c# webapi 过滤器token、sign认证、访问日志

1、token认证

服务端登录成功后分配token字符串。记录缓存服务器，可设置有效期

var token = Guid.NewGuid().ToString().Replace("-", "");
var expire = DateTime.Now.AddHours();
var timespan = ( expire- DateTime.Now);
var key = string.Format("login-{0}", apiRm.Result.UserID);
RedisCacheHelper.SetCacheByKey<string>(key, JsonHelper.ToJson(apiRm.Result), timespan);

通过header传入token后进行服务端认证有效性

curl -X POST --header 'Content-Type: application/json' --header 'Accept: application/json' --header 'token: 1000-e0622f06a9a842a5b79a5295e6d4b235' -d

在controller或action可设置属性是否要验证token

controller：[RoutePrefix("api/Out"), OperateTrack, AuthToken(AuthTypeEnum.Driver)]
或
action：[HttpPost, Route("GetOutInfo")，AuthToken(AuthTypeEnum.Driver)]
 
读取过滤器传过来的信息：
var user = ControllerContext.RouteData.Values["user"];
var user1 = HttpContext.Current.User;

创建AuthTokenAttribute继承AuthorizeAttribute

public class AuthTokenAttribute : AuthorizeAttribute
    {
        public AuthTypeEnum VerifyAuth { get; set; }
 
        public AuthTokenAttribute() { this.VerifyAuth = AuthTypeEnum.Common; }
 
        public AuthTokenAttribute(AuthTypeEnum verifyAuth)
        {
            this.VerifyAuth = verifyAuth;
        }
 
        protected override bool IsAuthorized(System.Web.Http.Controllers.HttpActionContext actionContext)
        {
            var request = actionContext.Request;
            if(VerifyAuth== AuthTypeEnum.Driver)
            {
                var rm= AuthDriver(actionContext);
                if (!rm.IsSuccess)
                    return false;
            }
            return true;
        }
    　　 protected override void HandleUnauthorizedRequest(System.Web.Http.Controllers.HttpActionContext actionContext)
        {
            StringBuilder sbMsg = new StringBuilder();
            if (VerifyAuth == AuthTypeEnum.Driver)
            {
                var rm = AuthDriver(actionContext);
                if (!rm.IsSuccess)
                    sbMsg.Append(rm.Message);
            }
            var content = JsonConvert.SerializeObject(new ResultApiModel { IsSuccess = false, Message = sbMsg.ToString() + ",验证失败,状态：" + (int)HttpStatusCode.Unauthorized, Code = ((int)HttpStatusCode.Unauthorized).ToString() });
            actionContext.Response = new HttpResponseMessage
            {
                Content = new StringContent(content, Encoding.UTF8, "application/json"),
                StatusCode = HttpStatusCode.Unauthorized
            };
        }
 
 　　　　private ResultApiModel AuthDriver(System.Web.Http.Controllers.HttpActionContext actionContext)
        {
            //todo 验证token
            //向action传值，在action中可以使用：var user =         ControllerContext.RouteData.Values["user"];获取到
            actionContext.ControllerContext.RouteData.Values["user"] = v;
            SetPrincipal(new UserPrincipal<int>(tokenV));
            return ResultApiModel.Create(true);
        }
        public static void SetPrincipal(IPrincipal principal)
        {
            Thread.CurrentPrincipal = principal;
            //每次都重新覆盖user，避免不同用户对不同action的访问
            if (HttpContext.Current != null)
            {
                HttpContext.Current.User = principal;
            }
        }
}
public enum AuthTypeEnum
    {
        Common=,
        Driver=
    }  
 
IPrincipal：

public class UserIdentity<TKey> : IIdentity
    {
        public UserIdentity(IUser<TKey> user)
        {
            if (user != null)
            {
                IsAuthenticated = true;
                UserID = user.UserID;
                LoginNo = user.LoginNo.ToString();
                Name = user.LoginNo.ToString();
                UserName = user.UserName;
                RoleCode = user.RoleCode;
                token = user.token;
            }
        }
 
        public string AuthenticationType
        {
            get { return "CustomAuthentication"; }
        }
 
        public TKey UserID { get; private set; }
 
        public bool IsAuthenticated { get; private set; }
 
        public string LoginNo { get; private set; }
 
        public string Name { get; private set; }
 
        public string UserName { get; private set; }
 
        public string RoleCode { get; private set; }
 
        public string token { get; private set; }
    }
 
    public class UserPrincipal<TKey> : IPrincipal
    {
        public UserPrincipal(UserIdentity<TKey> identity)
        {
            Identity = identity;
        }
 
        public UserPrincipal(IUser<TKey> user)
            : this(new UserIdentity<TKey>(user))
        {
 
