Web用戶的身份驗證及WebApi權限驗證流程的設計和實現

5. WebApi 服務端代碼示例

5.1 控制器基類ApiControllerBase

[csharp] view plain copy

 

1. ///
2. /// Controller的基類，用於實現適合業務場景的基礎功能
3. ///
4. ///
5. [BasicAuthentication]
6. public abstract class ApiControllerBase : ApiController
7. {
8. }

 

 

5.2 權限屬性BaseAuthenticationAttribute

[csharp] view plain copy

 

1. ///
2. /// 基本驗證Attribtue，用以Action的權限處理
3. ///
4. public class BasicAuthenticationAttribute : ActionFilterAttribute
5. {
6. ///
7. /// 檢查用戶是否有該Action執行的操做權限
8. ///
9. ///
10. public override void OnActionExecuting(HttpActionContext actionContext)
11. {
12. //檢驗用戶ticket信息，用戶ticket信息來自調用發起方
13. if (actionContext.Request.Headers.Authorization != null)
14. {
15. //解密用戶ticket,並校驗用戶名密碼是否匹配
16. var encryptTicket = actionContext.Request.Headers.Authorization.Parameter;
17. if (ValidateUserTicket(encryptTicket))
18. base.OnActionExecuting(actionContext);
19. else
20. actionContext.Response = new HttpResponseMessage(HttpStatusCode.Unauthorized);
21. }
22. else
23. {
24. //檢查web.config配置是否要求權限校驗
25. bool isRquired = (WebConfigurationManager.AppSettings["WebApiAuthenticatedFlag"].ToString() == "true");
26. if (isRquired)
27. {
28. //若是請求Header不包含ticket，則判斷是不是匿名調用
29. var attr = actionContext.ActionDescriptor.GetCustomAttributes().OfType();
30. bool isAnonymous = attr.Any(a => a is AllowAnonymousAttribute);
31. //是匿名用戶，則繼續執行；非匿名用戶，拋出「未受權訪問」信息
32. if (isAnonymous)
33. base.OnActionExecuting(actionContext);
34. else
35. actionContext.Response = new HttpResponseMessage(HttpStatusCode.Unauthorized);
36. }
37. else
38. {
39. base.OnActionExecuting(actionContext);
40. }
41. }
42. }
43. ///
44. /// 校驗用戶ticket信息
45. ///
46. ///
47. ///
48. private bool ValidateUserTicket(string encryptTicket)
49. {
50. var userTicket = FormsAuthentication.Decrypt(encryptTicket);
51. var userTicketData = userTicket.UserData;
52. string userName = userTicketData.Substring(0, userTicketData.IndexOf(":"));
53. string password = userTicketData.Substring(userTicketData.IndexOf(":") + 1);
54. //檢查用戶名、密碼是否正確，驗證是合法用戶
55. //var isQuilified = CheckUser(userName, password);
56. return true;
57. }
58. }

 

5.3 api服務Controller實例

[csharp] view plain copy

 

1. public class ProductController : ApiControllerBase
2. {
3. [HttpGet]
4. public object Find(string id)
5. {
6. return ProductServiceInstance.Find(2);
7. }
8. // GET api/product/5
9. [HttpGet]
10. [AllowAnonymous]
11. public Product Get(string id)
12. {
13. var headers = Request.Headers;
14. var p = ProductServiceInstance.GetById(long.Parse(id));
15. if (p == null)
16. {
17. throw new HttpResponseException(new HttpResponseMessage(HttpStatusCode.BadRequest)
18. Content = new StringContent("id3 not found"), ReasonPhrase = "product id not exist." });
19. }
20. return p;
21. }
22. }

6. 其它配置說明

6.1 Mvc前端Web.Config 配置

[html] view plain copy

 

1. <</SPAN>system.web>
2. <</SPAN>compilation debug="true" targetFramework="4.5">
3. <</SPAN>assemblies>
4. <</SPAN>add assembly="System.Web.Http.Data.Helpers, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
5. </</SPAN>assemblies>
6. </</SPAN>compilation>
7. <</SPAN>httpRuntime targetFramework="4.5" />
8. <</SPAN>authentication mode="Forms">
9. <</SPAN>forms loginUrl="~/Account/Login" defaultUrl="~/Home/Index" protection="All" timeout="90" name=".AuthCookie"></</SPAN>forms>
10. </</SPAN>authentication>
11. <</SPAN>machineKey validationKey="3FFA12388DDF585BA5D35E7BC87E3F0AB47FBBEBD12240DD3BEA2BEAEC4ABA213F22AD27E8FAD77DCFEE306219691434908D193A17C1FC8DCE51B71A4AE54920" decryptionKey="ECB6A3AF9ABBF3F16E80685ED68DC74B0B13CCEE538EBBA97D0B893139683B3B" validation="SHA1" decryption="AES" />
12. </</SPAN>system.web>

machineKey節點配置，是應用於對用戶ticket數據加密和解密。

6.2 WebApi服務端Web.Config配置

[html] view plain copy

 

1. <</SPAN>system.web>
2. <</SPAN>machineKey validationKey="3FF112388DDF585BA5D35E7BC87E3F0AB47FBBEBD12240DD3BEA2BEAEC4ABA213F22AD27E8FAD77DCFEE306219691434908D193A17C1FC8DCE51B71A4AE54920" decryptionKey="ECB6A3AF9ABBF3F16E80685ED68DC74B0B13CCEE538EBBA97D0B893139683B3B" validation="SHA1" decryption="AES" />
3. </</SPAN>system.web>

machineKey節點配置，是應用於對用戶ticket數據加密和解密。

7. 總結

Web系統的用戶登陸及頁面操做權限驗證在處理邏輯上比較複雜，須要考慮到Form認證、匿名訪問，Session和Cookie存儲，以及Session和Cookie的過時處理，本文實現了整個權限驗證框架的基本功能，供系統架構設計人員以及Web開發人員參考。

 

Demo項目代碼地址： https://github.com/lgsky/DemoUserAuthorization/