你的位置:首页 > ASP.net教程

[ASP.net教程]关于WEB ServiceWCFWebApi实现身份验证之WebApi篇


之前先后总结并发表了关于WEB Service、WCF身份验证相关文章,如下:

关于WEB Service&WCF&WebApi实现身份验证之WEB Service篇、

关于WEB Service&WCF&WebApi实现身份验证之WCF篇(1)、关于WEB Service&WCF&WebApi实现身份验证之WCF篇(2)

今天再来总结关于如何实现WebApi的身份验证,以完成该系列所有文章,WebApi常见的实现方式有:FORM身份验证、集成WINDOWS验证、Basic基础认证、Digest摘要认证

 第一种:FORM身份验证(若在ASP.NET应用程序使用,则该验证方式不支持跨域,因为cookie无法跨域访问)

1.定义一个FormAuthenticationFilterAttribute,该类继承自AuthorizationFilterAttribute,并重写其OnAuthorization,在该方法中添加从请求头中获取有无登录的Cookie,若有则表示登录成功,否则失败,代码如下:

using System;using System.Collections.Generic;using System.Linq;using System.Web;using System.Web.Http;using System.Web.Http.Filters;using System.Web.Security;using System.Net.Http;using System.Collections.ObjectModel;using System.Net.Http.Headers;using System.Threading;using System.Security.Principal;using System.Net;using System.Text;namespace WebApplication1.Models{  public class FormAuthenticationFilterAttribute : AuthorizationFilterAttribute  {    private const string UnauthorizedMessage = "请求未授权,拒绝访问。";    public override void OnAuthorization(System.Web.Http.Controllers.HttpActionContext actionContext)    {      if (actionContext.ActionDescriptor.GetCustomAttributes<AllowAnonymousAttribute>().Count > 0)      {        base.OnAuthorization(actionContext);        return;      }      if (HttpContext.Current.User != null && HttpContext.Current.User.Identity.IsAuthenticated)      {        base.OnAuthorization(actionContext);        return;      }      var cookies = actionContext.Request.Headers.GetCookies();      if (cookies == null || cookies.Count < 1)      {        actionContext.Response = new HttpResponseMessage(HttpStatusCode.Unauthorized) { Content = new StringContent(UnauthorizedMessage, Encoding.UTF8) };        return;      }      FormsAuthenticationTicket ticket = GetTicket(cookies);      if (ticket == null)      {        actionContext.Response = new HttpResponseMessage(HttpStatusCode.Unauthorized) { Content = new StringContent(UnauthorizedMessage, Encoding.UTF8) };        return;      }      //这里可以对FormsAuthenticationTicket对象进行进一步验证      var principal = new GenericPrincipal(new FormsIdentity(ticket), null);      HttpContext.Current.User = principal;      Thread.CurrentPrincipal = principal;      base.OnAuthorization(actionContext);    }    private FormsAuthenticationTicket GetTicket(Collection<CookieHeaderValue> cookies)    {      FormsAuthenticationTicket ticket = null;      foreach (var item in cookies)      {        var cookie = item.Cookies.SingleOrDefault(c => c.Name == FormsAuthentication.FormsCookieName);        if (cookie != null)        {          ticket = FormsAuthentication.Decrypt(cookie.Value);          break;        }      }      return ticket;    }  }}

  

2.在需要认证授权后才能访问的Controller中类或ACTION方法上添加上述授权过滤器FormAuthenticationFilterAttribute,也可在global文件中将该类添加到全局过滤器中,同时定义一个登录ACTION,用于登录入口,示例代码如下:

using System;using System.Collections.Generic;using System.Linq;using System.Net;using System.Net.Http;using System.Web;using System.Web.Http;using System.Web.Security;using WebApplication1.Models;namespace WebApplication1.Controllers{  [FormAuthenticationFilter]  public class TestController : ApiController  {    [AllowAnonymous]    [AcceptVerbs("Get")]    [Route("Api/Test/Login")]    public HttpResponseMessage Login(string uname, string pwd)    {      if ("admin".Equals(uname, StringComparison.OrdinalIgnoreCase) && "api.admin".Equals(pwd))      {        //创建票据        FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(1, uname, DateTime.Now, DateTime.Now.AddMinutes(30), false, string.Empty);        //加密票据        string authTicket = FormsAuthentication.Encrypt(ticket);        //存储为cookie        HttpCookie cookie = new HttpCookie(FormsAuthentication.FormsCookieName, authTicket);        cookie.Path = FormsAuthentication.FormsCookiePath;        HttpContext.Current.Response.AppendCookie(cookie);        //或者        //FormsAuthentication.SetAuthCookie(uname, false, "/");        return Request.CreateResponse(HttpStatusCode.OK, "登录成功!");      }      else      {        HttpContext.Current.Response.AppendCookie(new HttpCookie(FormsAuthentication.FormsCookieName) { Expires = DateTime.Now.AddDays(-10) });//测试用:当登录失败时,清除可能存在的身份验证Cookie        return Request.CreateErrorResponse(HttpStatusCode.NotFound, "登录失败,无效的用户名或密码!");      }    }    // GET api/test    public IEnumerable<string> GetValues()    {      return new string[] { "value1", "value2" };    }    // GET api/test/5    public string GetValue(int id)    {      return "value";    }  }}

