Question

当我调用从class继承的IAuthenticationFilter AuthenticateAsync方法时不会触发。

     public class HMACAuthenticationAttribute : Attribute, IAuthenticationFilter
        {
            private static Dictionary<string, string> allowedApps = new Dictionary<string, string>();
            // private readonly UInt64 requestMaxAgeInSeconds = 300;  //5 mins
            private readonly string authenticationScheme = "hmacauth";

            public HMACAuthenticationAttribute()
            {
                if (allowedApps.Count == 0)
                {
                    allowedApps.Add("4d53bce03ec34c0a911182d4c228ee6c", "A93reRTUJHsCuQSHR+L3GxqOJyDmQpCgps102ciuabc=");
                }
            }

            public Task AuthenticateAsync(HttpAuthenticationContext context, CancellationToken cancellationToken)
            {
                var req = context.Request;
    }
    }

我正在调用带有一些授权内容的api，因此应该重定向到AuthenticateAsync方法来验证该授权内容。但是此AuthenticateAsync不会触发。

    protected async override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
            {
                HttpResponseMessage response = null;
                string requestContentBase64String = string.Empty;

                string requestUri = HttpUtility.UrlEncode(request.RequestUri.AbsoluteUri.ToLower());

                string requestHttpMethod = request.Method.Method;

                //For timespan
                DateTime epochStart = new DateTime(1970, 01, 01, 0, 0, 0, 0, DateTimeKind.Utc);
                TimeSpan timeSpan = DateTime.UtcNow - epochStart;
                string requestTimeStamp = Convert.ToUInt64(timeSpan.TotalSeconds).ToString();

                //Random GUID
                string nonce = Guid.NewGuid().ToString("N");

                if (request.Content != null)
                {
                    byte[] content = await request.Content.ReadAsByteArrayAsync();
                    MD5 md5 = MD5.Create();
                    //Hashing the request body, any change in request body will result in different hash, we'll incure message integrity
                    byte[] requestContentHash = md5.ComputeHash(content);
                    requestContentBase64String = Convert.ToBase64String(requestContentHash);
                }

                //Creating the raw signature string
                string signatureRawData = String.Format("{0}{1}{2}{3}{4}{5}", APPId, requestHttpMethod, requestUri, requestTimeStamp, nonce, requestContentBase64String);

                var secretKeyByteArray = Convert.FromBase64String(APIKey);

                byte[] signature = Encoding.UTF8.GetBytes(signatureRawData);

                using (HMACSHA256 hmac = new HMACSHA256(secretKeyByteArray))
                {
                    byte[] signatureBytes = hmac.ComputeHash(signature);
                    string requestSignatureBase64String = Convert.ToBase64String(signatureBytes);
                    //Setting the values in the Authorization header using custom scheme (hmacauth)
                    request.Headers.Authorization = new AuthenticationHeaderValue("hmacauth", string.Format("{0}:{1}:{2}:{3}", APPId, requestSignatureBase64String, nonce, requestTimeStamp));
                }

                response = await base.SendAsync(request, cancellationToken);

                return response;
            }

Answer 1

在asp.net核心中，您需要继承IAuthorizationFilter而不是IAsyncAuthorizationFilter（或IAuthenticationFilter）来创建自定义授权过滤器。

public class HMACAuthenticationAttribute :Attribute, IAsyncAuthorizationFilter
{
   public Task OnAuthorizationAsync(AuthorizationFilterContext context)
    {
        var headers = context.HttpContext.Request.Headers;
        var authHeaders = headers["Authorization"];
        //...
    }
}

要进入OnAuthorizationAsync，请记住用[HMACAuthentication]属性装饰动作，或者您可以在Startup.cs中执行此操作，以应用于所有动作：

services.AddMvc(options =>
    {
        // add an instance of the filter, like we used to do it
        options.Filters.Add(new HMACAuthenticationAttribute ());
    });

.NET核心未启动AuthenticateAsync

1 个答案: