定义

身份验证(Authentication):确定用户是谁。

授权(Authorization):确定用户能做什么,不能做什么。

身份验证

WebApi 假定身份验证发生在宿主程序称中。对于 web-hosting,宿主是 IIS。这种情况下使用 HTTP Module 进行验证。

验证时,宿主会创建一个表示安全上下文的主体对象(实现 IPrincipal),将它附加到当前线程。主体对象包含一个存储用户信息的 Identity 对象。若验证成功,Identity.IsAuthenticated 属性将返回 true。

HTTP 消息处理程序(HTTP Message Handler)

可以用 HTTP 消息处理程序代替宿主进行身份验证。这种情况下,由 HTTP 消息处理程序检查请求并设置主体对象。

请考虑以下事项决定是否使用消息处理程序进行身份验证:

  • HTTP 模块检查所有经过 asp.net 管道的请求,消息处理程序只检查路由到 WebAPI的请求。
  • 可以为每个路由单独设置消息处理程序。
  • HTTP 模块仅在 IIS 中可用。消息处理程序则与宿主无关,在 web-hosting 和 self-hosting 中均可用。
  • HTTP 模块参与IIS 日志和审计等功能。
  • HTTP模块在管道之前运行,主体在消息处理程序运行之前不会设置,当响应离开 消息处理程序时,主体会恢复成原来的那个。

一般来说,不需要自承载时,HTTP 模块较好。

设置主体

进行自定义身份验证时,应在两个地方设置主体对象:

  • Thread.CurrentPrincipal,这是 .net 中设置线程主体的标准方式。
  • HttpContext.Current.User 这是特定于 ASP.NET 的属性。
private void SetPrincipal(IPrincipal principal)
{
Thread.CurrentPrincipal = principal;
if (HttpContext.Current != null)
{
HttpContext.Current.User = principal;
}
}

采用 web-hosting 时,必须同时设置两处,避免安全上下文不一致。对于 self-hosting,HttpContext.Current 为 null,所以设置之前应进行检查。

授权

授权发生在管道中更接近 controller 的位置。

  • 授权筛选器(Authorization filter)在 action 之前运行。若请求未授权,返回错误,action 不运行。
  • 在 action 内部,可以用 ApiController.User 属性获取主体对象,做进一步的控制。

aaarticlea/png;base64,iVBORw0KGgoAAAANSUhEUgAAAogAAAB9CAIAAACu6wVuAAAeG0lEQVR4nO2dT2wUV57Hu9potdIePDunPRO1YaQhszciYTOHvQEHt420240i7aadC4hAlHa0rIHszmC3wRwW3LaUIcvgGAMBQtwNwwZkYzOJIxyXmXiHOG4HzwIOjcExJLQjJMJ07+G7/OZRVd1u466uLvr70+fg+vde1XtV9an3p8Hz+Mcn848eE0LKisc/PslYBV8IhDjL4x+feOYfPb734AdCSFkx/+ixpZj5QiDEWeYfPaaYCSlHKGZCShOKmZAyhWImpDShmAkpUyhmQkoTipmQMoViJqQ0oZgJKVMoZkJKE4qZkDKFYiakNKGYCSlTKGZCShOK2TEOtHecv9D/fMf2Xx7qOXHKjrMaGr56oL1jiYlcv5mM7G27fjPpeCGTHFDMtnIw2rnEB/zu/fklnsCnV0aXeBVnYuc+7D27xDMhi4VidobRsfE3tm0PBAJ57n/9ZlI18Ye9ZyN72wp1JurrY3pm7trE1HOk82HvWfXA0bFxxwuZ5IZito/RsfFt298MBAJ5Ku36zeSxD07Lzmdi5yJ725aow2sTU9Mzc4s9qv/yZ0PDV9UT4xd28aGYneHQ4SPnL/S/sW27+gzkYHRsXLV4AcVcqKQCgQBl7C4oZvt477dd5y/0b9v+Zp5t1tGx8WAwWFgxPx+t+/aziew4FLMzBAIBNIIPHT4iK69NTKmOlMX+y0NNO3cHAoHI3jasgU2vTUwdaO+I7G3rvzykJn7+Qj/2VNdjfxx46PARfEr3nDiFhntkbxta5IZO8v7LQ8ii58QpHDI6Nn7o8JHI3rYD7R1oIuM8A4FA087dyMVwIXLIocNHVHn3nDjVf3loaPiqmhopGhSzfQSDwa9v3O754PShw0dEctcmplr37Tcv9l8e2rnrHXnA796fh5j/+NX1g9HOyN62vsFP1cTVp/LrG7fV1HAIusGxeO/BD8c+OI2UwYH2jrv356dn5s5f6I/s3R/Z2yYmbt23PxAMvrFt+9NM5499cLr/8hC2Ts/M/ffFS6379kf2tv3u475bd75Vs75159v3ftulpkaeG4rZASDaew9+uDYxFQgEpLvJ0CyWxes3k+cv9KNJCrF92Hv2jW3bD7R3oCM6EAiIg6HAoeGrQ8NXm3bu/rD3LNbjsT9/oX90bLxp5245gUOHjzTt3D06Ng4vqg3onhOnkPLo2Djyuvd0aHx0bBxbp2fmpmfmcKpYL4tysZLIh71nA4GAdBJE9rY17dzdc+IUzI2PFcdrp3ygmG0Cor17f/7axFQwGBSBGZrFsogHPBgM6l98iafsTOzctu1vHmjv0L/4EpvEze/9tqtp5+5Pr4yOjo0fjHbiC0BS+8+D0U+vjOJZDgY36V98ee/BD9cmpvDqGBq+GgwGf/dx39378zj80yujQ8NXt21/8/RHcazcueudQ4eP6F98iYdRGtDTM3M7d72DUxoavrpz1ztNO3fjWtSskcXR4yfp5qVAMTuAOu3rjW3bxanZxGzeBMOJ0Q8dPoKWN3aT9UPDV+WoQCAgkr5+MykWNHRlyyI+GtRWrHm8Su2+Vv+Ws52emVM/Gu49/aTA39IBYC4KUgQoZptQp31t2/6mODWbmM2bzsTOqUZ/77ddaHljN2kl33vwQ+u+/eommBiImAU0nc3KVHvODV3ZsohvBVk/PTO3adOmvsFPzVlf+v1n27a/OTOXcrwi3AvFXGzgKmka9pw4JXJalJgtbQphS58VOsCxj2EMWBZzJGU59jw9M9d/eejD3rMH2jsWFLPhtA1r0OslmwyLxG4oZjuYnplT3am6cFFiVg0qi+axZ1nzNIW/6NAgZrRlValjbKvnxKlt299cUMzmsWdZg6zFxKNj48HgJop5KVDMxQY9zwZ3wtMFETP6pVWwT0HEjKY2DIrmOMXsXihmO0DPs+EBV3ubHRHz9MxcMLhJnYl27IPT6HM+f6Ef418Uc+lAMRcbGVUVZCQYvcey53OIGTO9LfNdrJgtk4L4LdO0FDOuSB05VnvXKWZnoZjtYOeudwwP+M5d70BgGHJeipj/++IltT/53oMfjn1wGpO5cov5YLQTu/1l66a/eDqfruyD0U51IhuuVIarKebCQjEXFbOo7j2rQEyhwt/oK5bd1BHfbDZFi1ZSmJ6Zk5lW2cScTflISgZ9MddaFTNmdUmamFmGv9U0m3bulpnn0zNz+C6RQyhmB6GYCw7Uq3YX33vwA343BaVh7hXWY+qWqC4YDGIS9b3sYr5+M6lOBEN28GsOMaMT+9adWfWsRMyY1SXZnYmdUxUuYkYicoaXfv9ZMBic/N9vJGuKuYBQzEWl58QptcUJoEBIF7aL7G17Y9t2TFSW3bDSsp9ZXUQK+OWSOgU6m5gx5i2+VJNC6xaZ4gxxqm9s2w7dqmnK8DamgMqZQ8aSiPpbLIrZWSjmgnPsg9MyV1mATaG0/stD6OjGA66KuXXffjwm5i5rdREylgfcNLPMKGZ0YiNl4e79eXRlR/buw+87DAPhkdZ9+LmU2oCGjFta9+GJFklTzAWHYi4qcJt5/ejYuKy/fjOJRfzuyLAb/H39ZlKdL21YxIHmY9Vp1eoi9scJGJLCntlOw5AmlCwJGi5cvUbL0shWOMQmKOaCU5wH/N7Tp1J9+ixTk18zWs47wZlMz8yZs5PEDVdk+W4xZG0+E7JYKGZCyhSKmZDShGImpEyhmAkpTShmQsoUipmQ0oRiJqRMoZgJKU0oZkLKFIqZkNKEYiakTKGYCSlNKGZCyhSKmZDShGImpEyhmAkpTShmQsoUipmQ0oRiJqRMoZgJKU0oZkLKFIqZkNKEYiakTKGYCSlNKGZCyhSKmZDShGImpEyhmAkpTShmQsoUipmQ0oRiJqRMoZgJKU0oZkLKFIqZkNLEWszxs+d6GCUQ8bPnzHXG2mEwGIwXIOJnz929P5+vmHt6ema/myGO09PTY64z1g4pCA9Ss/OP5sw8SM06fm6ElAPHjh2jmN0HxUzsg2ImxFkoZldCMRP7oJgJcRaK2ZVQzMQ+KGZCnIVidiUUM7EPipkQZ6GYXQnFTOyDYibEWShmV0IxE/ugmAlxForZlRRHzN3Hu7qPdzl+saTIUMyEOEsBxKy+vtdvWCfre8+d2fRqcP2Gda1tkRu3pxy/1BeJ/MXctGuHKtfec2e2bN0si1f0oU2vBrPl0toWaW2L5HM+3ce7DOlc0YfWb1gH1BugadeOK/qQ4wVIckAxE+IsBRCz+vr2eDz4o/Pd6OpXVveeO9M3eHHL1s19gxcdv9QXifzF3PluVFXmpleDHo9HNNnaFlE9bSB/MS9/afnyl5arxu0bvLj6ldV9gxf7Bi/i+wzr129Yx5uhxKGYCXEWu8TM96+t5C/maxNjUimooPUb1vWeOyPVJO1pMahsRc32njuzfsO6Ta8Gs7V04eDOd6Oq4/sGL6rdJ8tfWn5tYmyWN4YboJgJcRa7xNzaFln9ymr2YNvEosaYl7+0HK6FelWDSuu5b/Cix+PpPt7Ve+4MWrpSiU27dvQNXmxti6hNbZUtWzd3H+/CF4DsYBDz6ldWw+sUc+lDMRPiLHaJGeuXv7R8y9bN1HPBWZSYm3btaNq1A390vhu9og8tf2n57HczcDD22fRqUJrOMg7d2hZR5ao2poUbt6fEx2oiqpj7Bi8ix1mK2Q1QzIQ4i41inv1u5sbtKbS0ON+nsCxKzOhqnv1uZvUrq9GfjPHgpl07pOLWb1i3+pXVmKuFP2ZNY8yWQ87qtK/u411iejTBkZo6/Ewxlz4UMyHOYq+YgWH0kSydxf5cyuPxqM3WLVs3Y3ae6svOd6OYq9U3eBHrW9siaGoDtUEswLsyAVs+wtTJX+r+FHPpQzET4ix2ibn7eJf0YFPMBWexYt6ydfP6DeukFjCfS/2K2rJ1s+rg2ac1u/yl5ajHK/qQx+NBg1vAStE5xrCRjmGMWaCYSx+KmRBnsUvMTbt2SE+m9KCSQrFYMXcf7/J4PDJCjIFh9Wvpxu0pte0rLeYtWzdjJaaGGZI16xyqnqWY3QzFTIizFEDM1ybGxLvqO/faxJh0ipLCslgx37g91Td4UZ2Fd0UfMn8tXdGH+gYvynrULI61/LS6og+ZZ/Yhoxu3pyyr3vIQUlJQzIQ4C/9JTlfCfyub2AfFTIizUMyuhGIm9kExE+IsFLMroZiJfVDMhDgLxexKKGZiHxQzIc5CMbsSipnYB8VMiLNQzK6EYib2QTET4iwUsyuhmIl9UMyEOAvF7EooZmIfFDMhzkIxuxKKmdgHxUyIs1DMroRiJvZBMRPiLBSzK6GYiX1QzIQ4SzHEvOrlVR5GfrHq5VX5FGlxxMyKe+Fj1cur7j24Y6j3gov55V+87PSFMhYRq15edfd+sgj6+cXf/0LTNKcv15n4+aqfz8zddlLMHo8nw8gvPFb/obVTYmbFvfChaVoRxKxpWjqddvpaGflGRUVFccRcUVHx5MkTpy/XmVi2bNmdb7+hmN0RFDOjmEExM8xBMRchKGY3BcXMKGZQzAxzUMxFCIrZTUExM4oZFDPDHBRzEYJidlNQzIxiBsXMMAfFXISgmN0UFDOjmEExM8xBMRchKGY3BcXMKGZQzAxzUMxFCBeI2e/3JxIJdU0ikfD7/Uu88lgs5vf7BwYGzJt0XTdnmk/kc1Rzc3MsFltsygh3iTkWizU3Nxfw8iX8fn8oFLLcFA6HzZk6G/aVgzmpurq6iYmJgiSbKSUxDwwM1NXVPXz48PkuZOnFMjg42NDQsMQPiGQyWVdXd/v27aUkgkgkEnV1dX4lcIENDQ2XLl1Kp9PY4c9//vPS8zJESYk5mUy2tLSgKPbs2VOQsl1sbNy48auvvkqn0/F4vKWlpSBl7gIxezweXdfVNbquq0dFo1FVh4bFbBGNRj0ej6Xg/X6/OdN8Ip+j/H5/NBpdbMqSvlNifjc2cuvuMzfKghUXjUbNxatefiwWUz+MdF3v7u7Osxwsixo3xtI/2gobKAfDO72uru65bwNDqElpmjYyMlKQZDP2iNl8I+Uj5rq6Op/P9/777+epxng8rt5aXq93icWSSqWe40sd2lDP+TneKpah67rX6/3888/1p5FKpTKZTCKRwB/YAZLAk1WobomCi/k38