ASP.NET WEBAPI 的身份验证和授权

时间：2023-03-08 17:55:47

定义

身份验证（Authentication）：确定用户是谁。

授权(Authorization)：确定用户能做什么，不能做什么。

身份验证

WebApi 假定身份验证发生在宿主程序称中。对于 web-hosting，宿主是 IIS。这种情况下使用 HTTP Module 进行验证。

验证时，宿主会创建一个表示安全上下文的主体对象（实现 IPrincipal），将它附加到当前线程。主体对象包含一个存储用户信息的 Identity 对象。若验证成功，Identity.IsAuthenticated 属性将返回 true。

HTTP 消息处理程序（HTTP Message Handler）

可以用 HTTP 消息处理程序代替宿主进行身份验证。这种情况下，由 HTTP 消息处理程序检查请求并设置主体对象。

请考虑以下事项决定是否使用消息处理程序进行身份验证：

  • HTTP 模块检查所有经过 asp.net 管道的请求，消息处理程序只检查路由到 WebAPI的请求。
  • 可以为每个路由单独设置消息处理程序。
  • HTTP 模块仅在 IIS 中可用。消息处理程序则与宿主无关，在 web-hosting 和 self-hosting 中均可用。
  • HTTP 模块参与IIS 日志和审计等功能。
  • HTTP模块在管道之前运行，主体在消息处理程序运行之前不会设置，当响应离开 消息处理程序时，主体会恢复成原来的那个。

一般来说，不需要自承载时，HTTP 模块较好。

设置主体

进行自定义身份验证时，应在两个地方设置主体对象：

  • Thread.CurrentPrincipal，这是 .net 中设置线程主体的标准方式。
  • HttpContext.Current.User 这是特定于 ASP.NET 的属性。
private void SetPrincipal(IPrincipal principal)

{

    Thread.CurrentPrincipal = principal;

    if (HttpContext.Current != null)

    {

        HttpContext.Current.User = principal;

    }

}

采用 web-hosting 时，必须同时设置两处，避免安全上下文不一致。对于 self-hosting，HttpContext.Current 为 null，所以设置之前应进行检查。

授权

授权发生在管道中更接近 controller 的位置。

  • 授权筛选器（Authorization filter）在 action 之前运行。若请求未授权，返回错误，action 不运行。
  • 在 action 内部，可以用 ApiController.User 属性获取主体对象，做进一步的控制。

aaarticlea/png;base64,iVBORw0KGgoAAAANSUhEUgAAAogAAAB9CAIAAACu6wVuAAAeG0lEQVR4nO2dT2wUV57Hu9potdIePDunPRO1YaQhszciYTOHvQEHt420240i7aadC4hAlHa0rIHszmC3wRwW3LaUIcvgGAMBQtwNwwZkYzOJIxyXmXiHOG4HzwIOjcExJLQjJMJ07+G7/OZRVd1u466uLvr70+fg+vde1XtV9an3p8Hz+Mcn848eE0LKisc/PslYBV8IhDjL4x+feOYfPb734AdCSFkx/+ixpZj5QiDEWeYfPaaYCSlHKGZCShOKmZAyhWImpDShmAkpUyhmQkoTipmQMoViJqQ0oZgJKVMoZkJKE4qZkDKFYiakNKGYCSlTKGZCShOK2TEOtHecv9D/fMf2Xx7qOXHKjrMaGr56oL1jiYlcv5mM7G27fjPpeCGTHFDMtnIw2rnEB/zu/fklnsCnV0aXeBVnYuc+7D27xDMhi4VidobRsfE3tm0PBAJ57n/9ZlI18Ye9ZyN72wp1JurrY3pm7trE1HOk82HvWfXA0bFxxwuZ5IZito/RsfFt298MBAJ5Ku36zeSxD07Lzmdi5yJ725aow2sTU9Mzc4s9qv/yZ0PDV9UT4xd28aGYneHQ4SPnL/S/sW27+gzkYHRsXLV4AcVcqKQCgQBl7C4oZvt477dd5y/0b9v+Zp5t1tGx8WAwWFgxPx+t+/aziew4FLMzBAIBNIIPHT4iK69NTKmOlMX+y0NNO3cHAoHI3jasgU2vTUwdaO+I7G3rvzykJn7+Qj/2VNdjfxx46PARfEr3nDiFhntkbxta5IZO8v7LQ8ii58QpHDI6Nn7o8JHI3rYD7R1oIuM8A4FA087dyMVwIXLIocNHVHn3nDjVf3loaPiqmhopGhSzfQSDwa9v3O754PShw0dEctcmplr37Tcv9l8e2rnrHXnA796fh5j/+NX1g9HOyN62vsFP1cTVp/LrG7fV1HAIusGxeO/BD8c+OI2UwYH2jrv356dn5s5f6I/s3R/Z2yYmbt23PxAMvrFt+9NM5499cLr/8hC2Ts/M/ffFS6379kf2tv3u475bd75Vs75159v3ftulpkaeG4rZASDaew9+uDYxFQgEpLvJ0CyWxes3k+cv9KNJCrF92Hv2jW3bD7R3oCM6EAiIg6HAoeGrQ8NXm3bu/rD3LNbjsT9/oX90bLxp5245gUOHjzTt3D06Ng4vqg3onhOnkPLo2Djyuvd0aHx0bBxbp2fmpmfmcKpYL4tysZLIh71nA4GAdBJE9rY17dzdc+IUzI2PFcdrp3ygmG0Cor17f/7axFQwGBSBGZrFsogHPBgM6l98iafsTOzctu1vHmjv0L/4EpvEze/9tqtp5+5Pr4yOjo0fjHbiC0BS+8+D0U+vjOJZDgY36V98ee/BD9cmpvDqGBq+GgwGf/dx39378zj80yujQ8NXt21/8/RHcazcueudQ4eP6F98iYdRGtDTM3M7d72DUxoavrpz1ztNO3fjWtSskcXR4yfp5qVAMTuAOu3rjW3bxanZxGzeBMOJ0Q8dPoKWN3aT9UPDV+WoQCAgkr5+MykWNHRlyyI+GtRWrHm8Su2+Vv+Ws52emVM/Gu49/aTA39IBYC4KUgQoZptQp31t2/6mODWbmM2bzsTOqUZ/77ddaHljN2kl33vwQ+u+/eommBiImAU0nc3KVHvODV3ZsohvBVk/PTO3adOmvsFPzVlf+v1n27a/OTOXcrwi3AvFXGzgKmka9pw4JXJalJgtbQphS58VOsCxj2EMWBZzJGU59jw9M9d/eejD3rMH2jsWFLPhtA1r0OslmwyLxG4oZjuYnplT3am6cFFiVg0qi+axZ1nzNIW/6NAgZrRlValjbKvnxKlt299cUMzmsWdZg6zFxKNj48HgJop5KVDMxQY9zwZ3wtMFETP6pVWwT0HEjKY2DIrmOMXsXihmO0DPs+EBV3ubHRHz9MxcMLhJnYl27IPT6HM+f6Ef418Uc+lAMRcbGVUVZCQYvcey53OIGTO9LfNdrJgtk4L4LdO0FDOuSB05VnvXKWZnoZjtYOeudwwP+M5d70BgGHJeipj/++IltT/53oMfjn1wGpO5cov5YLQTu/1l66a/eDqfruyD0U51IhuuVIarKebCQjEXFbOo7j2rQEyhwt/oK5bd1BHfbDZFi1ZSmJ6Zk5lW2cScTflISgZ9MddaFTNmdUmamFmGv9U0m3bulpnn0zNz+C6RQyhmB6GYCw7Uq3YX33vwA343BaVh7hXWY+qWqC4YDGIS9b3sYr5+M6lOBEN28GsOMaMT+9adWfWsRMyY1SXZnYmdUxUuYkYicoaXfv9ZMBic/N9vJGuKuYBQzEWl58QptcUJoEBIF7aL7G17Y9t2TFSW3bDSsp9ZXUQK+OWSOgU6m5gx5i2+VJNC6xaZ4gxxqm9s2w7dqmnK8DamgMqZQ8aSiPpbLIrZWSjmgnPsg9MyV1mATaG0/stD6OjGA66KuXXffjwm5i5rdREylgfcNLPMKGZ0YiNl4e79eXRlR/buw+87DAPhkdZ9+LmU2oCGjFta9+GJFklTzAWHYi4qcJt5/ejYuKy/fjOJRfzuyLAb/H39ZlKdL21YxIHmY9Vp1eoi9scJGJLCntlOw5AmlCwJGi5cvUbL0shWOMQmKOaCU5wH/N7Tp1J9+ixTk18zWs47wZlMz8yZs5PEDVdk+W4xZG0+E7JYKGZCyhSKmZDShGImpEyhmAkpTShmQsoUipmQ0oRiJqRMoZgJKU0oZkLKFIqZkNKEYiakTKGYCSlNKGZCyhSKmZDShGImpEyhmAkpTShmQsoUipmQ0oRiJqRMoZgJKU0oZkLKFIqZkNKEYiakTKGYCSlNKGZCyhSKmZDShGImpEyhmAkpTShmQsoUipmQ0oRiJqRMoZgJKU0oZkLKFIqZkNLEWszxs+d6GCUQ8bPnzHXG2mEwGIwXIOJnz929P5+vmHt6ema/myGO09PTY64z1g4pCA9Ss/OP5sw8SM06fm6ElAPHjh2jmN0HxUzsg2ImxFkoZldCMRP7oJgJcRaK2ZVQzMQ+KGZCnIVidiUUM7EPipkQZ6GYXQnFTOyDYibEWShmV0IxE/ugmAlxForZlRRHzN3Hu7qPdzl+saTIUMyEOEsBxKy+vtdvWCfre8+d2fRqcP2Gda1tkRu3pxy/1BeJ/MXctGuHKtfec2e2bN0si1f0oU2vBrPl0toWaW2L5HM+3ce7DOlc0YfWb1gH1BugadeOK/qQ4wVIckAxE+IsBRCz+vr2eDz4o/Pd6OpXVveeO9M3eHHL1s19gxcdv9QXifzF3PluVFXmpleDHo9HNNnaFlE9bSB/MS9/afnyl5arxu0bvLj6ldV9gxf7Bi/i+wzr129Yx5uhxKGYCXEWu8TM96+t5C/maxNjUimooPUb1vWeOyPVJO1pMahsRc32njuzfsO6Ta8Gs7V04eDOd6Oq4/sGL6rdJ8tfWn5tYmyWN4YboJgJcRa7xNzaFln9ymr2YNvEosaYl7+0HK6FelWDSuu5b/Cix+PpPt7Ve+4MWrpSiU27dvQNXmxti6hNbZUtWzd3H+/CF4DsYBDz6ldWw+sUc+lDMRPiLHaJGeuXv7R8y9bN1HPBWZSYm3btaNq1A390vhu9og8tf2n57HczcDD22fRqUJrOMg7d2hZR5ao2poUbt6fEx2oiqpj7Bi8ix1mK2Q1QzIQ4i41inv1u5sbtKbS0ON+nsCxKzOhqnv1uZvUrq9GfjPHgpl07pOLWb1i3+pXVmKuFP2ZNY8yWQ87qtK/u411iejTBkZo6/Ewxlz4UMyHOYq+YgWH0kSydxf5cyuPxqM3WLVs3Y3ae6svOd6OYq9U3eBHrW9siaGoDtUEswLsyAVs+wtTJX+r+FHPpQzET4ix2ibn7eJf0YFPMBWexYt6ydfP6DeukFjCfS/2K2rJ1s+rg2ac1u/yl5ajHK/qQx+NBg1vAStE5xrCRjmGMWaCYSx+KmRBnsUvMTbt2SE+m9KCSQrFYMXcf7/J4PDJCjIFh9Wvpxu0pte0rLeYtWzdjJaaGGZI16xyqnqWY3QzFTIizFEDM1ybGxLvqO/faxJh0ipLCslgx37g91Td4UZ2Fd0UfMn8tXdGH+gYvynrULI61/LS6og+ZZ/Yhoxu3pyyr3vIQUlJQzIQ4C/9JTlfCfyub2AfFTIizUMyuhGIm9kExE+IsFLMroZiJfVDMhDgLxexKKGZiHxQzIc5CMbsSipnYB8VMiLNQzK6EYib2QTET4iwUsyuhmIl9UMyEOAvF7EooZmIfFDMhzkIxuxKKmdgHxUyIs1DMroRiJvZBMRPiLBSzK6GYiX1QzIQ4SzHEvOrlVR5GfrHq5VX5FGlxxMyKe+Fj1cur7j24Y6j3gov55V+87PSFMhYRq15edfd+sgj6+cXf/0LTNKcv15n4+aqfz8zddlLMHo8nw8gvPFb/obVTYmbFvfChaVoRxKxpWjqddvpaGflGRUVFccRcUVHx5MkTpy/XmVi2bNmdb7+hmN0RFDOjmEExM8xBMRchKGY3BcXMKGZQzAxzUMxFCIrZTUExM4oZFDPDHBRzEYJidlNQzIxiBsXMMAfFXISgmN0UFDOjmEExM8xBMRchKGY3BcXMKGZQzAxzUMxFCBeI2e/3JxIJdU0ikfD7/Uu88lgs5vf7BwYGzJt0XTdnmk/kc1Rzc3MsFltsygh3iTkWizU3Nxfw8iX8fn8oFLLcFA6HzZk6G/aVgzmpurq6iYmJgiSbKSUxDwwM1NXVPXz48PkuZOnFMjg42NDQsMQPiGQyWVdXd/v27aUkgkgkEnV1dX4lcIENDQ2XLl1Kp9PY4c9//vPS8zJESYk5mUy2tLSgKPbs2VOQsl1sbNy48auvvkqn0/F4vKWlpSBl7gIxezweXdfVNbquq0dFo1FVh4bFbBGNRj0ej6Xg/X6/OdN8Ip+j/H5/NBpdbMqSvlNifjc2cuvuMzfKghUXjUbNxatefiwWUz+MdF3v7u7Osxwsixo3xtI/2gobKAfDO72uru65bwNDqElpmjYyMlKQZDP2iNl8I+Uj5rq6Op/P9/777+epxng8rt5aXq93icWSSqWe40sd2lDP+TneKpah67rX6/3888/1p5FKpTKZTCKRwB/YAZLAk1WobomCi/k38ZGbMxYSWlDM8Xjc6/X++te/HhkZ0XW9paUlGo0+92V2dnZOTEw8x+HLli0bHh5Op9OdnZ11dXUFaeW/CGI27JCnU6PRaHV1tcfjMTxvyWQSL3eKWeWLr/+0671B9ZW6dDEbisJy/2zlUF1dbW40h8PhUChEMRck2Yw9YsaNdFO5kRYUczKZ1DStt7e3pqYmz/cmykR2XrqYny9UOxY5ZXWHjo6OAraeCy7mz659/auuT5Kzxjstt5gHBwcrKirGx8cL9cEhfn3uAynm/xcz+rTxmkY3smERa1KpVHNzs9/vD4fDyWQSieB1GQ6Hw+GwmjjWVFdXq5nGYjG88ZubmyUFRHd3N3pWcVY4ytB7qS6qNpITw+EL1pazXdkGNy9RzKgpn8/n9/tRPj6fD59EKCv00A4MDKDk1Y5fj8cTi8U8Ho9aF/iiQnXIykQiEQ6HDVWfTCZlpXyWYWjD7/dLq13XdewWCoXUrzf1dsKohzzMltktKGbLjHDrPnz4EJsMFleLRd2qitny7kJRDwwMGIrUMmzqyja4eUExHz16NBwOP3z40Ov1qn2VLS0t6iVgMZ1O19XVaZqGW6u3tzedTkPM8siriaBRi1LCzmpqOGRiYgLlJl3Eah/ypUuXUImNjY1IB73K8Xi8pqbG4/HU1tbiBsCxkoUcEg6H1e8GZI3ee0nNENnEXF9fj/1lh5aWlqqqKpzGnj17kHsikZCspTTkknP3/NvRld37yf9Ezwzfe7AIMa9cubK9vT3bnSNd3IZqjUQivb29AwMD9fX1oVAIXdCTk5P19fWapq1Zs8bv92Plxo0bP//888bGRnFtPB5vaGhAn/k333wjeWUTM4Y//H5/e3v7999/j5XmZC3D3WJOpVL4u7u7G505lot4B+m6HgqFfD4funrwyCUSCY/HgzVIEK97NVN4emBgACmoPgiFQtiEN50cZXCSuiiv0VQqVV1djZc7NLOgmx0fY1bdvEQx67oul59MJqE0fA9BTn6/H81iKR9RJsoqFAqpXz/RaDQcDquZJhIJn88XjUZ1XcfIxcOHD1OplKZpshIng+4T1GN1dbVULm6k5uZmHIta0zRNzgofE/Kyq6qqMmSXyUPMDQ0N5ox0XUdGOCtN0/bs2YP9u7u70YKUG7K9vR2bRMypVKqmpkbuLlkfjUZ9Ph/O3/CJaQ77xphVNy8o5qqqKsivoaEBdlTL0Lyo6zqufWRkBNfo9Xpra2vff/99bPL5fFBaIpHwer3t7e1SSqIudJ5jUyqVQqMznU7jrYJobGysqqrCO1cqsaWlRdO077//PplMHj16VNM0dDhnnrVpPB6XSoxGo5qm9ff3I+v6+vrq6uo9e/aMjIw0NjZqmqZqAJFNzOjfVneAg2tqakZGRvBkJRKJFStWtLe3j4yMdHR04GyRLy55ZGREXonmsGmM+TfxkVMDX6huziHmRCJRUVExPT1tuXVycrKiouLgwYMjIyOxWAzd3SgrQ9l6vd7p6elUKjU6OlpRUdHV1TUyMoIHcNmyZWvWrPnoo490XU+n02+//XZNTU1/f7+u66+//rrX67116xaysxRzPB5fsWIFDn/99df9fj/WG5LNVsjuEDNawBLoglZ3yNaVrbZiET6fD1/Z8gZXG0nS3pKjkIL6CsNnJm4OVeqqzvMRs2Gf5ubmbBOa1EtzVsyqm/MRM76K1PB4PHl2ZWN/WYQFpRzwZjTfBpZFjaiursarU1SayWRQfYZuDPO1aJqGmu3u7hZz46wkNUPvdE1NDe6rbOUgNjVkBINCzNKQisViVVVVyEjTNIgKga8Bw+GGr4GWlpZQKJROp+GAPGdR2Tr5S9ycW8yJRELTNLxV1ULIZBezeRPsi8VkMun1eqG6urq6cDisNmHFgmgWyyYRs5wY0oEFDWG2o6SPxVQq5fV61ZZcR0dHVVWVyMPv98tRK1asUPdUk0JbHIH9LbM2dGXX19erbc21a9di8N6Qb7awb/LXr7o+ufyHiXt5iBkezba1vr4+HA7LhWBnWNxwjStXrvzoo49QFIau7GXLlh08eBB7qikgNm7c+NZbb2GrWcypVEpNDYtffvllOp1Wk80R7hAz3qcS3d3dixKzmprZi+ob3+fzYc5INsWqa8ybFiVmv9+P3jYE/l6wKBwXs7xS/+qv/yb32aIZqj8b1dXV+YtZ3apWpZSzfGbFYjH4Uk3E8EmHbwI0ef3PziGAO7FVVqZSKfTsoVWK/S3PSnxpzi6fcjBkpIrZ4Aw0Bw0msxxjRoPPcHdBzObme7awe1Y2bqTcYm5paRF3wmfysbIoMat9xbJoHnuWNYYUzGJeu3atNK9xbvF4HJWIVnImu5jN7V11jUGchkV1f3Xyl5z/gmL2er3os0Vomob0LTMyh31ivnX3m3/7zcAfp24sUcwVFRWG0WJZg2s0fKMY/IpN6qJ58FhdYxYzTk/9bNI0DfvkOZLtDjHrzzv5Kx8xZ576eGBgwNAmy9gsZvQ0Siw47RNi3vXe4D/9+1mnidf/64ncZ7vEyV/5iFl8XF1dbegIyVh90qHnA4OvaMVKmctgBDLFhCOcw8DAQJ5itswud1e2ISNDi3kpYra8uxYl5n/4l0gRbqTcYvZ6veoXhqZpb731lqV9iynmjo6Ompoaeb+j9VxbW9ve3j4wMLBgi7lQYs6nKztjJeauri7zjZq/mP/xnZh9t8Q/N//u7oM7ucWcTCZzzPwqETEPDw+rhSw95BSzhZjRn5l59g2O79xQKCQvOEmku7tbbI2QPme0hCxP1TAFyVLMoVDIMO9swSidFnO4o/9v/2557rMtrJhhR0M5Y04A+pPVqQOyW475TalUym/6PTRymZiYMFSudGX7n85NQxjE3Nvbm60csokZGcnWPMWs9kVbirmhoUHtpM19MtmiCC3mxo7+HGKWLxV5u2F8XYZ1ly5mtZcYLfKvvvrKnIIqZoxMYzfZqnp6QTEjBXXkeHBwsJhilv5bNUqhxbz7vwb/MPmn2YVazJlM5pe//OVrr71m2SdcUVGhXmAqlRKLP5+Yjx49umLFCvVkIpFIQ0NDtq5sDHLLILQaZSRmvzJIbFjEnvLaUqfyqm9wvN/VAWPJFCPH8n7HuDK6uw2b0AjDUdgNbZRUKqV2U4tvcDLqLNw8W8zOivnj4fEd7w5M3Z5e+s+l8D0km8zVKjWCiXJiRPWWQLHLJjXTcDgsc/1Q4IZylm8sqUR0dBvErE7Nw9+Yswq1i5iRnShT0sxfzOosrWxizmQyVVVVIl2oyzz5C0nJ3Fq56tIRM26k67enc4jZ8vMCNs1kMkePHq2qqkKBYyhavNLR0YExdTnEUswtLS01NTVSZY2NjVIXOcS8du1ag8BUMWNWl4w9qwpXZbl27Vq1i17tGC+4mA07q3PWcMKW+WYLm8RssPKCYpYZXnLCyWRS1/V0Oh2JRGpqar777jusx7wtJJVDzBs3blR/KK8aFA30M2fOYBFZ9/X1GQan1Wb0z372s9dee03OXwq5jMQsk2vk1SOL2BPTfTFlzPC6lEQMv5tSM4VlMXxoaIThNY3EVTEjQZwGJsGaxZx5KhW/319dXe3z+RacJeu4mLs+vtp2fOjOt3fyqbgFxawrc+YzTz+PRMBozuKbBruZP5syTz+PDL9Nwt8iTnUIH29wKXPcM2pGyB09zD6fD1PHs9Us/pbXqyE7rM+nK1vNaEEx4xKkg1cdrlbni2F6sFwpfhVTImLGjZT89s5s9lnZaL+q09wQjY2NkC5mnqMc8AyKV1BctbW16s+lJAV1EdOea2trkY5IOpuYMY1ZHT7s7e1FV7ZUoipmGexHb4cIEjLGJnU2eMYGMaMk16xZg1xSqRR+HSRXbdlSzxZ2iNls5QXFnMlkJicnV6xY4Xn6gzRN00SWb7/9NgYXqqqqamtr5Sskh5g7OztxCH4uZTAoZIyxeU3TRNKZLGKenJxcuXKlz+erra3VNE0mfL04Ytaf/qM2EvjFgroGDjYv6sovng3p4Cc6aprqVnOm6EkzT9nFZxrEYNhBMlXzSiQShl/f6nmMLiMcFPOdb++0HR/q+vhq/hVnKOEcl6/+XE0KEwrHGkM65qrMkSlqQd3HMk3zHYKMsFu2mtWfneNtmV0+5WDOyHCTWy7Kr18kKXPJGK7U8mSyhR1ivvPtnf3P3kg5xGx4zNWLUotOuqmy3VqGYlmwlCxTk9LWnw218C3vFlmf7cVl+CI3ZG1YzF04ue8fQ7LmNQu2DTI2iNnSyvmIGYHq002/PpJqVddPTk6q12helHRGR0fNP14YHR2V0WJ1JdbgJlGzM+9vmaw5XCDmpYR5jNnV4aCY/+PIJx8Pjxet4jJL+yfSihNoIi92ooCLwg4x/8p0I/E/sXBXFFzMrUc/NVs5fzG/kEExuykc78qmmPEPciE8Hk8oFMrxTzG4PUrnP7FglE6U1H9i8aLGCy7mbB0+Lo2yEnOeHWvFD+k6K83TK2BQzAxzUMxFiBdczC9YlJWYGY4HxcwwB8VchKCY3RQUM6OYQTEzzEExFyEoZjcFxcwoZlDMDHNQzEUIitlNQTEzihkUM8McFHMRgmJ2U1DMjGIGxcwwB8VchKCY3RQUM6OYQTEzzEExFyEoZjcFxcwoZlDMDHNQzEUI58VcWVnpYeQXlZWVpSNmVtwLH5WVlUUQ809+8hOnL5SxiKisrCyOmH/60586fa2ORWVlpcNiJgWnOGIm5UnBxUwIWRQUsyuhmIl9UMyEOAvF7EooZmIfFDMhzkIxuxKKmdgHxUyIs1DMroRiJvZBMRPiLBSzK6GYiX1QzIQ4C8XsSihmYh8UMyHOQjG7EoqZ2AfFTIizUMyuhGIm9kExE+IsFLMroZiJfVDMhDgLxexKKGZiHxQzIc5CMbsSipnYB8VMiLNQzK6EYib2QTET4iwUsyuhmIl9UMyEOMvixHzy5MkeRgnEyZMnzXXG2mEwGIwXIE6ePLkIMRNCXnjmHz22/K/d+UIgxFkoZkLKFIqZkNKEYiakTKGYCSlNKGZCyhSKmZDShGImpEyhmAkpTShmQsoUipmQ0oRiJqRMoZgJKU0oZkLKFIqZkNKEYiakTKGYCSlNKGZCyhSKmZDSZP7RY8/jH5/MP3pMCCkrHv/4xFLMfCEQ4iyPf3zyf/khoi/dyJ68AAAAAElFTkSuQmCC" alt="" />

[Authorize] 属性

AuthorizeAttribute 是内置的授权筛选器。用户未通过身份验证时，它返回 HTTP 401 状态码。可以在全局，控制和 action 三个级别应用它。

在全局级别应用：

public static void Register(HttpConfiguration config)

{

    config.Filters.Add(new AuthorizeAttribute());

}

在控制器级别应用：

[Authorize]

public class ValuesController : ApiController

{

    public HttpResponseMessage Get(int id) { ... }

    public HttpResponseMessage Post() { ... }

}

在 Action 级别应用：

public class ValuesController : ApiController

{

    public HttpResponseMessage Get() { ... }

    [Authorize]

    public HttpResponseMessage Post() { ... }

}

在控制器上应用 [Authorize] 时，可以在 Action 上应用 [AllowAnonymous] 取消对某个 Action 的授权要求。上面的代码可以改成下面的形式：

[Authorize]

public class ValuesController : ApiController

{

    [AllowAnonymous]

    public HttpResponseMessage Get() { ... }

    public HttpResponseMessage Post() { ... }

}

指定用户和角色进行限制：

// 按用户限制访问

[Authorize(Users="Alice,Bob")]

public class ValuesController : ApiController

{

}

// 按角色限制访问

[Authorize(Roles="Administrators")]

public class ValuesController : ApiController

{

}

用于 WebAPI 的 AuthorizeAttribute 位于 System.Web.Http 命名空间。在 System.Web.Mvc 命名空间中有一个同名属性，不可用于 WebAPI。

