利用DelegatingHandler实现Web Api 的Api key校验

最新推荐文章于 2021-12-17 21:56:35 发布

hzm326

最新推荐文章于 2021-12-17 21:56:35 发布

阅读量120

点赞数

文章标签： redis http json java python

本文链接：https://blog.csdn.net/u014712365/article/details/117684619

版权

本文介绍了如何在WebApi中通过两种方式安全地传递APIkey：一种是通过Querystring，另一种是通过Requestheader。并展示了如何实现一个ApiKeyHandler中间件进行验证，以及如何将该中间件配置到特定路由。这种方法增强了API的安全性。

摘要由CSDN通过智能技术生成

客户端在请求Web Api时可以有以下两种方式提供API key

基于Querystring提供Api key

http://localhost:57967/Api/Values?key=12345
基于Request header体统API key

client.BaseAddress =new Uri(url);
client.DefaultRequestHeaders.Accept.Clear();
client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
client.DefaultRequestHeaders.Add("X-ApiKey","00000");

编写ApiKeyHandler

public class ApiKeyHandler : DelegatingHandler
    {
        public string Key { get; set; } public ApiKeyHandler(string key,HttpConfiguration httpConfiguration) { this.Key = key; InnerHandler = new HttpControllerDispatcher(httpConfiguration); } protected override Task<HttpResponseMessage> SendAsync( HttpRequestMessage request, CancellationToken cancellationToken) { if (!ValidateKey(request)) { var response = new HttpResponseMessage(HttpStatusCode.Forbidden); var tsc = new TaskCompletionSource<HttpResponseMessage>(); tsc.SetResult(response); return tsc.Task; } return base.SendAsync(request, cancellationToken); } private bool ValidateKey(HttpRequestMessage message) { IEnumerable<string> apiKeyHeaderValues = null; if (message.Headers.TryGetValues("X-ApiKey", out apiKeyHeaderValues)) { var apiKeyHeaderValue = apiKeyHeaderValues.First(); return (apiKeyHeaderValue == this.Key) // ... your authentication logic here ... /* var username = (apiKeyHeaderValue == "00000" ? "Maarten" : "OtherUser"); var usernameClaim = new Claim(ClaimTypes.Name, username); var identity = new ClaimsIdentity(new[] { usernameClaim }, "ApiKey"); var principal = new ClaimsPrincipal(identity); Thread.CurrentPrincipal = principal; */ } /* var query = message.RequestUri.ParseQueryString(); string key = query["key"]; return (key == this.Key); */ }

配置到特定的路由上去

config.Routes.MapHttpRoute(
                name: "DefaultApi",
                routeTemplate: "api/{controller}/{id}", defaults: new { id = RouteParameter.Optional }, constraints: null, handler: new ApiKeyHandler("12345", GlobalConfiguration.Configuration) );