首页 > 学院 > 开发设计 > 正文

关于WEBService&WCF&WebApi实现身份验证之WebApi篇

2019-11-14 14:18:01
字体:
来源:转载
供稿:网友

之前先后总结并发表了关于WEB Service、WCF身份验证相关文章,如下:

关于WEB Service&WCF&WebApi实现身份验证之WEB Service篇、

关于WEB Service&WCF&WebApi实现身份验证之WCF篇(1)、关于WEB Service&WCF&WebApi实现身份验证之WCF篇(2)

今天再来总结关于如何实现WebApi的身份验证,以完成该系列所有文章,WebApi常见的实现方式有:FORM身份验证、集成WINDOWS验证、Basic基础认证、Digest摘要认证

 第一种:FORM身份验证(若在asp.net应用程序使用,则该验证方式不支持跨域,因为cookie无法跨域访问)

1.定义一个FormAuthenticationFilterAttribute,该类继承自AuthorizationFilterAttribute,并重写其OnAuthorization,在该方法中添加从请求头中获取有无登录的Cookie,若有则表示登录成功,否则失败,代码如下:

using System;using System.Collections.Generic;using System.Linq;using System.Web;using System.Web.Http;using System.Web.Http.Filters;using System.Web.Security;using System.Net.Http;using System.Collections.ObjectModel;using System.Net.Http.Headers;using System.Threading;using System.Security.PRincipal;using System.Net;using System.Text;namespace Webapplication1.Models{    public class FormAuthenticationFilterAttribute : AuthorizationFilterAttribute    {        private const string UnauthorizedMessage = "请求未授权,拒绝访问。";        public override void OnAuthorization(System.Web.Http.Controllers.HttpActionContext actionContext)        {            if (actionContext.ActionDescriptor.GetCustomAttributes<AllowAnonymousAttribute>().Count > 0)            {                base.OnAuthorization(actionContext);                return;            }            if (HttpContext.Current.User != null && HttpContext.Current.User.Identity.IsAuthenticated)            {                base.OnAuthorization(actionContext);                return;            }            var cookies = actionContext.Request.Headers.GetCookies();            if (cookies == null || cookies.Count < 1)            {                actionContext.Response = new HttpResponseMessage(HttpStatusCode.Unauthorized) { Content = new StringContent(UnauthorizedMessage, Encoding.UTF8) };                return;            }            FormsAuthenticationTicket ticket = GetTicket(cookies);            if (ticket == null)            {                actionContext.Response = new HttpResponseMessage(HttpStatusCode.Unauthorized) { Content = new StringContent(UnauthorizedMessage, Encoding.UTF8) };                return;            }            //这里可以对FormsAuthenticationTicket对象进行进一步验证            var principal = new GenericPrincipal(new FormsIdentity(ticket), null);            HttpContext.Current.User = principal;            Thread.CurrentPrincipal = principal;            base.OnAuthorization(actionContext);        }        private FormsAuthenticationTicket GetTicket(Collection<CookieHeaderValue> cookies)        {            FormsAuthenticationTicket ticket = null;            foreach (var item in cookies)            {                var cookie = item.Cookies.SingleOrDefault(c => c.Name == FormsAuthentication.FormsCookieName);                if (cookie != null)                {                    ticket = FormsAuthentication.Decrypt(cookie.Value);                    break;                }            }            return ticket;        }    }}

  