        }
 
        /// <summary>
        ///
        /// </summary>
        public UserIdentity<TKey> Identity { get; private set; }
 
        IIdentity IPrincipal.Identity
        {
            get { return Identity; }
        }
 
        bool IPrincipal.IsInRole(string role)
        {
            throw new NotImplementedException();
        }
    }
 
    public interface IUser<T>
    {
        /// <summary>
        /// 用户id
        /// </summary>
        T UserID { get; set; }
 
        /// <summary>
        /// 登录账号
        /// </summary>
        string LoginNo { get; set; }
        /// <summary>
        /// 用户名称
        /// </summary>
        string UserName { get; set; }
        /// <summary>
        /// 角色编号
        /// </summary>
        string RoleCode { get; set; }
 
        /// <summary>
        /// 登录后分配token
        /// </summary>
        string token { get; set; }
    }

2、验证签名：

约定签名规则

controller或action增加属性验证

[AuthSign(AuthSignTypeEnum.Common)]

创建AuthSignAttribute继承AuthorizeAttribute

public class AuthSignAttribute : AuthorizeAttribute
    {
        public AuthSignTypeEnum AuthSignType { get; set; }
        public AuthSignAttribute() { this.AuthSignType = AuthSignTypeEnum.Common; }
        public AuthSignAttribute(AuthSignTypeEnum authSignType)
        {
            this.AuthSignType = authSignType;
        }
        /// <summary>
        /// 公共请求主体数据
        /// </summary>
        private string CommonRequestBodyData { get; set; }
 
        /// <summary>
        /// 权限验证
        /// </summary>
        /// <param name="actionContext"></param>
        /// <returns></returns>
        protected override bool IsAuthorized(System.Web.Http.Controllers.HttpActionContext actionContext)
        {
            var request = actionContext.Request;
            var requestBodyData = StreamHelper.GetStream2String(request.Content.ReadAsStreamAsync().Result);
            if (AuthSignType == AuthSignTypeEnum.Common)
            {
                CommonRequestBodyData = requestBodyData.TrimStart("data=".ToCharArray());
                var urlParam = GetUrlParam(actionContext);
                if (!urlParam.IsSuccess) return false;
                var rm = AuthSignCommon(urlParam.Result, CommonRequestBodyData);
                if (!rm.IsSuccess)
                    return false;
            }
 
            return true;
        }
 
        private ResultApiModel AuthSignCommon(CommonRequestApiModel request, string requestBodyData)
        {
            //todo 验证signreturn ResultApiModel.Create(true);
        }/// <summary>
        ///     处理未授权的请求
        /// </summary>
        /// <param name="actionContext"></param>
        protected override void HandleUnauthorizedRequest(System.Web.Http.Controllers.HttpActionContext actionContext)
        {
            StringBuilder sbMsg = new StringBuilder();
            if (AuthSignType == AuthSignTypeEnum.Common)
            {
                //todo 处理验证失败信息
            }
            var content = JsonConvert.SerializeObject(new ResultApiModel { IsSuccess = false, Message = sbMsg.ToString() + " 签名验证失败，状态：" + HttpStatusCode.Unauthorized });
            actionContext.Response = new HttpResponseMessage
            {
                Content = new StringContent(content, Encoding.UTF8, "application/json"),
                StatusCode = HttpStatusCode.Unauthorized
            };
        }
    }
    /// <summary>
    /// 签名类型
    /// </summary>
    public enum AuthSignTypeEnum
    {
        Common =
    }

3、访问日志：

controller或action增加属性

[RoutePrefix("api/Out"), OperateTrack, AuthToken(AuthTypeEnum.Driver)]

不需要日志可以[NoLog]

[AttributeUsage(AttributeTargets.Method | AttributeTargets.Class, Inherited = true)]
    public class NoLogAttribute : Attribute
    {
    }