ZGbMxYSWlDM8Xjc6/X++te/HhkZ0XW9paUlGo0+92V2dnZOTEw8x+HLli0bHh5Op9OdnZ11dXUFaeW/CGI27JCnU6PRaHV1tcfjMTxvyWQSL3eKWeWLr/+0671B9ZW6dDEbisJy/2zlUF1dbW40h8PhUChEMRck2Yw9YsaNdFO5kRYUczKZ1DStt7e3pqYmz/cmykR2XrqYny9UOxY5ZXWHjo6OAraeCy7mz659/auuT5Kzxjstt5gHBwcrKirGx8cL9cEhfn3uAynm/xcz+rTxmkY3smERa1KpVHNzs9/vD4fDyWQSieB1GQ6Hw+GwmjjWVFdXq5nGYjG88ZubmyUFRHd3N3pWcVY4ytB7qS6qNpITw+EL1pazXdkGNy9RzKgpn8/n9/tRPj6fD59EKCv00A4MDKDk1Y5fj8cTi8U8Ho9aF/iiQnXIykQiEQ6HDVWfTCZlpXyWYWjD7/dLq13XdewWCoXUrzf1dsKohzzMltktKGbLjHDrPnz4EJsMFleLRd2qitny7kJRDwwMGIrUMmzqyja4eUExHz16NBwOP3z40Ov1qn2VLS0t6iVgMZ1O19XVaZqGW6u3tzedTkPM8siriaBRi1LCzmpqOGRiYgLlJl3Eah/ypUuXUImNjY1IB73K8Xi8pqbG4/HU1tbiBsCxkoUcEg6H1e8GZI3ee0nNENnEXF9fj/1lh5aWlqqqKpzGnj17kHsikZCspTTkknP3/NvRld37yf9Ezwzfe7AIMa9cubK9vT3bnSNd3IZqjUQivb29AwMD9fX1oVAIXdCTk5P19fWapq1Zs8bv92Plxo0bP//888bGRnFtPB5vaGhAn/k333wjeWUTM4Y//H5/e3v7999/j5XmZC3D3WJOpVL4u7u7G505lot4B+m6HgqFfD4funrwyCUSCY/HgzVIEK97NVN4emBgACmoPgiFQtiEN50cZXCSuiiv0VQqVV1djZc7NLOgmx0fY1bdvEQx67oul59MJqE0fA9BTn6/H81iKR9RJsoqFAqpXz/RaDQcDquZJhIJn88XjUZ1XcfIxcOHD1OplKZpshIng+4T1GN1dbVULm6k5uZmHIta0zRNzgofE/Kyq6qqMmSXyUPMDQ0N5ox0XUdGOCtN0/bs2YP9u7u70YKUG7K9vR2bRMypVKqmpkbuLlkfjUZ9Ph/O3/CJaQ77xphVNy8o5qqqKsivoaEBdlTL0Lyo6zqufWRkBNfo9Xpra2vff/99bPL5fFBaIpHwer3t7e1SSqIudJ5jUyqVQqMznU7jrYJobGysqqrCO1cqsaWlRdO077//PplMHj16VNM0dDhnnrVpPB6XSoxGo5qm9ff3I+v6+vrq6uo9e/aMjIw0NjZqmqZqAJFNzOjfVneAg2tqakZGRvBkJRKJFStWtLe3j4yMdHR04GyRLy55ZGREXonmsGmM+TfxkVMDX6huziHmRCJRUVExPT1tuXVycrKiouLgwYMjIyOxWAzd3SgrQ9l6vd7p6elUKjU6OlpRUdHV1TUyMoIHcNmyZWvWrPnoo490XU+n02+//XZNTU1/f7+u66+//rrX67116xaysxRzPB5fsWIFDn/99df9fj/WG5LNVsjuEDNawBLoglZ3yNaVrbZiET6fD1/Z8gZXG0nS3pKjkIL6CsNnJm4OVeqqzvMRs2Gf5ubmbBOa1EtzVsyqm/MRM76K1PB4PHl2ZWN/WYQFpRzwZjTfBpZFjaiursarU1SayWRQfYZuDPO1aJqGmu3u7hZz46wkNUPvdE1NDe6rbOUgNjVkBINCzNKQisViVVVVyEjTNIgKga8Bw+GGr4GWlpZQKJROp+GAPGdR2Tr5S9ycW8yJRELTNLxV1ULIZBezeRPsi8VkMun1eqG6urq6cDisNmHFgmgWyyYRs5wY0oEFDWG2o6SPxVQq5fV61ZZcR0dHVVWVyMPv98tRK1asUPdUk0JbHIH9LbM2dGXX19erbc21a9di8N6Qb7awb/LXr7o+ufyHiXt5iBkezba1vr4+HA7LhWBnWNxwjStXrvzoo49QFIau7GXLlh08eBB7qikgNm7c+NZbb2GrWcypVEpNDYtffvllOp1Wk80R7hAz3qcS3d3dixKzmprZi+ob3+fzYc5INsWqa8ybFiVmv9+P3jYE/l6wKBwXs7xS/+qv/yb32aIZqj8b1dXV+YtZ3apWpZSzfGbFYjH4Uk3E8EmHbwI0ef3PziGAO7FVVqZSKfTsoVWK/S3PSnxpzi6fcjBkpIrZ4Aw0Bw0msxxjRoPPcHdBzObme7awe1Y2bqTcYm5paRF3wmfysbIoMat9xbJoHnuWNYYUzGJeu3atNK9xbvF4HJWIVnImu5jN7V11jUGchkV1f3Xyl5z/gmL2er3os0Vomob0LTMyh31ivnX3m3/7zcAfp24sUcwVFRWG0WJZg2s0fKMY/IpN6qJ58FhdYxYzTk/9bNI0DfvkOZLtDjHrzzv5Kx8xZ576eGBgwNAmy9gsZvQ0Siw47RNi3vXe4D/9+1mnidf/64ncZ7vEyV/5iFl8XF1dbegIyVh90qHnA4OvaMVKmctgBDLFhCOcw8DAQJ5itswud1e2ISNDi3kpYra8uxYl5n/4l0gRbqTcYvZ6veoXhqZpb731lqV9iynmjo6Ompoaeb+j9VxbW9ve3j4wMLBgi7lQYs6nKztjJeauri7zjZq/mP/xnZh9t8Q/N//u7oM7ucWcTCZzzPwqETEPDw+rhSw95BSzhZjRn5l59g2O79xQKCQvOEmku7tbbI2QPme0hCxP1TAFyVLMoVDIMO9swSidFnO4o/9v/2557rMtrJhhR0M5Y04A+pPVqQOyW475TalUym/6PTRymZiYMFSudGX7n85NQxjE3Nvbm60csokZGcnWPMWs9kVbirmhoUHtpM19MtmiCC3mxo7+HGKWLxV5u2F8XYZ1ly5mtZcYLfKvvvrKnIIqZoxMYzfZqnp6QTEjBXXkeHBwsJhilv5bNUqhxbz7vwb/MPmn2YVazJlM5pe//OVrr71m2SdcUVGhXmAqlRKLP5+Yjx49umLFCvVkIpFIQ0NDtq5sDHLLILQaZSRmvzJIbFjEnvLaUqfyqm9wvN/VAWPJFCPH8n7HuDK6uw2b0AjDUdgNbZRUKqV2U4tvcDLqLNw8W8zOivnj4fEd7w5M3Z5e+s+l8D0km8zVKjWCiXJiRPWWQLHLJjXTcDgsc/1Q4IZylm8sqUR0dBvErE7Nw9+Yswq1i5iRnShT0sxfzOosrWxizmQyVVVVIl2oyzz5C0nJ3Fq56tIRM26k67enc4jZ8vMCNs1kMkePHq2qqkKBYyhavNLR0YExdTnEUswtLS01NTVSZY2NjVIXOcS8du1ag8BUMWNWl4w9qwpXZbl27Vq1i17tGC+4mA07q3PWcMKW+WYLm8RssPKCYpYZXnLCyWRS1/V0Oh2JRGpqar777jusx7wtJJVDzBs3blR/KK8aFA30M2fOYBFZ9/X1GQan1Wb0z372s9dee03OXwq5jMQsk2vk1SOL2BPTfTFlzPC6lEQMv5tSM4VlMXxoaIThNY3EVTEjQZwGJsGaxZx5KhW/319dXe3z+RacJeu4mLs+vtp2fOjOt3fyqbgFxawrc+YzTz+PRMBozuKbBruZP5syTz+PDL9Nwt8iTnUIH29wKXPcM2pGyB09zD6fD1PHs9Us/pbXqyE7rM+nK1vNaEEx4xKkg1cdrlbni2F6sFwpfhVTImLGjZT89s5s9lnZaL+q09wQjY2NkC5mnqMc8AyKV1BctbW16s+lJAV1EdOea2trkY5IOpuYMY1ZHT7s7e1FV7ZUoipmGexHb4cIEjLGJnU2eMYGMaMk16xZg1xSqRR+HSRXbdlSzxZ2iNls5QXFnMlkJicnV6xY4Xn6gzRN00SWb7/9NgYXqqqqamtr5Sskh5g7OztxCH4uZTAoZIyxeU3TRNKZLGKenJxcuXKlz+erra3VNE0mfL04Ytaf/qM2EvjFgroGDjYv6sovng3p4Cc6aprqVnOm6EkzT9nFZxrEYNhBMlXzSiQShl/f6nmMLiMcFPOdb++0HR/q+vhq/hVnKOEcl6/+XE0KEwrHGkM65qrMkSlqQd3HMk3zHYKMsFu2mtWfneNtmV0+5WDOyHCTWy7Kr18kKXPJGK7U8mSyhR1ivvPtnf3P3kg5xGx4zNWLUotOuqmy3VqGYlmwlCxTk9LWnw218C3vFlmf7cVl+CI3ZG1YzF04ue8fQ7LmNQu2DTI2iNnSyvmIGYHq002/PpJqVddPTk6q12helHRGR0fNP14YHR2V0WJ1JdbgJlGzM+9vmaw5XCDmpYR5jNnV4aCY/+PIJx8Pjxet4jJL+yfSihNoIi92ooCLwg4x/8p0I/E/sXBXFFzMrUc/NVs5fzG/kEExuykc78qmmPEPciE8Hk8oFMrxTzG4PUrnP7FglE6U1H9i8aLGCy7mbB0+Lo2yEnOeHWvFD+k6K83TK2BQzAxzUMxFiBdczC9YlJWYGY4HxcwwB8VchKCY3RQUM6OYQTEzzEExFyEoZjcFxcwoZlDMDHNQzEUIitlNQTEzihkUM8McFHMRgmJ2U1DMjGIGxcwwB8VchKCY3RQUM6OYQTEzzEExFyEoZjcFxcwoZlDMDHNQzEUI58VcWVnpYeQXlZWVpSNmVtwLH5WVlUUQ809+8hOnL5SxiKisrCyOmH/60586fa2ORWVlpcNiJgWnOGIm5UnBxUwIWRQUsyuhmIl9UMyEOAvF7EooZmIfFDMhzkIxuxKKmdgHxUyIs1DMroRiJvZBMRPiLBSzK6GYiX1QzIQ4C8XsSihmYh8UMyHOQjG7EoqZ2AfFTIizUMyuhGIm9kExE+IsFLMroZiJfVDMhDgLxexKKGZiHxQzIc5CMbsSipnYB8VMiLNQzK6EYib2QTET4iwUsyuhmIl9UMyEOMvixHzy5MkeRgnEyZMnzXXG2mEwGIwXIE6ePLkIMRNCXnjmHz22/K/d+UIgxFkoZkLKFIqZkNKEYiakTKGYCSlNKGZCyhSKmZDShGImpEyhmAkpTShmQsoUipmQ0oRiJqRMoZgJKU0oZkLKFIqZkNKEYiakTKGYCSlNKGZCyhSKmZDSZP7RY8/jH5/MP3pMCCkrHv/4xFLMfCEQ4iyPf3zyf/khoi/dyJ68AAAAAElFTkSuQmCC" alt="" />