2.在需要认证授权后才能访问的Controller中类或ACTION方法上添加上述授权过滤器FormAuthenticationFilterAttribute,也可在global文件中将该类添加到全局过滤器中,同时定义一个登录ACTION,用于登录入口,示例代码如下:

using System;using System.Collections.Generic;using System.Linq;using System.Net;using System.Net.Http;using System.Web;using System.Web.Http;using System.Web.Security;using WebApplication1.Models;namespace WebApplication1.Controllers{    [FormAuthenticationFilter]    public class TestController : ApiController    {        [AllowAnonymous]        [AcceptVerbs("Get")]        [Route("Api/Test/Login")]        public HttpResponseMessage Login(string uname, string pwd)        {            if ("admin".Equals(uname, StringComparison.OrdinalIgnoreCase) && "api.admin".Equals(pwd))            {                //创建票据                FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(1, uname, DateTime.Now, DateTime.Now.AddMinutes(30), false, string.Empty);                //加密票据                string authTicket = FormsAuthentication.Encrypt(ticket);                //存储为cookie                HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, authTicket);                cookie.Path = FormsAuthentication.FormsCookiePath;                HttpContext.Current.Response.AppendCookie(cookie);                //或者                //FormsAuthentication.SetAuthCookie(uname, false, "/");                return Request.CreateResponse(HttpStatusCode.OK, "登录成功!");            }            else            {                HttpContext.Current.Response.AppendCookie(new HttpCookie(FormsAuthentication.FormsCookieName) { Expires = DateTime.Now.AddDays(-10) });//测试用:当登录失败时,清除可能存在的身份验证Cookie                return Request.CreateErrorResponse(HttpStatusCode.NotFound, "登录失败,无效的用户名或密码!");            }        }        // GET api/test        public IEnumerable<string> GetValues()        {            return new string[] { "value1", "value2" };        }        // GET api/test/5        public string GetValue(int id)        {            return "value";        }    }}

测试用法一:可直接在浏览器中访问需要授权的方法(即:Login除外),如:http://localhost:11099/api/test/,响应结果如下:

请求头信息如下:

若成功调用Login方法后(http://localhost:11099/api/test/login?uname=admin&pwd=api.admin),再调用上述方法,则可以获得正常的结果,如下图示:

看一下请求时附带的Cookie,如下图示:

测试用法二:采用HttpClient来调用Api的相关方法,示例代码如下:

        public async static void TestLoginApi()        {            HttpClientHandler handler = new HttpClientHandler();            handler.UseCookies = true;//因为采用Form验证,所以需要使用Cookie来记录身份登录信息            HttpClient client = new HttpClient(handler);            Console.WriteLine("Login>>>>>>>>>>>>>>>>>>>>>>>>>>>>>");            var response = await client.GetAsync("http://localhost:11099/api/test/login/?uname=admin&pwd=api.admin");            var r = await response.Content.ReadAsAsync<dynamic>();            Console.WriteLine("StatusCode:{0}", response.StatusCode);            if (!response.IsSuccessStatusCode)            {                Console.WriteLine("Msg:{1}", response.StatusCode, r.Message);                return;            }            Console.WriteLine("Msg:{1}", response.StatusCode, r);            var getCookies = handler.CookieContainer.GetCookies(new Uri("http://localhost:11099/"));            Console.WriteLine("获取到的cookie数量:" + getCookies.Count);            Console.WriteLine("获取到的cookie:");            for (int i = 0; i < getCookies.Count; i++)            {                Console.WriteLine(getCookies[i].Name + ":" + getCookies[i].Value);            }            Console.WriteLine("GetValues>>>>>>>>>>>>>>>>>>>>>>>>>>>>>");            response = await client.GetAsync("http://localhost:11099/api/test/");            var r2 = await response.Content.ReadAsAsync<IEnumerable<string>>();            foreach (string item in r2)            {                Console.WriteLine("GetValues - Item Value:{0}", item);            }            Console.WriteLine("GetValue>>>>>>>>>>>>>>>>>>>>>>>>>>>>>");            response = await client.GetAsync("http://localhost:11099/api/test/8");            var r3 = await response.Content.ReadAsAsync<string>();            Console.WriteLine("GetValue - Item Value:{0}", r3);        }

结果如下图示:

 如果Web Api作为ASP.NET 或MVC的一部份使用,那么完全可以采用基于默认的FORM身份验证授权特性(Authorize),或采用web.config中配置,这个很简单,就不作说明了,大家可以网上参考关于ASP.NET 或ASP.NET MVC的FORM身份验证。

第二种:集成WINDOWS验证

首先在WEB.CONFIG文件中,增加如下配置,以开启WINDOWS身份验证,配置如下:

    <authentication mode="Windows">    </authentication>

然后在需要认证授权后才能访问的Controller中类或ACTION方法上添加Authorize特性,Controller与上文相同不再贴出,当然也可以在WEB.CONFIG中配置:

    <authorization>      <deny users="?"/>    </authorization>

最后将WEB API寄宿到(或者说发布到)IIS,且需要在IIS中启用WINDOWS身份验证,如下图示:

这样就完成了该身份验证模式(理论上WEB服务、WCF若都以IIS为宿主,都可以采用集成WINDOWS身份验证模式),测试方法很简单,第一种直接在浏览器中访问,第二种采用HttpClient来调用WEB API,示例代码如下:

        public async static void TestLoginApi2()        {            HttpClientHandler handler = new HttpClientHandler();            handler.ClientCertificateOptions = ClientCertificateOption.Manual;            handler.Credentials = new NetworkCredential("admin", "www.zuowenjun.cn");            HttpClient client = new HttpClient(handler);            var response = await client.GetAsync("http://localhost:8010/api/test/");            var r2 = await response.Content.ReadAsAsync<IEnumerable<string>>();            foreach (string item in r2)            {                Console.WriteLine("GetValues - Item Value:{0}", item);            }            response = await client.GetAsync("http://localhost:8010/api/test/8");            var r3 = await response.Content.ReadAsAsync<string>();            Console.WriteLine("GetValue - Item Value:{0}", r3);        }

第三种:Basic基础认证

1.定义一个继承自AuthorizationFilterAttribute的HttpBasicAuthenticationFilter类,用于实现Basic基础认证,实现代码如下:

using System;using System.Net;using System.Text;using System.Web;using System.Web.Http.Controllers;using System.Web.Http.Filters;using System.Net.Http;using System.Web.Http;using System.Security.Principal;using System.Threading;using System.Net.Http.Headers;namespace WebApplication1.Models{    public class HttpBasicAuthenticationFilter : AuthorizationFilterAttribute    {        public override void OnAuthorization(System.Web.Http.Controllers.HttpActionContext actionContext)        {            if (actionContext.ActionDescriptor.GetCustomAttributes<AllowAnonymousAttribute>().Count > 0)            {                base.OnAuthorization(actionContext);                return;            }            if (Thread.CurrentPrincipal != null && Thread.CurrentPrincipal.Identity.IsAuthenticated)            {                base.OnAuthorization(actionContext);                return;            }            string authParameter = null;            var authValue = actionContext.Request.Headers.Authorization;            if (authValue != null && authValue.Scheme == "Basic")            {                authParameter = authValue.Parameter;  //authparameter:获取请求中经过Base64编码的(用户:密码)            }            if (string.IsNullOrEmpty(authParameter))            {                Challenge(actionContext);                return;            }            authParameter = Encoding.Default.GetString(Convert.FromBase64String(authParameter));            var authToken = authParameter.Split(':');            if (authToken.Length < 2)            {                Challenge(actionContext);                return;            }            if (!ValidateUser(authToken[0], authToken[1]))            {                Challenge(actionContext);                return;            }            var principal = new GenericPrincipal(new GenericIdentity(authToken[0]), null);            Thread.CurrentPrincipal = principal;            if (HttpContext.Current != null)            {                HttpContext.Current.User = principal;            }            base.OnAuthorization(actionContext);        }        private void Challenge(HttpActionContext actionContext)        {            var host = actionContext.Request.RequestUri.DnsSafeHost;            actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.Unauthorized, "请求未授权,拒绝访问。");            //actionContext.Response.Headers.Add("WWW-Authenticate", string.Format("Basic realm=/"{0}/"", host));//可以使用如下语句            actionContext.Response.Headers.WwwAuthenticate.Add(new AuthenticationHeaderValue("Basic", string.Format("realm=/"{0}/"", host)));        }        protected virtual bool ValidateUser(string userName, string passWord)        {            if (userName.Equals("admin", StringComparison.OrdinalIgnoreCase) && password.Equals("api.admin")) //判断用户名及密码,实际可从数据库查询验证,可重写            {                return true;            }            return false;        }    }}

