asp.net-core – 根据ASP.NET Core中请求标头中提供的API密钥授

[User]
public IHttpActionResult DoSomethingOnlyUsersCanDo() {}

[Admin]
public IHttpActionResult DoSomethingOnlyAdminsCanDo() {}

在ASP.NET Core中,建议您不要从AuthorizeAttribute继承.相反,您可以制定自定义授权策略： https://docs.microsoft.com/en-us/aspnet/core/security/authorization/claims.

您需要具有一个身份验证处理程序,该处理程序根据标头为用户创建一个ClaimsIdentity.然后,您可以制定策略来断言用户是否存在某些声明.

您可以在此处找到基本身份验证的实现：https://github.com/blowdart/idunno.Authentication.
请注意巴里当然的评论：

It is meant as a demonstration of how to write authentication middleware and not as something you would seriously consider using.

其核心是在BasicAuthenticationHandler,它继承自AuthenticationHandler< BasicAuthenticationOptions>.

此实现中的主体是在开发人员制作的事件回调中创建的,在示例中它是here：

if (context.Username == context.Password)
{
    var claims = new[]
    {
        new Claim(ClaimTypes.NameIdentifier,context.Username,ClaimValueTypes.String,context.Options.ClaimsIssuer),new Claim(ClaimTypes.Name,context.Options.ClaimsIssuer)
    };

    context.Principal = new ClaimsPrincipal(new ClaimsIdentity(claims,context.Scheme.Name));
    context.Success();
}

然后,在根据主体调用此回调后,在处理程序中创建身份验证票证：

var ticket = new AuthenticationTicket(validateCredentialsContext.Principal,Scheme.Name);
return AuthenticateResult.Success(ticket);

我还发表了一篇关于实现自定义身份验证方案的文章：Creating an authentication scheme in ASP.NET Core 2.0.