Web用户的身份验证及WebApi权限验证流程的设计和实现

5. WebApi 服务端代码示例

5.1 控制器基类ApiControllerBase

[csharp] view plaincopy

 

1. ///
2. /// Controller的基类，用于实现适合业务场景的基础功能
3. ///
4. ///
5. [BasicAuthentication]
6. public abstract class ApiControllerBase : ApiController
7. {
8. }

5.2
权限属性BaseAuthenticationAttribute

[csharp] view
plaincopy

 

1. ///
2. /// 基本验证Attribtue，用以Action的权限处理
3. ///
4. public class
   BasicAuthenticationAttribute :
   ActionFilterAttribute
5. {
6. ///
7. /// 检查用户是否有该Action执行的操作权限
8. ///
9. ///
10. public override void
    OnActionExecuting(HttpActionContext
    actionContext)
11. {
12. //检验用户ticket信息，用户ticket信息来自调用发起方
13. if
    (actionContext.Request.Headers.Authorization != null)
14. {
15. //解密用户ticket,并校验用户名密码是否匹配
16. var encryptTicket =
    actionContext.Request.Headers.Authorization.Parameter;
17. if
    (ValidateUserTicket(encryptTicket))
18. base.OnActionExecuting(actionContext);
19. else
20. actionContext.Response = new
    HttpResponseMessage(HttpStatusCode.Unauthorized);
21. }
22. else
23. {
24. //检查web.config配置是否要求权限校验
25. bool
    isRquired =
    (WebConfigurationManager.AppSettings["WebApiAuthenticatedFlag"].ToString()
    == "true");
26. if
    (isRquired)
27. {
28. //如果请求Header不包含ticket，则判断是否是匿名调用
29. var attr =
    actionContext.ActionDescriptor.GetCustomAttributes().OfType();
30. bool
    isAnonymous = attr.Any(a => a is
    AllowAnonymousAttribute);
31. //是匿名用户，则继续执行；非匿名用户，抛出“未授权访问”信息
32. if
    (isAnonymous)
33. base.OnActionExecuting(actionContext);
34. else
35. actionContext.Response = new
    HttpResponseMessage(HttpStatusCode.Unauthorized);
36. }
37. else
38. {
39. base.OnActionExecuting(actionContext);
40. }
41. }
42. }
43. ///
44. /// 校验用户ticket信息
45. ///
46. ///
47. ///
48. private bool
    ValidateUserTicket(string
    encryptTicket)
49. {
50. var userTicket =
    FormsAuthentication.Decrypt(encryptTicket);
51. var userTicketData =
    userTicket.UserData;
52. string
    userName = userTicketData.Substring(0,
    userTicketData.IndexOf(":"));
53. string
    password =
    userTicketData.Substring(userTicketData.IndexOf(":")
    + 1);
54. //检查用户名、密码是否正确，验证是合法用户
55. //var isQuilified = CheckUser(userName,
    password);
56. return true;
57. }
58. }

5.3
api服务Controller实例

[csharp] view
plaincopy

 

1. public class
   ProductController : ApiControllerBase
2. {
3. [HttpGet]
4. public object
   Find(string
   id)
5. {
6. return
   ProductServiceInstance.Find(2);
7. }
8. // GET api/product/5
9. [HttpGet]
10. [AllowAnonymous]
11. public
    Product Get(string
    id)
12. {
13. var headers =
    Request.Headers;
14. var p =
    ProductServiceInstance.GetById(long.Parse(id));
15. if
    (p == null)
16. {
17. throw new
    HttpResponseException(new
    HttpResponseMessage(HttpStatusCode.BadRequest)
18. Content = new
    StringContent("id3 not found"),
    ReasonPhrase = "product id not exist."
    });
19. }
20. return
    p;
21. }
22. }

6.
其它配置说明

6.1
Mvc前端Web.Config 配置

[html] view
plaincopy

 

1. <</SPAN>system.web>
2. <</SPAN>compilation debug="true" targetFramework="4.5">
3. <</SPAN>assemblies>
4. <</SPAN>add assembly="System.Web.Http.Data.Helpers,
   Version=4.0.0.0, Culture=neutral,
   PublicKeyToken=31bf3856ad364e35" />
5. </</SPAN>assemblies>
6. </</SPAN>compilation>
7. <</SPAN>httpRuntime targetFramework="4.5" />
8. <</SPAN>authentication mode="Forms">
9. <</SPAN>forms loginUrl="~/Account/Login" defaultUrl="~/Home/Index" protection="All" timeout="90" name=".AuthCookie"></</SPAN>forms>
10. </</SPAN>authentication>
11. <</SPAN>machineKey validationKey="3FFA12388DDF585BA5D35E7BC87E3F0AB47FBBEBD12240DD3BEA2BEAEC4ABA213F22AD27E8FAD77DCFEE306219691434908D193A17C1FC8DCE51B71A4AE54920"
    decryptionKey="ECB6A3AF9ABBF3F16E80685ED68DC74B0B13CCEE538EBBA97D0B893139683B3B"
    validation="SHA1" decryption="AES" />
12. </</SPAN>system.web>

machineKey节点配置，是应用于对用户ticket数据加密和解密。

6.2
WebApi服务端Web.Config配置

[html] view
plaincopy

 

1. <</SPAN>system.web>
2. <</SPAN>machineKey validationKey="3FF112388DDF585BA5D35E7BC87E3F0AB47FBBEBD12240DD3BEA2BEAEC4ABA213F22AD27E8FAD77DCFEE306219691434908D193A17C1FC8DCE51B71A4AE54920"
   decryptionKey="ECB6A3AF9ABBF3F16E80685ED68DC74B0B13CCEE538EBBA97D0B893139683B3B"
   validation="SHA1" decryption="AES" />
3. </</SPAN>system.web>

machineKey节点配置，是应用于对用户ticket数据加密和解密。

7.
总结

Web系统的用户登录及页面操作权限验证在处理逻辑上比较复杂，需要考虑到Form认证、匿名访问，Session和Cookie存储，以及Session和Cookie的过期处理，本文实现了整个权限验证框架的基本功能，供系统架构设计人员以及Web开发人员参考。

Demo项目代码地址：
https://github.com/lgsky/DemoUserAuthorization/