  

 2.在需要认证授权后才能访问的Controller中类或ACTION方法上添加上述定义的类HttpBasicAuthenticationFilter,也可在global文件中将该类添加到全局过滤器中,即可

测试方法很简单,第一种直接在浏览器中访问(同上),第二种采用HttpClient来调用WEB API,示例代码如下:

        public async static void TestLoginApi3()        {            HttpClient client = new HttpClient();            client.DefaultRequestHeaders.Authorization = CreateBasicHeader("admin", "api.admin");            var response = await client.GetAsync("http://localhost:11099/api/test/");            var r2 = await response.Content.ReadAsAsync<IEnumerable<string>>();            foreach (string item in r2)            {                Console.WriteLine("GetValues - Item Value:{0}", item);            }            response = await client.GetAsync("http://localhost:11099/api/test/8");            var r3 = await response.Content.ReadAsAsync<string>();            Console.WriteLine("GetValue - Item Value:{0}", r3);        }        public static AuthenticationHeaderValue CreateBasicHeader(string username, string password)        {            return new AuthenticationHeaderValue("Basic",                    Convert.ToBase64String(System.Text.ASCIIEncoding.ASCII.GetBytes(string.Format("{0}:{1}", username, password))));        }

实现Basic基础认证,除了通过继承自AuthorizationFilterAttribute来实现自定义的验证授权过滤器外,还可以通过继承自DelegatingHandler来实现自定义的消息处理管道类,具体的实现方式可参见园子里的这篇文章:

http://www.VEVb.com/CreateMyself/p/4857799.html

 第四种:Digest摘要认证

 1.定义一个继承自DelegatingHandler的HttpDigestAuthenticationHandler类,用于实现在消息管道中实现Digest摘要认证,同时定义该类所需关联或依赖的其它类,源代码如下:

