ASP.NET Web API 安全验证之摘要（Digest）认证

在基本认证的方式中，主要的安全问题来自于用户信息的明文传输，而在摘要认证中，主要通过一些手段避免了此问题，大大增加了安全性。

1.客户端匿名的方式请求 (无认证)

HTTP/1.0  Unauthorized
Server: HTTPd/0.9
Date: Sun,  Apr  :: GMT
WWW-Authenticate: Digest realm="testrealm@host.com",
                        qop="auth,auth-int",
                        nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093",
                        opaque="5ccc069c403ebaf9f0171e9517f40e41"  

3.客户端请求  (用户名 "Mufasa", 密码 "Circle Of Life")

客户端接受到请求返回后，进行HASH运算，返回Authorization参数

其中：realm，nonce，qop由服务器产生；

uri：客户端想要访问的URI；

nc：“现时”计数器，这是一个16进制的数值，即客户端发送出请求的数量（包括当前这个请求），这些请求都使用了当前请求中这个“现时”值。例如，对一个给定的“现时”值，在响应的第一个请求中，客户端将发送“nc=00000001”。这个指示值的目的，是让服务器保持这个计数器的一个副本，以便检测重复的请求。如果这个相同的值看到了两次，则这个请求是重复的；

cnonce：这是一个不透明的字符串值，由客户端提供，并且客户端和服务器都会使用，以避免用明文文本。这使得双方都可以查验对方的身份，并对消息的完整性提供一些保护；

response：这是由用户代理软件计算出的一个字符串，以证明用户知道口令。

<strong>response计算过程：</strong>
HA1=MD5(A1)=MD5(username:realm:password)
如果 qop 值为“auth”或未指定，那么 HA2 为
HA2=MD5(A2)=MD5(method:digestURI)
如果 qop 值为“auth-int”，那么 HA2 为
HA2=MD5(A2)=MD5(method:digestURI:MD5(entityBody))
如果 qop 值为“auth”或“auth-int”，那么如下计算 response：
response=MD5(HA1:nonce:nonceCount:clientNonce:qop:HA2)
如果 qop 未指定，那么如下计算 response：
response=MD5(HA1:nonce:HA2) 

请求头：

GET /dir/index.html HTTP/1.0
Host: localhost
Authorization: Digest username="Mufasa",
                     realm="testrealm@host.com",
                     nonce="dcd98b7102dd2f0e8b11d0f600bfb0c093",
                     uri="/dir/index.html",
                     qop=auth,
                     nc=,
                     cnonce="0a4f113b",
                     response="6629fae49393a05397450978507c4ef1",
                     opaque="5ccc069c403ebaf9f0171e9517f40e41"  

4.服务器响应

当服务器接收到摘要响应，也要重新计算响应中各参数的值，并利用客户端提供的参数值，和服务器上存储的口令，进行比对。如果计算结果与收到的客户响应值是相同的，则客户已证明它知道口令，因而客户的身份验证通过。

二、服务端验证

编写一个自定义消息处理器，需要通过System.Net.Http.DelegatingHandler进行派生，并重写SendAsync方法。

AuthenticationHandler类：

public class AuthenticationHandler : DelegatingHandler
{
    protected async override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
    {
        try
        {
            HttpRequestHeaders headers = request.Headers;
            if (headers.Authorization != null)
            {
                Header header = new Header(request.Headers.Authorization.Parameter, request.Method.Method);  

                if (Nonce.IsValid(header.Nonce, header.NounceCounter))
                {
                    // Just assuming password is same as username for the purpose of illustration
                    string password = header.UserName;  

                    string ha1 = String.Format("{0}:{1}:{2}", header.UserName, header.Realm, password).ToMD5Hash();  

                    string ha2 = String.Format("{0}:{1}", header.Method, header.Uri).ToMD5Hash();  

                    string computedResponse = String.Format("{0}:{1}:{2}:{3}:{4}:{5}",
                                        ha1, header.Nonce, header.NounceCounter,header.Cnonce, "auth", ha2).ToMD5Hash();  

                    if (String.CompareOrdinal(header.Response, computedResponse) == )
                    {
                        // digest computed matches the value sent by client in the response field.
                        // Looks like an authentic client! Create a principal.
                        var claims = new List<Claim>
                        {
                                        new Claim(ClaimTypes.Name, header.UserName),
                                        new Claim(ClaimTypes.AuthenticationMethod, AuthenticationMethods.Password)
                        };  

                        ClaimsPrincipal principal = new ClaimsPrincipal(new[] { new ClaimsIdentity(claims, "Digest") });  

                        Thread.CurrentPrincipal = principal;  

                        if (HttpContext.Current != null)
                            HttpContext.Current.User = principal;
                    }
                }
            }  

            HttpResponseMessage response = await base.SendAsync(request, cancellationToken);  

            if (response.StatusCode == HttpStatusCode.Unauthorized)
            {
                response.Headers.WwwAuthenticate.Add(new AuthenticationHeaderValue("Digest",Header.UnauthorizedResponseHeader.ToString()));
            }  

            return response;
        }
        catch (Exception)
        {
            var response = request.CreateResponse(HttpStatusCode.Unauthorized);
            response.Headers.WwwAuthenticate.Add(new AuthenticationHeaderValue("Digest",Header.UnauthorizedResponseHeader.ToString()));  

            return response;
        }
    }
}  

Header类：

public class Header
{
    public Header() { }  

    public Header(string header, string method)
    {
        string keyValuePairs = header.Replace("\"", String.Empty);  

        foreach (string keyValuePair in keyValuePairs.Split(','))
        {
            int index = keyValuePair.IndexOf("=", System.StringComparison.Ordinal);
            string key = keyValuePair.Substring(, index);
            string value = keyValuePair.Substring(index + );  

            switch (key)
            {
                case "username": this.UserName = value; break;
                case "realm": this.Realm = value; break;
                case "nonce": this.Nonce = value; break;
                case "uri": this.Uri = value; break;
                case "nc": this.NounceCounter = value; break;
                case "cnonce": this.Cnonce = value; break;
                case "response": this.Response = value; break;
                case "method": this.Method = value; break;
            }
        }  

        if (String.IsNullOrEmpty(this.Method))
            this.Method = method;
    }  

    public string Cnonce { get; private set; }
    public string Nonce { get; private set; }
    public string Realm { get; private set; }
    public string UserName { get; private set; }
    public string Uri { get; private set; }
    public string Response { get; private set; }
    public string Method { get; private set; }
    public string NounceCounter { get; private set; }  

    // This property is used by the handler to generate a
    // nonce and get it ready to be packaged in the
    // WWW-Authenticate header, as part of 401 response
    public static Header UnauthorizedResponseHeader
    {
        get
        {
            return new Header()
            {
                Realm = "MyRealm",
                Nonce = WebApiDemo.Nonce.Generate()
            };
        }
    }  

    public override string ToString()
    {
        StringBuilder header = new StringBuilder();
        header.AppendFormat("realm=\"{0}\"", Realm);
        header.AppendFormat(",nonce=\"{0}\"", Nonce);
        header.AppendFormat(",qop=\"{0}\"", "auth");
        return header.ToString();
    }
}  

nonce类

public class Nonce
{
    private static ConcurrentDictionary<string, Tuple<int, DateTime>>
    nonces = new ConcurrentDictionary<string, Tuple<int, DateTime>>();  

    public static string Generate()
    {
        byte[] bytes = new byte[];  

        using (var rngProvider = new RNGCryptoServiceProvider())
        {
            rngProvider.GetBytes(bytes);
        }  

        string nonce = bytes.ToMD5Hash();  

        nonces.TryAdd(nonce, new Tuple<int, DateTime>(, DateTime.Now.AddMinutes()));  

        return nonce;
    }  

    public static bool IsValid(string nonce, string nonceCount)
    {
        Tuple<int, DateTime> cachedNonce = null;
        //nonces.TryGetValue(nonce, out cachedNonce);
        nonces.TryRemove(nonce, out cachedNonce);//每个nonce只允许使用一次  

        if (cachedNonce != null) // nonce is found
        {
            // nonce count is greater than the one in record
            if (Int32.Parse(nonceCount) > cachedNonce.Item1)
            {
                // nonce has not expired yet
                if (cachedNonce.Item2 > DateTime.Now)
                {
                    // update the dictionary to reflect the nonce count just received in this request
                    //nonces[nonce] = new Tuple<int, DateTime>(Int32.Parse(nonceCount), cachedNonce.Item2);  

                    // Every thing looks ok - server nonce is fresh and nonce count seems to be
                    // incremented. Does not look like replay.
                    return true;
                }  

            }
        }  

        return false;
    }
}  

需要使用摘要验证可在代码里添加Attribute [Authorize]，如：

[Authorize]
public class ProductsController : ApiController 

最后Global.asax里需注册下

GlobalConfiguration.Configuration.MessageHandlers.Add(
new AuthenticationHandler());  

三、客户端的调用

这里主要说明使用WebClient调用

public static string Request(string sUrl, string sMethod, string sEntity, string sContentType,
    out string sMessage)
{
    try
    {
        sMessage = "";
        using (System.Net.WebClient client = new System.Net.WebClient())
        {
            client.Credentials = CreateAuthenticateValue(sUrl);
            client.Headers = CreateHeader(sContentType);  

            Uri url = new Uri(sUrl);
            byte[] bytes = Encoding.UTF8.GetBytes(sEntity);
            byte[] buffer;
            switch (sMethod.ToUpper())
            {
                case "GET":
                    buffer = client.DownloadData(url);
                    break;
                case "POST":
                    buffer = client.UploadData(url, "POST", bytes);
                    break;
                default:
                    buffer = client.UploadData(url, "POST", bytes);
                    break;
            }  

            return Encoding.UTF8.GetString(buffer);
        }
    }
    catch (WebException ex)
    {
        sMessage = ex.Message;
        var rsp = ex.Response as HttpWebResponse;
        var httpStatusCode = rsp.StatusCode;
        var authenticate = rsp.Headers.Get("WWW-Authenticate");  

        return "";
    }
    catch (Exception ex)
    {
        sMessage = ex.Message;
        return "";
    }
}  

关键代码，在这里添加用户认证，使用NetworkCredential

private static CredentialCache CreateAuthenticateValue(string sUrl)
{
    CredentialCache credentialCache = new CredentialCache();
    credentialCache.Add(new Uri(sUrl), "Digest", new NetworkCredential("Lime", "Lime"));  

    return credentialCache;
}  

https://www.cnblogs.com/ywolf123/p/5340938.html  利用DelegatingHandler实现Web Api 的Api key校验