Web用户的身份验证及WebApi权限验证流程的设计和实现

时间：2024-01-01 20:43:09

5. WebApi 服务端代码示例

5.1 控制器基类ApiControllerBase

[csharp] view plaincopy
  1. ///
  2. /// Controller的基类，用于实现适合业务场景的基础功能
  3. ///
  4. ///
  5. [BasicAuthentication]
  6. public abstract class ApiControllerBase : ApiController
  7. {
  8. }

5.2
权限属性BaseAuthenticationAttribute

[csharp] view
plaincopy
  1. ///
  2. /// 基本验证Attribtue，用以Action的权限处理
  3. ///
  4. public class
    BasicAuthenticationAttribute :
    ActionFilterAttribute
  5. {
  6. ///
  7. /// 检查用户是否有该Action执行的操作权限
  8. ///
  9. ///
  10. public override void
    OnActionExecuting(HttpActionContext
    actionContext)
  11. {
  12. //检验用户ticket信息，用户ticket信息来自调用发起方
  13. if
    (actionContext.Request.Headers.Authorization != null)
  14. {
  15. //解密用户ticket,并校验用户名密码是否匹配
  16. var encryptTicket =
    actionContext.Request.Headers.Authorization.Parameter;
  17. if
    (ValidateUserTicket(encryptTicket))
  18. base.OnActionExecuting(actionContext);
  19. else
  20. actionContext.Response = new
    HttpResponseMessage(HttpStatusCode.Unauthorized);
  21. }
  22. else
  23. {
  24. //检查web.config配置是否要求权限校验
  25. bool
    isRquired =
    (WebConfigurationManager.AppSettings["WebApiAuthenticatedFlag"].ToString()
    == "true");
  26. if
    (isRquired)
  27. {
  28. //如果请求Header不包含ticket，则判断是否是匿名调用
  29. var attr =
    actionContext.ActionDescriptor.GetCustomAttributes().OfType();
  30. bool
    isAnonymous = attr.Any(a => a is
    AllowAnonymousAttribute);
  31. //是匿名用户，则继续执行；非匿名用户，抛出“未授权访问”信息
  32. if
    (isAnonymous)
  33. base.OnActionExecuting(actionContext);
  34. else
  35. actionContext.Response = new
    HttpResponseMessage(HttpStatusCode.Unauthorized);
  36. }
  37. else
  38. {
  39. base.OnActionExecuting(actionContext);
  40. }
  41. }
  42. }
  43. ///
  44. /// 校验用户ticket信息
  45. ///
  46. ///
  47. ///
  48. private bool
    ValidateUserTicket(string
    encryptTicket)
  49. {
  50. var userTicket =
    FormsAuthentication.Decrypt(encryptTicket);
  51. var userTicketData =
    userTicket.UserData;
  52. string
    userName = userTicketData.Substring(0,
    userTicketData.IndexOf(":"));
  53. string
    password =
    userTicketData.Substring(userTicketData.IndexOf(":")
    + 1);
  54. //检查用户名、密码是否正确，验证是合法用户
  55. //var isQuilified = CheckUser(userName,
    password);
  56. return true;
  57. }
  58. }

5.3
api服务Controller实例

[csharp] view
plaincopy
  1. public class
    ProductController : ApiControllerBase
  2. {
  3. [HttpGet]
  4. public object
    Find(string
    id)
  5. {
  6. return
    ProductServiceInstance.Find(2);
  7. }
  8. // GET api/product/5
  9. [HttpGet]
  10. [AllowAnonymous]
  11. public
    Product Get(string
    id)
  12. {
  13. var headers =
    Request.Headers;
  14. var p =
    ProductServiceInstance.GetById(long.Parse(id));
  15. if
    (p == null)
  16. {
  17. throw new
    HttpResponseException(new
    HttpResponseMessage(HttpStatusCode.BadRequest)
  18. Content = new
    StringContent("id3 not found"),
    ReasonPhrase = "product id not exist."
    });
  19. }
  20. return
    p;
  21. }
  22. }

6.
其它配置说明

6.1
Mvc前端Web.Config 配置

  1. <</SPAN>system.web>
  2. <</SPAN>compilation debug="true" targetFramework="4.5">
  3. <</SPAN>assemblies>
  4. <</SPAN>add assembly="System.Web.Http.Data.Helpers,
    Version=4.0.0.0, Culture=neutral,
    PublicKeyToken=31bf3856ad364e35" />
  5. </</SPAN>assemblies>
  6. </</SPAN>compilation>
  7. <</SPAN>httpRuntime targetFramework="4.5" />
  8. <</SPAN>authentication mode="Forms">
  9. <</SPAN>forms loginUrl="~/Account/Login" defaultUrl="~/Home/Index" protection="All" timeout="90" name=".AuthCookie"></</SPAN>forms>
  10. </</SPAN>authentication>
  11. <</SPAN>machineKey validationKey="3FFA12388DDF585BA5D35E7BC87E3F0AB47FBBEBD12240DD3BEA2BEAEC4ABA213F22AD27E8FAD77DCFEE306219691434908D193A17C1FC8DCE51B71A4AE54920"
    decryptionKey="ECB6A3AF9ABBF3F16E80685ED68DC74B0B13CCEE538EBBA97D0B893139683B3B"
    validation="SHA1" decryption="AES" />
  12. </</SPAN>system.web>

machineKey节点配置，是应用于对用户ticket数据加密和解密。

6.2
WebApi服务端Web.Config配置

  1. <</SPAN>system.web>
  2. <</SPAN>machineKey validationKey="3FF112388DDF585BA5D35E7BC87E3F0AB47FBBEBD12240DD3BEA2BEAEC4ABA213F22AD27E8FAD77DCFEE306219691434908D193A17C1FC8DCE51B71A4AE54920"
    decryptionKey="ECB6A3AF9ABBF3F16E80685ED68DC74B0B13CCEE538EBBA97D0B893139683B3B"
    validation="SHA1" decryption="AES" />
  3. </</SPAN>system.web>

machineKey节点配置，是应用于对用户ticket数据加密和解密。

7.
总结

Web系统的用户登录及页面操作权限验证在处理逻辑上比较复杂，需要考虑到Form认证、匿名访问，Session和Cookie存储，以及Session和Cookie的过期处理，本文实现了整个权限验证框架的基本功能，供系统架构设计人员以及Web开发人员参考。

Demo项目代码地址：
https://github.com/lgsky/DemoUserAuthorization/

相关文章