测试用法一:可直接在浏览器中访问需要授权的方法(即:Login除外),如:http://localhost:11099/api/test/,响应结果如下:

请求头信息如下:

若成功调用Login方法后(http://localhost:11099/api/test/login?uname=admin&pwd=api.admin),再调用上述方法,则可以获得正常的结果,如下图示:

看一下请求时附带的Cookie,如下图示:

测试用法二:采用HttpClient来调用Api的相关方法,示例代码如下:

    public async static void TestLoginApi()    {      HttpClientHandler handler = new HttpClientHandler();      handler.UseCookies = true;//因为采用Form验证,所以需要使用Cookie来记录身份登录信息      HttpClient client = new HttpClient(handler);      Console.WriteLine("Login>>>>>>>>>>>>>>>>>>>>>>>>>>>>>");      var response = await client.GetAsync("http://localhost:11099/api/test/login/?uname=admin&pwd=api.admin");      var r = await response.Content.ReadAsAsync<dynamic>();      Console.WriteLine("StatusCode:{0}", response.StatusCode);      if (!response.IsSuccessStatusCode)      {        Console.WriteLine("Msg:{1}", response.StatusCode, r.Message);        return;      }      Console.WriteLine("Msg:{1}", response.StatusCode, r);      var getCookies = handler.CookieContainer.GetCookies(new Uri("http://localhost:11099/"));      Console.WriteLine("获取到的cookie数量:" + getCookies.Count);      Console.WriteLine("获取到的cookie:");      for (int i = 0; i < getCookies.Count; i++)      {        Console.WriteLine(getCookies[i].Name + ":" + getCookies[i].Value);      }      Console.WriteLine("GetValues>>>>>>>>>>>>>>>>>>>>>>>>>>>>>");      response = await client.GetAsync("http://localhost:11099/api/test/");      var r2 = await response.Content.ReadAsAsync<IEnumerable<string>>();      foreach (string item in r2)      {        Console.WriteLine("GetValues - Item Value:{0}", item);      }      Console.WriteLine("GetValue>>>>>>>>>>>>>>>>>>>>>>>>>>>>>");      response = await client.GetAsync("http://localhost:11099/api/test/8");      var r3 = await response.Content.ReadAsAsync<string>();      Console.WriteLine("GetValue - Item Value:{0}", r3);    }

结果如下图示:

 如果Web Api作为ASP.NET 或MVC的一部份使用,那么完全可以采用基于默认的FORM身份验证授权特性(Authorize),或采用web.config中配置,这个很简单,就不作说明了,大家可以网上参考关于ASP.NET 或ASP.NET MVC的FORM身份验证。

第二种:集成WINDOWS验证

首先在WEB.CONFIG文件中,增加如下配置,以开启WINDOWS身份验证,配置如下:

  <authentication mode="Windows">  </authentication>

然后在需要认证授权后才能访问的Controller中类或ACTION方法上添加Authorize特性,Controller与上文相同不再贴出,当然也可以在WEB.CONFIG中配置:

  <authorization>   <deny users="?"/>  </authorization>

最后将WEB API寄宿到(或者说发布到)IIS,且需要在IIS中启用WINDOWS身份验证,如下图示:

这样就完成了该身份验证模式(理论上WEB服务、WCF若都以IIS为宿主,都可以采用集成WINDOWS身份验证模式),测试方法很简单,第一种直接在浏览器中访问,第二种采用HttpClient来调用WEB API,示例代码如下:

    public async static void TestLoginApi2()    {      HttpClientHandler handler = new HttpClientHandler();      handler.ClientCertificateOptions = ClientCertificateOption.Manual;      handler.Credentials = new NetworkCredential("admin", "www.zuowenjun.cn");      HttpClient client = new HttpClient(handler);      var response = await client.GetAsync("http://localhost:8010/api/test/");      var r2 = await response.Content.ReadAsAsync<IEnumerable<string>>();      foreach (string item in r2)      {        Console.WriteLine("GetValues - Item Value:{0}", item);      }      response = await client.GetAsync("http://localhost:8010/api/test/8");      var r3 = await response.Content.ReadAsAsync<string>();      Console.WriteLine("GetValue - Item Value:{0}", r3);    }