using System;using System.Collections.Concurrent;using System.Net;using System.Net.Http;using System.Net.Http.Headers;using System.Security.Cryptography;using System.Security.Principal;using System.Text;using System.Threading;using System.Threading.Tasks;using System.Web;namespace WebApplication1.Models{    public class HttpDigestAuthenticationHandler : DelegatingHandler    {        protected async override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)        {            try            {                HttpRequestHeaders headers = request.Headers;                if (headers.Authorization != null)                {                    Header header = new Header(request.Headers.Authorization.Parameter, request.Method.Method);                    if (Nonce.IsValid(header.Nonce, header.NounceCounter))                    {                        string password = "www.zuowenjun.cn";//默认值                        //根据用户名获取正确的密码,实际情况应该从数据库查询                        if (header.UserName.Equals("admin", StringComparison.OrdinalIgnoreCase))                        {                            password = "api.admin";//这里模拟获取到的正确的密码                        }                        #region 计算正确的可授权的Hash值                        string ha1 = String.Format("{0}:{1}:{2}", header.UserName, header.Realm, password).Tomd5Hash();                        string ha2 = String.Format("{0}:{1}", header.Method, header.Uri).ToMD5Hash();                        string computedResponse = String.Format("{0}:{1}:{2}:{3}:{4}:{5}",                                            ha1, header.Nonce, header.NounceCounter, header.Cnonce, "auth", ha2).ToMD5Hash();                        #endregion                        if (String.CompareOrdinal(header.Response, computedResponse) == 0) //比较请求的Hash值与正确的可授权的Hash值是否相同,相则则表示验证通过,否则失败                        {                            // digest computed matches the value sent by client in the response field.                            // Looks like an authentic client! Create a principal.                            //    var claims = new List<Claim>                            //{                            //                new Claim(ClaimTypes.Name, header.UserName),                            //                new Claim(ClaimTypes.AuthenticationMethod, AuthenticationMethods.Password)                            //};                            //    ClaimsPrincipal principal = new ClaimsPrincipal(new[] { new ClaimsIdentity(claims, "Digest") });                            //    Thread.CurrentPrincipal = principal;                            //    if (HttpContext.Current != null)                            //        HttpContext.Current.User = principal;                            var principal = new GenericPrincipal(new GenericIdentity(header.UserName), null);                            Thread.CurrentPrincipal = principal;                            if (HttpContext.Current != null)                            {                                HttpContext.Current.User = principal;                            }                        }                    }                }                HttpResponseMessage response = await base.SendAsync(request, cancellationToken);                if (response.StatusCode == HttpStatusCode.Unauthorized)                {                    response.Headers.WwwAuthenticate.Add(new AuthenticationHeaderValue("Digest", Header.GetUnauthorizedResponseHeader(request).ToString()));                }                return response;            }            catch (Exception)            {                var response = request.CreateResponse(HttpStatusCode.Unauthorized);                response.Headers.WwwAuthenticate.Add(new AuthenticationHeaderValue("Digest", Header.GetUnauthorizedResponseHeader(request).ToString()));                return response;            }        }    }    public class Header    {        public Header() { }        public Header(string header, string method)        {            string keyValuePairs = header.Replace("/"", String.Empty);            foreach (string keyValuePair in keyValuePairs.Split(','))            {                int index = keyValuePair.IndexOf("=", System.StringComparison.Ordinal);                string key = keyValuePair.Substring(0, index).Trim();                string value = keyValuePair.Substring(index + 1).Trim();                switch (key)                {                    case "username": this.UserName = value; break;                    case "realm": this.Realm = value; break;                    case "nonce": this.Nonce = value; break;                    case "uri": this.Uri = value; break;                    case "nc": this.NounceCounter = value; break;                    case "cnonce": this.Cnonce = value; break;                    case "response": this.Response = value; break;                    case "method": this.Method = value; break;                }            }            if (String.IsNullOrEmpty(this.Method))                this.Method = method;        }        public string Cnonce { get; private set; }        public string Nonce { get; private set; }        public string Realm { get; private set; }        public string UserName { get; private set; }        public string Uri { get; private set; }        public string Response { get; private set; }        public string Method { get; private set; }        public string NounceCounter { get; private set; }        // This property is used by the handler to generate a        // nonce and get it ready to be packaged in the        // WWW-Authenticate header, as part of 401 response        public static Header GetUnauthorizedResponseHeader(HttpRequestMessage request)        {            var host = request.RequestUri.DnsSafeHost;            return new Header()            {                Realm = host,                Nonce = WebApplication1.Models.Nonce.Generate()            };        }        public override string ToString()        {            StringBuilder header = new StringBuilder();            header.AppendFormat("realm=/"{0}/"", Realm);            header.AppendFormat(",nonce=/"{0}/"", Nonce);            header.AppendFormat(",qop=/"{0}/"", "auth");            return header.ToString();        }    }    public class Nonce    {        private static ConcurrentDictionary<string, Tuple<int, DateTime>>        nonces = new ConcurrentDictionary<string, Tuple<int, DateTime>>();        public static string Generate()        {            byte[] bytes = new byte[16];            using (var rngProvider = new RNGCryptoServiceProvider())            {                rngProvider.GetBytes(bytes);            }            string nonce = bytes.ToMD5Hash();            nonces.TryAdd(nonce, new Tuple<int, DateTime>(0, DateTime.Now.AddMinutes(10)));            return nonce;        }        public static bool IsValid(string nonce, string nonceCount)        {            Tuple<int, DateTime> cachedNonce = null;            //nonces.TryGetValue(nonce, out cachedNonce);            nonces.TryRemove(nonce, out cachedNonce);//每个nonce只允许使用一次            if (cachedNonce != null) // nonce is found            {                // nonce count is greater than the one in record                if (Int32.Parse(nonceCount) > cachedNonce.Item1)                {                    // nonce has not expired yet                    if (cachedNonce.Item2 > DateTime.Now)                    {                        // update the dictionary to reflect the nonce count just received in this request                        //nonces[nonce] = new Tuple<int, DateTime>(Int32.Parse(nonceCount), cachedNonce.Item2);                        // Every thing looks ok - server nonce is fresh and nonce count seems to be                         // incremented. Does not look like replay.                        return true;                    }                }            }            return false;        }    }}