[Authorize] 属性

AuthorizeAttribute 是内置的授权筛选器。用户未通过身份验证时,它返回 HTTP 401 状态码。可以在全局,控制和 action 三个级别应用它。

在全局级别应用

public static void Register(HttpConfiguration config)
{
config.Filters.Add(new AuthorizeAttribute());
}

在控制器级别应用

[Authorize]
public class ValuesController : ApiController
{
public HttpResponseMessage Get(int id) { ... }
public HttpResponseMessage Post() { ... }
}

在 Action 级别应用

public class ValuesController : ApiController
{
public HttpResponseMessage Get() { ... } [Authorize]
public HttpResponseMessage Post() { ... }
}

在控制器上应用 [Authorize] 时,可以在 Action 上应用 [AllowAnonymous] 取消对某个 Action 的授权要求。上面的代码可以改成下面的形式:

[Authorize]
public class ValuesController : ApiController
{
[AllowAnonymous]
public HttpResponseMessage Get() { ... } public HttpResponseMessage Post() { ... }
}

指定用户和角色进行限制:

// 按用户限制访问
[Authorize(Users="Alice,Bob")]
public class ValuesController : ApiController
{
} // 按角色限制访问
[Authorize(Roles="Administrators")]
public class ValuesController : ApiController
{
}

用于 WebAPI 的 AuthorizeAttribute 位于 System.Web.Http 命名空间。在 System.Web.Mvc 命名空间中有一个同名属性,不可用于 WebAPI。

自定义授权筛选器

可从以下类型派生自定义授权筛选器

  • AuthorizeAttribute,基于用户和角色进行授权。
  • AuthorizationFilterAttribute,不基于用户和角色的同步授权。
  • IAuthorizationFilter,实现此接口执行异步授权逻辑。例如,授权逻辑中有对 IO 或网络的异步调用。(CPU-bound的授权逻辑更适合从 AuthorizationFilterAttribute 派生,这样不必写异步方法)。