第三种:Basic基础认证

1.定义一个继承自AuthorizationFilterAttribute的HttpBasicAuthenticationFilter类,用于实现Basic基础认证,实现代码如下:

using System;using System.Net;using System.Text;using System.Web;using System.Web.Http.Controllers;using System.Web.Http.Filters;using System.Net.Http;using System.Web.Http;using System.Security.Principal;using System.Threading;using System.Net.Http.Headers;namespace WebApplication1.Models{  public class HttpBasicAuthenticationFilter : AuthorizationFilterAttribute  {    public override void OnAuthorization(System.Web.Http.Controllers.HttpActionContext actionContext)    {      if (actionContext.ActionDescriptor.GetCustomAttributes<AllowAnonymousAttribute>().Count > 0)      {        base.OnAuthorization(actionContext);        return;      }      if (Thread.CurrentPrincipal != null && Thread.CurrentPrincipal.Identity.IsAuthenticated)      {        base.OnAuthorization(actionContext);        return;      }      string authParameter = null;      var authValue = actionContext.Request.Headers.Authorization;      if (authValue != null && authValue.Scheme == "Basic")      {        authParameter = authValue.Parameter; //authparameter:获取请求中经过Base64编码的(用户:密码)      }      if (string.IsNullOrEmpty(authParameter))      {        Challenge(actionContext);        return;      }      authParameter = Encoding.Default.GetString(Convert.FromBase64String(authParameter));      var authToken = authParameter.Split(':');      if (authToken.Length < 2)      {        Challenge(actionContext);        return;      }      if (!ValidateUser(authToken[0], authToken[1]))      {        Challenge(actionContext);        return;      }      var principal = new GenericPrincipal(new GenericIdentity(authToken[0]), null);      Thread.CurrentPrincipal = principal;      if (HttpContext.Current != null)      {        HttpContext.Current.User = principal;      }      base.OnAuthorization(actionContext);    }    private void Challenge(HttpActionContext actionContext)    {      var host = actionContext.Request.RequestUri.DnsSafeHost;      actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.Unauthorized, "请求未授权,拒绝访问。");      //actionContext.Response.Headers.Add("WWW-Authenticate", string.Format("Basic realm=\"{0}\"", host));//可以使用如下语句      actionContext.Response.Headers.WwwAuthenticate.Add(new AuthenticationHeaderValue("Basic", string.Format("realm=\"{0}\"", host)));    }    protected virtual bool ValidateUser(string userName, string password)    {      if (userName.Equals("admin", StringComparison.OrdinalIgnoreCase) && password.Equals("api.admin")) //判断用户名及密码,实际可从数据库查询验证,可重写      {        return true;      }      return false;    }  }}

  

 2.在需要认证授权后才能访问的Controller中类或ACTION方法上添加上述定义的类HttpBasicAuthenticationFilter,也可在global文件中将该类添加到全局过滤器中,即可

测试方法很简单,第一种直接在浏览器中访问(同上),第二种采用HttpClient来调用WEB API,示例代码如下:

    public async static void TestLoginApi3()    {      HttpClient client = new HttpClient();      client.DefaultRequestHeaders.Authorization = CreateBasicHeader("admin", "api.admin");      var response = await client.GetAsync("http://localhost:11099/api/test/");      var r2 = await response.Content.ReadAsAsync<IEnumerable<string>>();      foreach (string item in r2)      {        Console.WriteLine("GetValues - Item Value:{0}", item);      }      response = await client.GetAsync("http://localhost:11099/api/test/8");      var r3 = await response.Content.ReadAsAsync<string>();      Console.WriteLine("GetValue - Item Value:{0}", r3);    }    public static AuthenticationHeaderValue CreateBasicHeader(string username, string password)    {      return new AuthenticationHeaderValue("Basic",          Convert.ToBase64String(System.Text.ASCIIEncoding.ASCII.GetBytes(string.Format("{0}:{1}", username, password))));    }

