I have a web API that utilizes role authorization ( ex: [Authorize(Roles="test")] ) for each controller and action.
我有一个Web API,它为每个控制器和操作使用角色授权(例如:[Authorize(Roles =“test”)])。
This API is meant to be a stand alone app with no actual MVC site for it, so there is no login method.
此API旨在成为一个独立的应用程序,没有实际的MVC站点,因此没有登录方法。
So let's say I have a separate "Students" app that needs to display a list of all current students in the school. In the API, I have a role-based authorized method that retrieves all current students from the database. How would I be able to call that API call from the "Students" app (which is on the same domain) if it's authorized?
所以,假设我有一个单独的“学生”应用程序,需要显示学校所有当前学生的列表。在API中,我有一个基于角色的授权方法,可以从数据库中检索所有当前学生。如果获得授权,我如何能够从“学生”应用程序(位于同一域中)调用该API调用?
Is there anyway I can spoof the "Students" app to run under one of the authorized roles? I don't want to use the roles of the user using the site because only Admins are allowed to execute these API calls.
反正我是否可以欺骗“学生”应用程序在其中一个授权角色下运行?我不想使用使用该站点的用户的角色,因为只允许管理员执行这些API调用。
1 个解决方案
#1
0
Look at this tutorial on building an OAuth 2 authorization server. You can use the Authorization Code Grant to authenticate your Students MVC app against your API.
查看本教程,了解如何构建OAuth 2授权服务器。您可以使用授权代码授权来针对您的API验证您的Students MVC应用。
Building an OAuth server is not a simple task, however. You can look at a complete and secure open source product like IdentityServer to help you implement most of the authorization and authentication logic.
但是,构建OAuth服务器并不是一项简单的任务。您可以查看完整且安全的开源产品(如IdentityServer),以帮助您实现大多数授权和身份验证逻辑。
#1
0
Look at this tutorial on building an OAuth 2 authorization server. You can use the Authorization Code Grant to authenticate your Students MVC app against your API.
查看本教程,了解如何构建OAuth 2授权服务器。您可以使用授权代码授权来针对您的API验证您的Students MVC应用。
Building an OAuth server is not a simple task, however. You can look at a complete and secure open source product like IdentityServer to help you implement most of the authorization and authentication logic.
但是,构建OAuth服务器并不是一项简单的任务。您可以查看完整且安全的开源产品(如IdentityServer),以帮助您实现大多数授权和身份验证逻辑。