如何在ASP.NET中使用多个授权方案发布相应的承载和Cookie标识？

发布时间：2020-12-16 06:55:29 所属栏目：asp.Net 来源：网络整理

导读：这 documentation describes部分如何使用多个身份验证方案： In some scenarios,such as Single Page Applications it is possible to end up with multiple authentication methods. For example,your application may use cookie-based authentication to

这 documentation describes部分如何使用多个身份验证方案：

In some scenarios,such as Single Page Applications it is possible to end up with multiple authentication methods. For example,your application may use cookie-based authentication to log in and bearer authentication for JavaScript requests. In some cases you may have multiple instances of an authentication middleware. For example,two cookie middlewares where one contains a basic identity and one is created when a multi-factor authentication has triggered because the user requested an operation that requires extra security.

例：

app.UseCookieAuthentication(new CookieAuthenticationOptions()
{
    AuthenticationScheme = "Cookie",LoginPath = new PathString("/Account/Unauthorized/"),AccessDeniedPath = new PathString("/Account/Forbidden/"),AutomaticAuthenticate = false
});

app.UseBearerAuthentication(options =>
{
    options.AuthenticationScheme = "Bearer";
    options.AutomaticAuthenticate = false;
});

但是它仅描述了如何使用Bearer或Cookie auth.不清楚的是其他组合是有效的,或者如何正确地向客户发放承载或cookie.

怎么能实现呢？

解决方法

Facebook,Google等大型网站使用的一个常见用例是使用多个cookie身份验证中间件,并使用AutomaticAuthenticate将其中一个设置为默认值

app.UseCookieAuthentication(new CookieAuthenticationOptions()
{
    AuthenticationScheme = "InsecureLongLived",AutomaticAuthenticate = true
});
app.UseCookieAuthentication(new CookieAuthenticationOptions()
{
    AuthenticationScheme = "SecureAndShortLived",AutomaticAuthenticate = false
});

>默认值为长期存在且用于非关键身份验证方案,例如在Facebook上,这可能是为了查看您的个人资料页面.
>更安全,更短暂的用于安全关键用户操作,如更改密码或配置文件信息.

这使您不必一直使用长期存在的cookie登录,但是只要您需要做一些有潜在危险的事情,就可以切换到使用更短寿命的auth,从而更安全的cookie,这需要用户再次登录.

（编辑：李大同）

【声明】本站内容均来自网络，其相关言论仅代表作者个人观点，不代表本站立场。若无意侵犯到您的权利，请及时与联系站长删除相关内容!