实现Basic基础认证,除了通过继承自AuthorizationFilterAttribute来实现自定义的验证授权过滤器外,还可以通过继承自DelegatingHandler来实现自定义的消息处理管道类,具体的实现方式可参见园子里的这篇文章:

http://www.cnblogs.com/CreateMyself/p/4857799.html

 第四种:Digest摘要认证

 1.定义一个继承自DelegatingHandler的HttpDigestAuthenticationHandler类,用于实现在消息管道中实现Digest摘要认证,同时定义该类所需关联或依赖的其它类,源代码如下:

using System;using System.Collections.Concurrent;using System.Net;using System.Net.Http;using System.Net.Http.Headers;using System.Security.Cryptography;using System.Security.Principal;using System.Text;using System.Threading;using System.Threading.Tasks;using System.Web;namespace WebApplication1.Models{  public class HttpDigestAuthenticationHandler : DelegatingHandler  {    protected async override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)    {      try      {        HttpRequestHeaders headers = request.Headers;        if (headers.Authorization != null)        {          Header header = new Header(request.Headers.Authorization.Parameter, request.Method.Method);          if (Nonce.IsValid(header.Nonce, header.NounceCounter))          {            string password = "www.zuowenjun.cn";//默认值            //根据用户名获取正确的密码,实际情况应该从数据库查询            if (header.UserName.Equals("admin", StringComparison.OrdinalIgnoreCase))            {              password = "api.admin";//这里模拟获取到的正确的密码            }            #region 计算正确的可授权的Hash值            string ha1 = String.Format("{0}:{1}:{2}", header.UserName, header.Realm, password).ToMD5Hash();            string ha2 = String.Format("{0}:{1}", header.Method, header.Uri).ToMD5Hash();            string computedResponse = String.Format("{0}:{1}:{2}:{3}:{4}:{5}",                      ha1, header.Nonce, header.NounceCounter, header.Cnonce, "auth", ha2).ToMD5Hash();            #endregion            if (String.CompareOrdinal(header.Response, computedResponse) == 0) //比较请求的Hash值与正确的可授权的Hash值是否相同,相则则表示验证通过,否则失败            {              // digest computed matches the value sent by client in the response field.              // Looks like an authentic client! Create a principal.              //  var claims = new List<Claim>              //{              //        new Claim(ClaimTypes.Name, header.UserName),              //        new Claim(ClaimTypes.AuthenticationMethod, AuthenticationMethods.Password)              //};              //  ClaimsPrincipal principal = new ClaimsPrincipal(new[] { new ClaimsIdentity(claims, "Digest") });              //  Thread.CurrentPrincipal = principal;              //  if (HttpContext.Current != null)              //    HttpContext.Current.User = principal;              var principal = new GenericPrincipal(new GenericIdentity(header.UserName), null);              Thread.CurrentPrincipal = principal;              if (HttpContext.Current != null)              {                HttpContext.Current.User = principal;              }            }          }        }        HttpResponseMessage response = await base.SendAsync(request, cancellationToken);        if (response.StatusCode == HttpStatusCode.Unauthorized)        {          response.Headers.WwwAuthenticate.Add(new AuthenticationHeaderValue("Digest", Header.GetUnauthorizedResponseHeader(request).ToString()));        }        return response;      }      catch (Exception)      {        var response = request.CreateResponse(HttpStatusCode.Unauthorized);        response.Headers.WwwAuthenticate.Add(new AuthenticationHeaderValue("Digest", Header.GetUnauthorizedResponseHeader(request).ToString()));        return response;      }    }  }  public class Header  {    public Header() { }    public Header(string header, string method)    {      string keyValuePairs = header.Replace("\"", String.Empty);      foreach (string keyValuePair in keyValuePairs.Split(','))      {        int index = keyValuePair.IndexOf("=", System.StringComparison.Ordinal);        string key = keyValuePair.Substring(0, index).Trim();        string value = keyValuePair.Substring(index + 1).Trim();        switch (key)        {          case "username": this.UserName = value; break;          case "realm": this.Realm = value; break;          case "nonce": this.Nonce = value; break;          case "uri": this.Uri = value; break;          case "nc": this.NounceCounter = value; break;          case "cnonce": this.Cnonce = value; break;          case "response": this.Response = value; break;          case "method": this.Method = value; break;        }      }      if (String.IsNullOrEmpty(this.Method))        this.Method = method;    }    public string Cnonce { get; private set; }    public string Nonce { get; private set; }    public string Realm { get; private set; }    public string UserName { get; private set; }    public string Uri { get; private set; }    public string Response { get; private set; }    public string Method { get; private set; }    public string NounceCounter { get; private set; }    // This property is used by the handler to generate a    // nonce and get it ready to be packaged in the    // WWW-Authenticate header, as part of 401 response    public static Header GetUnauthorizedResponseHeader(HttpRequestMessage request)    {      var host = request.RequestUri.DnsSafeHost;      return new Header()      {        Realm = host,        Nonce = WebApplication1.Models.Nonce.Generate()      };    }    public override string ToString()    {      StringBuilder header = new StringBuilder();      header.AppendFormat("realm=\"{0}\"", Realm);      header.AppendFormat(",nonce=\"{0}\"", Nonce);      header.AppendFormat(",qop=\"{0}\"", "auth");      return header.ToString();    }  }  public class Nonce  {    private static ConcurrentDictionary<string, Tuple<int, DateTime>>    nonces = new ConcurrentDictionary<string, Tuple<int, DateTime>>();    public static string Generate()    {      byte[] bytes = new byte[16];      using (var rngProvider = new RNGCryptoServiceProvider())      {        rngProvider.GetBytes(bytes);      }      string nonce = bytes.ToMD5Hash();      nonces.TryAdd(nonce, new Tuple<int, DateTime>(0, DateTime.Now.AddMinutes(10)));      return nonce;    }    public static bool IsValid(string nonce, string nonceCount)    {      Tuple<int, DateTime> cachedNonce = null;      //nonces.TryGetValue(nonce, out cachedNonce);      nonces.TryRemove(nonce, out cachedNonce);//每个nonce只允许使用一次      if (cachedNonce != null) // nonce is found      {        // nonce count is greater than the one in record        if (Int32.Parse(nonceCount) > cachedNonce.Item1)        {          // nonce has not expired yet          if (cachedNonce.Item2 > DateTime.Now)          {            // update the dictionary to reflect the nonce count just received in this request            //nonces[nonce] = new Tuple<int, DateTime>(Int32.Parse(nonceCount), cachedNonce.Item2);            // Every thing looks ok - server nonce is fresh and nonce count seems to be             // incremented. Does not look like replay.            return true;          }        }      }      return false;    }  }}