自定义授权筛选器

可从以下类型派生自定义授权筛选器

  • AuthorizeAttribute，基于用户和角色进行授权。
  • AuthorizationFilterAttribute，不基于用户和角色的同步授权。
  • IAuthorizationFilter，实现此接口执行异步授权逻辑。例如，授权逻辑中有对 IO 或网络的异步调用。（CPU-bound的授权逻辑更适合从 AuthorizationFilterAttribute 派生，这样不必写异步方法）。

下图是 AuthorizeAttribute 类层次

aaarticlea/png;base64,iVBORw0KGgoAAAANSUhEUgAAALQAAABvCAIAAADKVn2JAAAKPklEQVR4nO2dIXbdPhPFBQsDCx/ROYVdgEC24B30HG2gwDzIOMQ8QKDYK/AGtAGhMHcBBoX6g5vMN5Ys2/F7sV/7zQ8lfpI1Gl2P9HLaaxUFoYD6/v27EoSMN2GcLVDhHnnTyNlhCPeIiEMo8veJYxiGYRj29R3HMYSwe+gQwjiOu7tzaBbXTOezOU4ceRZCCNvzQi3btm3bdl8Mfd9baz/UhUdore37fse4ngF10iz4dMZxvJX4bsJx4sgXVWttjNnSt6oq6nuNOD6K9/4myVFKVe80TcM/4tNRSnnvrx/uVpwmDjzEWmv+aPK6TZUmhGCMqesaiaP7eO/zwkOPJqB9xHs/jiO/J3+aaVBcp77OOSwYeiUrxxvT6Ig8uZ5nmGbKp6OUcs7x+JPpoNcwDNdsjts5TRzW2q7rmqbhT1JVVZRWat80jVJKa11VFa43TYOnUCnVdR3ad12HBxQFCan33tMjG0Lg98RFY4xSCo3REUBV+LSqKoxCiQohUGOlFC0V4jHGJEUxzzDNlELCdIwxSAgNobWu65p6NU1DbT6bc8QxDAMGpR/ArDhitq3QcmIlYozjOPJFqusaCcXjOHtPujMdI6iZMQZqSLYV+rmqKuccfu66TmtNDej+Wmu6M2IAKEK5OOJ0W+FDQNn44aNnpms4RxzOOXoaaCXiZnHw5wbBo0LQRdKc955WLmbicM7luR6Goa5rXuqTsWJWCbTWWDxSbcxWnQoYJrsqDq4nioe6H8M54tBat22LmaPC4/pGcfAFnhVH6XpSvbTW/IhDhR3hxc3ioLD59WTVk2xsEUfFSCR1DCeIAxnnM1dKUbGlUtw0DWXNWrssDuzQdLHve2hiQRx8rBhjXddUxmnoEEJJHHQWxo6WNIi3EEf+tfbfFwcVSYKutG1rjPHe42sCF4S1Ns9mnJ4D0AYnUyx8SRzOOQxE31ZwTMHQVDlw/77vIQUaC3H2fd/3PT8eXikOFEjsUCiofd8jwqTXMRwnjq7rqDYmX0GxrcYYx3Fs2xY5ova4bq3F+YBfx92oDfqSjGKMIQR+QOExcPAVsa7rfOiu66jGcJ3henIISBrws1SSjaZpIALeLITAN1DnXPKnEep1DH/fn8+FwxBxCEVEHEIREYdQRMQhFBFxCEVEHEIRpZR6eHhQgpDx8PAgZeN/PD8/f/ny5eXl5exA7gURxxt//vy5XC6/fv16fHw8O5Z7QcTxxvPz88+fP2OMl8vl9fX17HDuAhFHjO9l4/fv3zHGp6enp6ensyO6C0QcMbKyEWN8fX29XC7nxnMniDgmZQM8Pj7u+18I/xgijknZAC8vLz9+/DgrnvtBxBG/ffuWf8v/+vXr2XGdj4hjgpK/FzMkFxNEHBzJxQQRB0dyMUHEwZFcTBBxcCQXE0QcHMnFBBEHR3IxQcTBkVxMEHFwJBcTRBwcycUEEQdHcjFBxMERe2thHrG3Foq8aeTsMIR7RMQhFBFxCEU+Vxy5teN2uIXjDrTWtzLeI+PKa6ZzPTSjw8yftorDGLPRAZMbvR2ZzcQzbjf8uJ7YNfHpwFLsozfP05iEzbNX4qPi2Bdq3CgO8vLdYtv+D/iUlz4qOf9tZDaNSdg8eyU+Ko4doVLHdXHAhpGbMcaCZyh8I+meuE7+1GR2FkKw1qIZuaHB+Q+Nvfez91TvHo91XfPuSDFAL5oUnODwkbWWFkYphaeWxxDnxJE7/yWlhQ/BTeJgTEjlJ09jEnaePXgK4lcKDAZ2uM6zOrsiW0ItsS4O+GyO45i4AW+3okYzbkartUaChmEwxpA/KV2Pc1Un2bDwAgpykS4ZyuLEgMbwC6QGuA67Y+5fnmRg1TOUhoDxLXmqVlVFWiylcaFytG3L156LwxhDr+agu5VWZDXUEuvi6LqOtkmt9awn5oI4yMaazFy999w0njbdJE2JOJJeBClmwW2Yl3GqPYoZzXLZ8SpFpWu7oWzbttA3Ny9fSOOyOPgBhYuDP/RcjqvimA21xLo4eCh8sY+0okaFoGeILEexKayKI5nOZ1hRL0hqOY3L4sizN3tn/LpRHHmoJVbEgZKbAOldI46kcuDXBXEkZ3gkF87D1Gx75cCvtxVHnjqen4U07hMHrxyrK7IaaokVcTRNQxpPIqvrGkUPBuF8SnS+K02vdOaYFUe+oVhr0R1bEs8CP2/ih4UzRz5W3CwObp2Oc3TyVY4v1UIaY1bqV7OH0wwdzPmBd3ZFVkMtsSIOxU5qgF5xQq8ZwHgUCiJT7NtKPj34OCeVrSSO5IHz3tO3jGRonMOhGxqLn8+hkiSYuEsccFjHYsB9G0OQjrk4FtKYhL0le/Q9CBnIX/yQpGU11BIr4hD+nxFxCEVEHEIREYdQRMQhFBFxCEVEHEIRpcTeWigg9tYTxN46QcTxhthb54g43hB76xwRR4xib11AxBGj2FsXEHGIvXUREYfYWxcRcYi9dRERxwQlfy9mSC4miDg4kosJIg6O5GKCiIMjuZgg4uBILiaIODiSiwkiDo7kYoKIgyO5mCDi4EguJog4OJKLCSIOjuRigoiDI/bWwjxiby0UedPI2WEI94iIQygi4hCK/E3i6Lput2N13/cbHZhviLUW/xC1aZrE2eev4BxxbDFxBlwQiQ3ShxjHcd/y5KHCQHc2woQQQm7ltnHQexDTCeKAPerGQc8yywazocLlcjbCEocZUt+WE8QBwzxrLX/g+PMXQoCjHvliYzEgDjg7c+u3cRydc1VVURmnm6BxCIHuDyNlAp58wzDAli9Z5jxUvMtBKYXbJhFiFFIPaQjiwHUeOa8QFCFM34wxZCvYdR1md3A5OUEccNzFhOkirwpkKwiLUliOog18KdGAzhD42XsP2zxyu6a+3K40hOC9996TMSOslXFbay3XRx4qZIT3EGCryiN0ziU+uBAirltrE9EkGYAzqXOODKyNMX3fQ5cbXSJvwtHi6PueHA4VM5ieFUfMthW+SAg7eSUF3R8p5v6efNWxX+BTmNXjOqySV0MtbStYSPqIi4PakAl63Gwry224b/USmS0cLQ7+zoC6rmcNWRfEkfty7jDLjlPf1rZtsS8AysZCqAviKDmHXmNITbFxR94DOFQceGiMMZgqXj6Cj24lDpSE/Drv65zjX2vbd7NsYjXUHeLg/7mSisFGcfDYlt9zcFsOFQeOjXyq9EIMfIRm3LJ54b1PCBurSCc1euVWSRx8QwE4UiR7+UKoOORSy9UI4/upiIajnYuOOOM4ks13nL5bicY9nkPFkc+THmJs9sYYnO8o+33fq/cXyZRSj3Moqi4tc0kcxhi+iUBVMJjGFWzqC6HiuEN9t0QIv2mMy6WMgxEqEz8LozE2MhheUw3bnfwdHCqO/Ls7Xk7DGwzDkPzBKoSAX4dh4EWVd8R9eK/kJtTXT+HG4fwOy6Gi8fYI8dcw9EpKFG6LT5O+ya9538/mb/rzuXAwIg6hiIhDKCLiEIqIOIQiIg6hiFJiby0UEHtrYYn/ALyp0dEEvp1pAAAAAElFTkSuQmCC" alt="" />

在 Action 中执行验证

可在控制器中检查 ApiController.User 属性，根据用户和角色使用不同的逻辑。

public HttpResponseMessage Get()

{

    if (User.IsInRole("Administrators"))

    {

        // ...

    }

}

原文地址：http://www.asp.net/web-api/overview/security/authentication-and-authorization-in-aspnet-web-api

相关文章