下图是 AuthorizeAttribute 类层次

aaarticlea/png;base64,iVBORw0KGgoAAAANSUhEUgAAALQAAABvCAIAAADKVn2JAAAKPklEQVR4nO2dIXbdPhPFBQsDCx/ROYVdgEC24B30HG2gwDzIOMQ8QKDYK/AGtAGhMHcBBoX6g5vMN5Ys2/F7sV/7zQ8lfpI1Gl2P9HLaaxUFoYD6/v27EoSMN2GcLVDhHnnTyNlhCPeIiEMo8veJYxiGYRj29R3HMYSwe+gQwjiOu7tzaBbXTOezOU4ceRZCCNvzQi3btm3bdl8Mfd9baz/UhUdore37fse4ngF10iz4dMZxvJX4bsJx4sgXVWttjNnSt6oq6nuNOD6K9/4myVFKVe80TcM/4tNRSnnvrx/uVpwmDjzEWmv+aPK6TZUmhGCMqesaiaP7eO/zwkOPJqB9xHs/jiO/J3+aaVBcp77OOSwYeiUrxxvT6Ig8uZ5nmGbKp6OUcs7x+JPpoNcwDNdsjts5TRzW2q7rmqbhT1JVVZRWat80jVJKa11VFa43TYOnUCnVdR3ad12HBxQFCan33tMjG0Lg98RFY4xSCo3REUBV+LSqKoxCiQohUGOlFC0V4jHGJEUxzzDNlELCdIwxSAgNobWu65p6NU1DbT6bc8QxDAMGpR/ArDhitq3QcmIlYozjOPJFqusaCcXjOHtPujMdI6iZMQZqSLYV+rmqKuccfu66TmtNDej+Wmu6M2IAKEK5OOJ0W+FDQNn44aNnpms4RxzOOXoaaCXiZnHw5wbBo0LQRdKc955WLmbicM7luR6Goa5rXuqTsWJWCbTWWDxSbcxWnQoYJrsqDq4nioe6H8M54tBat22LmaPC4/pGcfAFnhVH6XpSvbTW/IhDhR3hxc3ioLD59WTVk2xsEUfFSCR1DCeIAxnnM1dKUbGlUtw0DWXNWrssDuzQdLHve2hiQRx8rBhjXddUxmnoEEJJHHQWxo6WNIi3EEf+tfbfFwcVSYKutG1rjPHe42sCF4S1Ns9mnJ4D0AYnUyx8SRzOOQxE31ZwTMHQVDlw/77vIQUaC3H2fd/3PT8eXikOFEjsUCiofd8jwqTXMRwnjq7rqDYmX0GxrcYYx3Fs2xY5ova4bq3F+YBfx92oDfqSjGKMIQR+QOExcPAVsa7rfOiu66jGcJ3henIISBrws1SSjaZpIALeLITAN1DnXPKnEep1DH/fn8+FwxBxCEVEHEIREYdQRMQhFBFxCEVEHEIRpZR6eHhQgpDx8PAgZeN/PD8/f/ny5eXl5exA7gURxxt//vy5XC6/fv16fHw8O5Z7QcTxxvPz88+fP2OMl8vl9fX17HDuAhFHjO9l4/fv3zHGp6enp6ensyO6C0QcMbKyEWN8fX29XC7nxnMniDgmZQM8Pj7u+18I/xgijknZAC8vLz9+/DgrnvtBxBG/ffuWf8v/+vXr2XGdj4hjgpK/FzMkFxNEHBzJxQQRB0dyMUHEwZFcTBBxcCQXE0QcHMnFBBEHR3IxQcTBkVxMEHFwJBcTRBwcycUEEQdHcjFBxMERe2thHrG3Foq8aeTsMIR7RMQhFBFxCEU+Vxy5teN2uIXjDrTWtzLeI+PKa6ZzPTSjw8yftorDGLPRAZMbvR2ZzcQzbjf8uJ7YNfHpwFLsozfP05iEzbNX4qPi2Bdq3CgO8vLdYtv+D/iUlz4qOf9tZDaNSdg8eyU+Ko4doVLHdXHAhpGbMcaCZyh8I+meuE7+1GR2FkKw1qIZuaHB+Q+Nvfez91TvHo91XfPuSDFAL5oUnODwkbWWFkYphaeWxxDnxJE7/yWlhQ/BTeJgTEjlJ09jEnaePXgK4lcKDAZ2uM6zOrsiW0ItsS4O+GyO45i4AW+3okYzbkartUaChmEwxpA/KV2Pc1Un2bDwAgpykS4ZyuLEgMbwC6QGuA67Y+5fnmRg1TOUhoDxLXmqVlVFWiylcaFytG3L156LwxhDr+agu5VWZDXUEuvi6LqOtkmt9awn5oI4yMaazFy999w0njbdJE2JOJJeBClmwW2Yl3GqPYoZzXLZ8SpFpWu7oWzbttA3Ny9fSOOyOPgBhYuDP/RcjqvimA21xLo4eCh8sY+0okaFoGeILEexKayKI5nOZ1hRL0hqOY3L4sizN3tn/LpRHHmoJVbEgZKbAOldI46kcuDXBXEkZ3gkF87D1Gx75cCvtxVHnjqen4U07hMHrxyrK7IaaokVcTRNQxpPIqvrGkUPBuF8SnS+K02vdOaYFUe+oVhr0R1bEs8CP2/ih4UzRz5W3CwObp2Oc3TyVY4v1UIaY1bqV7OH0wwdzPmBd3ZFVkMtsSIOxU5qgF5xQq8ZwHgUCiJT7NtKPj34OCeVrSSO5IHz3tO3jGRonMOhGxqLn8+hkiSYuEsccFjHYsB9G0OQjrk4FtKYhL0le/Q9CBnIX/yQpGU11BIr4hD+nxFxCEVEHEIREYdQRMQhFBFxCEVEHEIRpcTeWigg9tYTxN46QcTxhthb54g43hB76xwRR4xib11AxBGj2FsXEHGIvXUREYfYWxcRcYi9dRERxwQlfy9mSC4miDg4kosJIg6O5GKCiIMjuZgg4uBILiaIODiSiwkiDo7kYoKIgyO5mCDi4EguJog4OJKLCSIOjuRigoiDI/bWwjxiby0UedPI2WEI94iIQygi4hCK/E3i6Lput2N13/cbHZhviLUW/xC1aZrE2eev4BxxbDFxBlwQiQ3ShxjHcd/y5KHCQHc2woQQQm7ltnHQexDTCeKAPerGQc8yywazocLlcjbCEocZUt+WE8QBwzxrLX/g+PMXQoCjHvliYzEgDjg7c+u3cRydc1VVURmnm6BxCIHuDyNlAp58wzDAli9Z5jxUvMtBKYXbJhFiFFIPaQjiwHUeOa8QFCFM34wxZCvYdR1md3A5OUEccNzFhOkirwpkKwiLUliOog18KdGAzhD42XsP2zxyu6a+3K40hOC9996TMSOslXFbay3XRx4qZIT3EGCryiN0ziU+uBAirltrE9EkGYAzqXOODKyNMX3fQ5cbXSJvwtHi6PueHA4VM5ieFUfMthW+SAg7eSUF3R8p5v6efNWxX+BTmNXjOqySV0MtbStYSPqIi4PakAl63Gwry224b/USmS0cLQ7+zoC6rmcNWRfEkfty7jDLjlPf1rZtsS8AysZCqAviKDmHXmNITbFxR94DOFQceGiMMZgqXj6Cj24lDpSE/Drv65zjX2vbd7NsYjXUHeLg/7mSisFGcfDYlt9zcFsOFQeOjXyq9EIMfIRm3LJ54b1PCBurSCc1euVWSRx8QwE4UiR7+UKoOORSy9UI4/upiIajnYuOOOM4ks13nL5bicY9nkPFkc+THmJs9sYYnO8o+33fq/cXyZRSj3Moqi4tc0kcxhi+iUBVMJjGFWzqC6HiuEN9t0QIv2mMy6WMgxEqEz8LozE2MhheUw3bnfwdHCqO/Ls7Xk7DGwzDkPzBKoSAX4dh4EWVd8R9eK/kJtTXT+HG4fwOy6Gi8fYI8dcw9EpKFG6LT5O+ya9538/mb/rzuXAwIg6hiIhDKCLiEIqIOIQiIg6hiFJiby0UEHtrYYn/ALyp0dEEvp1pAAAAAElFTkSuQmCC" alt="" />

在 Action 中执行验证

可在控制器中检查 ApiController.User 属性,根据用户和角色使用不同的逻辑。

public HttpResponseMessage Get()
{
if (User.IsInRole("Administrators"))
{
// ...
}
}

原文地址:http://www.asp.net/web-api/overview/security/authentication-and-authorization-in-aspnet-web-api

ASP.NET WEBAPI 的身份验证和授权的更多相关文章

  1. 使用JWT的ASP.NET CORE令牌身份验证和授权(无Cookie)——第1部分

    原文:使用JWT的ASP.NET CORE令牌身份验证和授权(无Cookie)--第1部分 原文链接:https://www.codeproject.com/Articles/5160941/ASP- ...

