDictionary<string, object> env)
    {
        IOwinContext context = new OwinContext(env);

        // Buffer the response
        var stream = context.Response.Body;
        var buffer = new MemoryStream();
        context.Response.Body = buffer;

        await this.next(env);

        buffer.Seek(0, SeekOrigin.Begin);
        var reader = new StreamReader(buffer);
        string responseBody = await reader.ReadToEndAsync();

        // Now, you can access response body.
        Debug.WriteLine(responseBody);

        // You need to do this so that the response we buffered
        // is flushed out to the client application.
        buffer.Seek(0, SeekOrigin.Begin);
        await buffer.CopyToAsync(stream);
    }
}
据我所知,BTW源于OwinMiddleware并不是一种好习惯,因为OwinMiddleware特定于Katana。但是,这与你的问题无关。