 

using System.Linq;using System.Security.Cryptography;using System.Text;namespace WebApplication1.Models{    public static class HashHelper    {        public static string ToMD5Hash(this byte[] bytes)        {            StringBuilder hash = new StringBuilder();            MD5 md5 = MD5.Create();            md5.ComputeHash(bytes)                  .ToList()                  .ForEach(b => hash.AppendFormat("{0:x2}", b));            return hash.ToString();        }        public static string ToMD5Hash(this string inputString)        {            return Encoding.UTF8.GetBytes(inputString).ToMD5Hash();        }    }}

2.将上述自定义的HttpDigestAuthenticationHandler类添加到全局消息处理管道中,代码如下:

    public static class WebApiConfig    {        public static void Register(HttpConfiguration config)        {            config.MapHttpAttributeRoutes();            config.Routes.MapHttpRoute(                name: "DefaultApi",                routeTemplate: "api/{controller}/{id}",                defaults: new { id = RouteParameter.Optional }            );            config.MessageHandlers.Add(new HttpDigestAuthenticationHandler());//添加到消息处理管道中        }    }

3.在需要认证授权后才能访问的Controller中类或ACTION方法上添加Authorize特性即可。

测试方法很简单,第一种直接在浏览器中访问(同上),第二种采用HttpClient来调用WEB API,示例代码如下:

        public async static void TestLoginApi4()        {            HttpClientHandler handler = new HttpClientHandler();            handler.ClientCertificateOptions = ClientCertificateOption.Manual;            handler.Credentials = new NetworkCredential("admin", "api.admin");            HttpClient client = new HttpClient(handler);            var response = await client.GetAsync("http://localhost:11099/api/test/");            var r2 = await response.Content.ReadAsAsync<IEnumerable<string>>();            foreach (string item in r2)            {                Console.WriteLine("GetValues - Item Value:{0}", item);            }            response = await client.GetAsync("http://localhost:11099/api/test/8");            var r3 = await response.Content.ReadAsAsync<string>();            Console.WriteLine("GetValue - Item Value:{0}", r3);        }

该实现方法,参考了该篇文章:http://zrj-software.VEvb.com/blog/2163487

实现Digest摘要认证,除了上述通过继承自DelegatingHandler来实现自定义的消息处理管道类外,也可以通过继承自AuthorizationFilterAttribute来实现自定义的验证授权过滤器,Basic基础认证与Digest摘要认证流程基本相同,区别在于:Basic是将密码直接base64编码(明文),而Digest是用MD5进行加密后传输,所以两者实现认证方式上,也基本相同。

最后说明一下,WEB SERVICE、WCF、WEB API实现身份验证的方法有很多,每种方法都有他所适用的场景,我这个系列文章仅是列举一些常见的实见身份验证的方法,一是给自己复习并备忘,二是给大家以参考,文中可能有不足之处,若发现问题,可以在下面评论指出,谢谢!


发表评论 共有条评论
用户名: 密码:
验证码: 匿名发表