  2. ASP.NET Web API身份验证和授权

    英语原文地址:http://www.asp.net/web-api/overview/security/authentication-and-authorization-in-aspnet-web-a ...

  3. asp.net webapi 自定义身份验证

    /// <summary> /// 验证 /// </summary> /// Account API账号 /// TimeStamp 请求时间 /// Sign 所有请求参数 ...

  4. 从零搭建一个IdentityServer——聊聊Asp.net core中的身份验证与授权

    OpenIDConnect是一个身份验证服务,而Oauth2.0是一个授权框架,在前面几篇文章里通过IdentityServer4实现了基于Oauth2.0的客户端证书(Client_Credenti ...

  5. ASP.NET MVC5学习系列——身份验证、授权

    一.什么是身份验证和授权 人们有时对用户身份验证和用户授权之间的区别感到疑惑.用户身份验证是指通过某种形式的登录机制(包括用户名/密码.OpenID.OAuth等说明身份的项)来核实用户的身份.授权验 ...

  6. 关于WEB Service&WCF&WebApi实现身份验证之WebApi篇

    之前先后总结并发表了关于WEB Service.WCF身份验证相关文章,如下: 关于WEB Service&WCF&WebApi实现身份验证之WEB Service篇. 关于WEB S ...

  7. 关于WEB Service&WCF&WebApi实现身份验证之WCF篇(2)

    因前段时间工作变动(换了新工作)及工作较忙暂时中断了该系列文章,今天难得有点空闲时间,就继续总结WCF身份验证的其它方法.前面总结了三种方法(详见:关于WEB Service&WCF& ...

  8. 也谈Asp.net 中的身份验证

    钱李峰 的这篇博文<Asp.net中的认证与授权>已对Asp.net 中的身份验证进行了不错实践.而我这篇博文,是从初学者的角度补充了一些基础的概念,以便能有个清晰的认识. 一.配置安全身 ...

  9. ASP.NET Core2.2 多用户验证和授权

    asp.net core2.2 用户验证 和授权有很详细和特贴心的介绍,我感兴趣的主要是这两篇: cookie身份验证 基于角色的授权 我的项目有两类用户: 微信公众号用户,用户名为公众号的openi ...

随机推荐

  1. iOS--通讯录、蓝牙、内购、GameCenter、iCloud、Passbook等系统服务开发汇总

    iOS开发过程中有时候难免会使用iOS内置的一些应用软件和服务,例如QQ通讯录.微信电话本会使用iOS的通讯录,一些第三方软件会在应用内发送短信等.今天将和大家一起学习如何使用系统应用.使用系统服务: ...

  2. Android笔记——Android中visibility属性VISIBLE、INVISIBLE、GONE的区别

    在Android开发中,大部分控件都有visibility这个属性,其属性有3个分别为"visible "."invisible"."gone&quo ...

  3. webpack摸索(一)webpack-dev-server热模块替换

    webpack-dev-server 是生成在内存中的 本地开发: index.html <!DOCTYPE html> <html lang="en"> ...

  4. Go 作用

    Go语句的作用是表示一个batch(多条Tsql命令)的结束,并向sql server 提交batch,由于局部变量的作用域是基于batch的,所以,go语句限制局部变量的作用域在一个batch中. ...

  5. jQuery源码分析系列(37) : Ajax 总结

    综合前面的分析,我们总结如下3大块: jQuery1.5以后,AJAX模块提供了三个新的方法用于管理.扩展AJAX请求 前置过滤器 jQuery. ajaxPrefilter 请求分发器 jQuery ...

  6. Android 之 ProgressDialog用法介绍

    布局文件测试: <LinearLayout xmlns:android="http://schemas.android.com/apk/res/android" androi ...

  7. 【开源】OSharp框架解说系列(5.2):EntityFramework数据层实现

    OSharp是什么? OSharp是个快速开发框架,但不是一个大而全的包罗万象的框架,严格的说,OSharp中什么都没有实现.与其他大而全的框架最大的不同点,就是OSharp只做抽象封装,不做实现.依 ...

  8. UWP开发之Mvvmlight实践二:Mvvmlight的核心框架MVVM与MVC、MVP的区别(图文详解)

    最近UWP开发在海外很潮流,随着微软收购Xamarin,我们这些C#程序员也可以靠这杆小米枪挑战Android,IOS平台了. 那我们为什么选择MVVM做UWP开发?MVC,MVP,MVVM他们之间到 ...

  9. MySQL的多存储引擎架构

    支持多种存储引擎是众所周知的MySQL特性,也是MySQL架构的关键优势之一.如果能够理解MySQL Server与存储引擎之间是怎样通过API交互的,将大大有利于理解MySQL的核心基础架构.本文将 ...

  10. ORM小结

    最近看园子里 @李林峰的园子 关于ORM的介绍,真的很好.自己看了也有一点点小心的,记录一下. ORM即为一种数据模型和数据库中关系映射的一种方式. 学过“三层架构”,知道怎么把表 示层(UI)--& ...