使用ASP.NET Web Api构建基于REST风格的服务实战系列教程【八】——Web Api的安全性

publicclass ForceHttpsAttribute : AuthorizationFilterAttribute
    {
        publicoverridevoid OnAuthorization(System.Web.Http.Controllers.HttpActionContext actionContext)
        {
            var request = actionContext.Request;
 
            if (request.RequestUri.Scheme != Uri.UriSchemeHttps)
            {
                var html = "<p>Https is required</p>";
 
                if (request.Method.Method == "GET")
                {
                    actionContext.Response = request.CreateResponse(HttpStatusCode.Found);
                    actionContext.Response.Content = new StringContent(html, Encoding.UTF8, "text/html");
 
                    UriBuilder httpsNewUri = new UriBuilder(request.RequestUri);
                    httpsNewUri.Scheme = Uri.UriSchemeHttps;
                    httpsNewUri.Port = 443;
 
                    actionContext.Response.Headers.Location = httpsNewUri.Uri;
                }
                else
                {
                    actionContext.Response = request.CreateResponse(HttpStatusCode.NotFound);
                    actionContext.Response.Content = new StringContent(html, Encoding.UTF8, "text/html");
                }
 
            }
        }
    }

publicstaticvoid Register(HttpConfiguration config)
   {
       config.Filters.Add(new ForceHttpsAttribute());
   }

//对于整个Controller强制使用Https

[Learning.Web.Filters.ForceHttps()]
    publicclass CoursesController : BaseApiController
    {
    //仅对这个方法强制使用Https

        [Learning.Web.Filters.ForceHttps()]
            public HttpResponseMessage Post([FromBody] CourseModel courseModel)
            {
 
        }
}

publicclass LearningAuthorizeAttribute : AuthorizationFilterAttribute
    {
 
        [Inject]
        public LearningRepository TheRepository { get; set; }
 
        publicoverridevoid OnAuthorization(System.Web.Http.Controllers.HttpActionContext actionContext)
        {
            //forms authentication Case that user is authenticated using forms authentication

//so no need to check header for basic authentication.if (Thread.CurrentPrincipal.Identity.IsAuthenticated)
            {
                return;
            }
 
            var authHeader = actionContext.Request.Headers.Authorization;
 
            if (authHeader != null)
            {
                if (authHeader.Scheme.Equals("basic", StringComparison.OrdinalIgnoreCase) &&
                    !String.IsNullOrWhiteSpace(authHeader.Parameter))
                {
                    var credArray = GetCredentials(authHeader);
                    var userName = credArray[0];
                    var password = credArray[1];
 
                    if (IsResourceOwner(userName, actionContext))
                    {
                        //You can use Websecurity or asp.net memebrship provider to login, for
                        //for he sake of keeping example simple, we used out own login functionalityif (TheRepository.LoginStudent(userName, password))
                        {
                            var currentPrincipal = new GenericPrincipal(new GenericIdentity(userName), null);
                            Thread.CurrentPrincipal = currentPrincipal;
                            return;
                        }
                    }
                }
            }
 
            HandleUnauthorizedRequest(actionContext);
        }
 
        privatestring[] GetCredentials(System.Net.Http.Headers.AuthenticationHeaderValue authHeader)
        {
 
            //Base 64 encoded stringvar rawCred = authHeader.Parameter;
            var encoding = Encoding.GetEncoding("iso-8859-1");
            var cred = encoding.GetString(Convert.FromBase64String(rawCred));
 
            var credArray = cred.Split(‘:‘);
 
            return credArray;
        }
 
        privatebool IsResourceOwner(string userName, System.Web.Http.Controllers.HttpActionContext actionContext)
        {
            var routeData = actionContext.Request.GetRouteData();
            var resourceUserName = routeData.Values["userName"] asstring;
 
            if (resourceUserName == userName)
            {
                returntrue;
            }
            returnfalse;
        }
 
        privatevoid HandleUnauthorizedRequest(System.Web.Http.Controllers.HttpActionContext actionContext)
        {
            actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.Unauthorized);
 
            actionContext.Response.Headers.Add("WWW-Authenticate",
                                               "Basic Scheme=‘eLearning‘ location=‘http://localhost:8323/account/login‘");
 
        }
    }

publicclass StudentsController : BaseApiController
    {
        [LearningAuthorizeAttribute]
        public HttpResponseMessage Get(string userName)
            {
 
            }
    }

publicclass EnrollmentsController : BaseApiController
    {
        [LearningAuthorizeAttribute]
        public HttpResponseMessage Post(int courseId, [FromUri]string userName, [FromBody]Enrollment enrollment)
            {
 
            }
    }