一沙框架(YiShaAdmin) -WebAPI添加身份认证

最新推荐文章于 2024-09-13 22:20:47 发布

6.Qiang

最新推荐文章于 2024-09-13 22:20:47 发布

阅读量5k

点赞数 1

分类专栏： YiShaAdmin 文章标签： c#

本文链接：https://blog.csdn.net/shiyiyuedeliuye/article/details/122263803

版权

YiShaAdmin 专栏收录该内容

2 篇文章 2 订阅

订阅专栏

记录YiShaAdmin webAPI站点添加身份认证功能。

从Github 下载下来代码发现API身份认证功能貌似没有写完，所以补充这个功能。

没有身份认证时，不用输入token 可以任意调用api接口，显然不符合常理。

接下来进行改造，三步走：

设置Authorization header
修改AuthorizeFilterAttribute
API接口授权

具体如下：

设置Authorization header

StartUp.cs文件ConfigureServices方法增加如下代码

#region Auth
            //Bearer 的scheme定义
            var securityScheme = new OpenApiSecurityScheme()
            {
                Description = "JWT Authorization header using the  scheme. Example: \"Authorization: {token}\"",
                Name = "Authorization",
                In = ParameterLocation.Header,
                Type = SecuritySchemeType.ApiKey,
                Scheme = "",
                BearerFormat = "JWT"
            };
            var securityRequirement = new OpenApiSecurityRequirement
                        {
                        {
                                new OpenApiSecurityScheme
                                {
                                    Reference = new OpenApiReference
                                    {
                                        Type = ReferenceType.SecurityScheme,
                                        Id = "token"
                                    }
                                },
                                new string[] {}
                        }
                    };

 #endregion

修改Swagger注入

	 services.AddSwaggerGen(options =>
	            {
	                var xmlPath = Path.Combine(AppContext.BaseDirectory, $"{Assembly.GetExecutingAssembly().GetName().Name}.xml");
	                options.SwaggerDoc("v1", new OpenApiInfo { Title = "YiSha Api", Version = "v1" });
	                options.IncludeXmlComments(xmlPath, true);
	
	                options.AddSecurityDefinition("token", securityScheme);
	                options.AddSecurityRequirement(securityRequirement);
	            });

重新运行项目会发现Authorize在Swagger上已生效

2. 修改AuthorizeFilterAttribute

AuthorizeFilterAttribute.cs文件添加如下代码

	private static readonly MenuAuthorizeBLL menuAuthorizeBLL = new MenuAuthorizeBLL();
        private static readonly MenuBLL menuBLL = new MenuBLL();

OnActionExecutionAsync方法在sw.Start();和sw.Stop();间修改代码如下：

	ActionExecutedContext resultContext = null;
	            string token = context.HttpContext.Request.Headers["Authorization"].ParseToString();
	
	            var actionName = context.ActionDescriptor.RouteValues["action"];
	
	            OperatorInfo user = await Operator.Instance.Current(token);
	            if (user != null)
	            {
	
	                #region 验证权限
	                var temp = await menuAuthorizeBLL.GetAuthorizeList(user);
	                // 获取当前请求的URL
	                var url = context.HttpContext.Request.Path.ToString();
	                var menu = menuBLL.GetEntity(url);
	                if (menu != null && menu.Result.Data != null)
	                {
	                    var menuid = menu.Result.Data.Id;
	                    var t = temp.Data.Where(w => w.MenuId == menuid).Any();
	                    if (t)
	                    {
	                        //有授权
	                    }
	                    else
	                    {
	                        //未授权
	                        //context.HttpContext.Response.StatusCode = 401;
	                        TData obj = new TData();
	                        obj.Tag = 0;
	                        obj.Message = "抱歉，您没有权限";
	                        context.Result = new JsonResult(obj);
	                        return;
	                    }
	                }
	                else
	                {
	                    //未授权
	                    //context.HttpContext.Response.StatusCode = 401;
	                    TData obj = new TData();
	                    obj.Tag = 0;
	                    obj.Message = "抱歉，您没有权限";
	                    context.Result = new JsonResult(obj);
	                    return;
	                }
	                #endregion
	       resultContext = await next();
	                // 根据传入的Token，设置CustomerId
	                if (context.ActionArguments != null && context.ActionArguments.Count > 0)
	                {
	                    PropertyInfo property = context.ActionArguments.FirstOrDefault().Value.GetType().GetProperty("Token");
	                    if (property != null)
	                    {
	                        property.SetValue(context.ActionArguments.FirstOrDefault().Value, token, null);
	                    }
	                    switch (context.HttpContext.Request.Method.ToUpper())
	                    {
	                        case "GET":
	                            break;
	
	                        case "POST":
	                            property = context.ActionArguments.FirstOrDefault().Value.GetType().GetProperty("CustomerId");
	                            if (property != null)
	                            {
	                                property.SetValue(context.ActionArguments.FirstOrDefault().Value, user.UserId, null);
	                            }
	                            break;
	                    }
	                }
	            }
	            else
	            {
	                if (IgnoreToken.Contains(actionName))
	                {
	                    resultContext = await next();
	                }
	                else
	                {
	                    context.HttpContext.Response.StatusCode = 401;
	                    return;
	                }
	
	            }

验证一下直接请求接口，返回401 符合预期