继承：ActionFilterAttribute

public class OperateTrackAttribute : ActionFilterAttribute
    {
        /// <summary>
        /// 自定义参数
        /// </summary>
        public string msg { get; set; }
        public OperateTrackAttribute()
        {
 
        }
 
        /// <summary>
        /// 初始化时填入类的说明
        /// </summary>
        /// <param name="message"></param>
        public OperateTrackAttribute(string message)
        {
            msg = message;
        }
 
        private static readonly string key = "enterTime";
        public override Task OnActionExecutingAsync(System.Web.Http.Controllers.HttpActionContext actionContext, CancellationToken cancellationToken)
        {
            if (SkipLogging(actionContext))
            {
                return base.OnActionExecutingAsync(actionContext, cancellationToken);
 
            }
            //记录进入请求的时间
            actionContext.Request.Properties[key] = DateTime.Now.ToBinary();
 
            return base.OnActionExecutingAsync(actionContext, cancellationToken);
        }
        /// <summary>
        /// 在请求执行完后 记录请求的数据以及返回数据
        /// </summary>
        /// <param name="actionExecutedContext"></param>
        /// <param name="cancellationToken"></param>
        /// <returns></returns>
        public override Task OnActionExecutedAsync(HttpActionExecutedContext actionExecutedContext, CancellationToken cancellationToken)
        {
            object beginTime = null;
            if (actionExecutedContext.Request.Properties.TryGetValue(key, out beginTime))
            {
                DateTime time = DateTime.FromBinary(Convert.ToInt64(beginTime));
                HttpRequest request = HttpContext.Current.Request;
                string token = request.Headers["token"];
 
                WebApiActionLogModel apiActionLog = new WebApiActionLogModel
                {
                    Id = Guid.NewGuid(),
                    //获取action名称
                    actionName = actionExecutedContext.ActionContext.ActionDescriptor.ActionName,
                    //获取Controller 名称
                    controllerName = actionExecutedContext.ActionContext.ActionDescriptor.ControllerDescriptor.ControllerName,
                    //获取action开始执行的时间
                    enterTime = time,
                    //获取执行action的耗时
                    costTime = (DateTime.Now - time).TotalMilliseconds,
                    navigator = request.UserAgent,
                    token = token,
                    //获取用户token
                    userId = getUserByToken(token),
                    //获取访问的ip
                    ip = request.UserHostAddress,
                    userHostName = request.UserHostName,
                    urlReferrer = request.UrlReferrer != null ? request.UrlReferrer.AbsoluteUri : "",
                    browser = request.Browser.Browser + " - " + request.Browser.Version + " - " + request.Browser.Type,
                    //获取request提交的参数
                    paramaters = StreamHelper.GetStream2String(actionExecutedContext.Request.Content.ReadAsStreamAsync().Result),
                    //获取response响应的结果
                    executeResult = StreamHelper.GetStream2String(actionExecutedContext.Response.Content.ReadAsStreamAsync().Result),
                    comments = msg,
                    RequestUri = request.Url.AbsoluteUri
                };
                //记debug
                Log.DefaultLogDebug(string.Format("actionExecutedContext {0} 请求：{1}", apiActionLog.controllerName + "/" + apiActionLog.actionName, JsonHelper.ToJson(apiActionLog)));
            }
            return base.OnActionExecutedAsync(actionExecutedContext, cancellationToken);
 
        }
        /// <summary>
        /// 获取当前登录用户的id
        /// </summary>
        /// <param name="token"></param>
        /// <returns></returns>
        public static string getUserByToken(string token)
        {
            UserIdentity<int> u = HttpContext.Current.User.Identity as UserIdentity<int>;
            if (u == null) return "未登录用户" + token;
            return u.LoginNo.ToString();
        }
 
        /// <summary>
        /// 判断类和方法头上的特性是否要进行Action拦截
        /// </summary>
        /// <param name="actionContext"></param>
        /// <returns></returns>
        private static bool SkipLogging(System.Web.Http.Controllers.HttpActionContext actionContext)
        {
            return actionContext.ActionDescriptor.GetCustomAttributes<NoLogAttribute>().Any() || actionContext.ActionDescriptor.ControllerDescriptor.GetCustomAttributes<NoLogAttribute>().Any();
        }
    }