Asp.Net WebApi身份认证ticket（随手笔记）

a.授权配置

a1.命名空间引用

• System.Web.Http
• System.Web.Http.Controllers
• System.Web.Security

a2.身份认证授权配置

/// <summary>
/// 身份认证配置
/// </summary>
public class CommonBasicAuthorize: AuthorizeAttribute
{
    /// <summary>
    /// 接收身份票据 2020-11-09 09:10 abel
    /// </summary>
    /// <param name="actionContext">请求操作上下文</param>
    public override void OnAuthorization(HttpActionContext actionContext)
    {
        //1.从当前请求中获取HTTP内容包含的用户代理的身份认证信息
        var userAuthorization = actionContext.Request.Headers.Authorization;

        //2.判断用户代理的身份认证信息是否有数据；如果有（解密ticket），如果没有（走允许匿名访问）
        if (userAuthorization != null && userAuthorization.Parameter != null)
        {
            //3.验证用户代理的身份认证信息的凭据
            if (CheckTicket(userAuthorization.Parameter))
                //4.1如果认证通过，则让当前请求获得授权(如果控件已获得授权，则为：true；否则为：false)
                base.IsAuthorized(actionContext);
            else
                //4.2认证没有被通过授权(拒绝访问：401)
                HandleUnauthorizedRequest(actionContext);
        }
        else
        {
            var attributeList = actionContext.ActionDescriptor.GetCustomAttributes<AllowAnonymousAttribute>().OfType<AllowAnonymousAttribute>();
            //1.判断每一个元素是否允许匿名特性（也就是说请求接口是否设置成匿名访问:[AllowAnonymous]）
            bool allowAnonymous = attributeList.Any(attribute => attribute is AllowAnonymousAttribute);
            if (allowAnonymous)
                //2.1如果确实有匿名特性，则认证通过
                base.OnAuthorization(actionContext);
            else
                //2.2没有匿名特性不通过授权(拒绝访问：401)
                HandleUnauthorizedRequest(actionContext);
        }
    }

    /// <summary>
    ///验证票据信息中用户名和密码是否正确 2020-11-09 09:22 abel
    /// </summary>
    /// <param name="ticket">加密后的票据信息</param>
    /// <returns></returns>
    private bool CheckTicket(string ticket)
    {
        //1.先解密ticket
        var userData = FormsAuthentication.Decrypt(ticket).UserData;
        //2.从解密后的字符串中获取用户名和密码
        int p = userData.IndexOf("&");
        string userName = userData.Substring(0, p);
        string userPwd = userData.Substring(p + 1);
        //3.到数据库中查询是否能够找到用户信息
        return true;
    }
}

b.获取授权

b1.用户登陆，返回ticket接口

 /// <summary>
 /// 登陆
 /// </summary>
 public class LoginController : ApiController
 {
     /// <summary>
     /// 用户登陆接口 2020-11-09 11:32 abel
     /// </summary>
     /// <returns></returns>
     [AllowAnonymous] //跳过身份验证
     [HttpPost]
     public object UserLogin() 
     {
         object encryptTicket = new { };
         try
         {
             HttpContextBase context = (HttpContextBase)Request.Properties["MS_HttpContext"];//获取传统context     
             HttpRequestBase request = context.Request;//定义传统request对象
             string UserCode = request["UserCode"].ToString();

             //1.生成身份验证票据
             FormsAuthenticationTicket userTicket = new FormsAuthenticationTicket(0, "UserName", DateTime.Now, DateTime.Now.AddHours(1), true, string.Format("{0}&{1}", "UserName", "UserPwd"), FormsAuthentication.FormsCookiePath);
             //2.将身份票据返回
             encryptTicket = new { Success = true, Ticket = FormsAuthentication.Encrypt(userTicket), Msg = "获取成功" };
         }
         catch (Exception)
         {
             encryptTicket = new { Success = false, Msg = "出现异常" };
         }

         return encryptTicket;
     }
 }

b2.前端请求ticket

$.ajax({
     url: "/api/Login/UserLogin",
     type: "post",
     data: {
         UserCode: "620915"
     },
     success: function (data) {
         if (data.Success == true) {
             userTicket = data.Ticket;
         }
     }
 });

c.携带ticket，请求数据

c1.需要授权认证的数据接口

/// <summary>
/// 测试授权认证特性的控制器
/// </summary>
[CommonBasicAuthorize]
public class StudentController : ApiController
{
    /// <summary>
    /// 查询学生数据 2020-11-09 13:23 abel
    /// </summary>
    /// <returns></returns>
    //[AllowAnonymous] //匿名验证
    [HttpPost]
    public object GetSearchStudentData() 
    {
        object json = new { };

        try
        {
            HttpContextBase context = (HttpContextBase)Request.Properties["MS_HttpContext"];//获取传统context     
            HttpRequestBase request = context.Request;//定义传统request对象
            int UserCode = int.Parse(request["UserCode"].ToString());
            DataTable dt = CreateStudent_Dt();
            for (int i = 0; i < 10; i++)
            {
                DataRow dataRow = dt.NewRow();
                dataRow["Stu_ID"] = i + 1;
                dataRow["UserCode"] = UserCode;
                dataRow["Stu_Name"] = "张三";
                dataRow["Stu_Age"] = 18 + i;
                dt.Rows.Add(dataRow);
            }

            json = new { Success = true, data = dt, Msg = "查询成功" };
        }
        catch (Exception)
        {
            json = new { Success = false, Msg = "出现异常" };
        }
        return json;
    }

    public DataTable CreateStudent_Dt()
    {
        using (DataTable dt = new DataTable())
        {
            dt.Columns.Add("Stu_ID", typeof(int));
            dt.Columns.Add("UserCode", typeof(int));
            dt.Columns.Add("Stu_Name", typeof(string));
            dt.Columns.Add("Stu_Age", typeof(string));
            return dt;
        }
    }
}

c2.请求数据

$.ajax({
    url: "/api/Student/GetSearchStudentData",
    type: "post",
    data: {
        UserCode: "620915"
    },
    beforeSend: function (xmlHttpRequest) {
        xmlHttpRequest.setRequestHeader("Authorization", "BasicAuthorize " + userTicket); //异步请求之前向Http的head里面加入票据信息
    },
    success: function (Result) {
        console.log(Result);
    },
    error: function (XHR) {
        var status = JSON.stringify(XHR.status);
        if (status == 400) {
            alert("错误请求，如语法错误");
        } else if (status == 401) {
            alert("请求授权失败");
        } else if (status == 403) {
            alert("请求不允许");
        } else if (status == 404) {
            alert("没有发现文件、查询或URL");
        } else if (status == 500) {
            alert("服务器产生内部错误");
        } else {
            alert("出现异常:" + JSON.stringify(XHR));
        }
    }
});

c3.注意

• [CommonBasicAuthorize] 声明控制器需要携带身份认证才能正常访问
• [AllowAnonymous] 声明当前接口可以跳过身份验证直接访问接口(匿名验证)