 

using System.Linq;using System.Security.Cryptography;using System.Text;namespace WebApplication1.Models{  public static class HashHelper  {    public static string ToMD5Hash(this byte[] bytes)    {      StringBuilder hash = new StringBuilder();      MD5 md5 = MD5.Create();      md5.ComputeHash(bytes)         .ToList()         .ForEach(b => hash.AppendFormat("{0:x2}", b));      return hash.ToString();    }    public static string ToMD5Hash(this string inputString)    {      return Encoding.UTF8.GetBytes(inputString).ToMD5Hash();    }  }}

2.将上述自定义的HttpDigestAuthenticationHandler类添加到全局消息处理管道中,代码如下:

  public static class WebApiConfig  {    public static void Register(HttpConfiguration config)    {      config.MapHttpAttributeRoutes();      config.Routes.MapHttpRoute(        name: "DefaultApi",        routeTemplate: "api/{controller}/{id}",        defaults: new { id = RouteParameter.Optional }      );      config.MessageHandlers.Add(new HttpDigestAuthenticationHandler());//添加到消息处理管道中    }  }

3.在需要认证授权后才能访问的Controller中类或ACTION方法上添加Authorize特性即可。

测试方法很简单,第一种直接在浏览器中访问(同上),第二种采用HttpClient来调用WEB API,示例代码如下:

    public async static void TestLoginApi4()    {      HttpClientHandler handler = new HttpClientHandler();      handler.ClientCertificateOptions = ClientCertificateOption.Manual;      handler.Credentials = new NetworkCredential("admin", "api.admin");      HttpClient client = new HttpClient(handler);      var response = await client.GetAsync("http://localhost:11099/api/test/");      var r2 = await response.Content.ReadAsAsync<IEnumerable<string>>();      foreach (string item in r2)      {        Console.WriteLine("GetValues - Item Value:{0}", item);      }      response = await client.GetAsync("http://localhost:11099/api/test/8");      var r3 = await response.Content.ReadAsAsync<string>();      Console.WriteLine("GetValue - Item Value:{0}", r3);    }

该实现方法,参考了该篇文章:http://zrj-software.iteye.com/blog/2163487

实现Digest摘要认证,除了上述通过继承自DelegatingHandler来实现自定义的消息处理管道类外,也可以通过继承自AuthorizationFilterAttribute来实现自定义的验证授权过滤器,Basic基础认证与Digest摘要认证流程基本相同,区别在于:Basic是将密码直接base64编码(明文),而Digest是用MD5进行加密后传输,所以两者实现认证方式上,也基本相同。

最后说明一下,WEB SERVICE、WCF、WEB API实现身份验证的方法有很多,每种方法都有他所适用的场景,我这个系列文章仅是列举一些常见的实见身份验证的方法,一是给自己复习并备忘,二是给大家以参考,文中可能有不足之处,若发现问题,可以在下面评论指出,谢谢!