.Net Core 3 自定义授权策略 - 访问操作谓词

Question

我正在尝试将一些旧代码移植到.Net Core 3。

使用旧的 AuthorizeAttibutes，您可以从 HttpActionContext 获取 Action 的动词。 通过

var verb = actionContext.Request.Method.Method;

在Core 3.0中，HttpActionContext现已更改为AuthorizationHandlerContext。

我看到一些帖子提到提及使用：

var filterContext = context.Resource as AuthorizationFilterContext;

var httpMethod = filterContext.HttpContext.Request.Method;

但在 .Net Core 3 中，我在上下文中看不到 AuthorizationFilterContext。普通控制器或 API 控制器的资源。

关于如何获得操作请求中使用的 VERB 的任何想法/指示？

编辑：因此，在@xing-zou的帮助下，我能够执行以下POC来获得唯一的路由键，我可以将其与数据库中的路由以及分配给它们的角色进行比较。

如果用户属于已与路由关联的角色，则用户将获得访问权限，否则 403 禁止访问

public class AccessToRouteHandler : AuthorizationHandler<AccessToRouteRequirement>
{
private readonly IHttpContextAccessor httpContextAccessor;
private readonly DbContext dbContext;
public AccessToRouteHandler(IHttpContextAccessor httpContextAccessor, DbContext dbContext)
{
this.httpContextAccessor = httpContextAccessor ?? throw new ArgumentNullException(nameof(httpContextAccessor));
this.dbContext = dbContext;
}
protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, AccessToRouteRequirement requirement)
{
var filterContext = context.Resource as AuthorizationFilterContext;
var routeInfo = context.Resource as RouteEndpoint;
var response = filterContext?.HttpContext.Response;
if (!context.User.Identity.IsAuthenticated || string.IsNullOrEmpty(context.User.Identity.Name))
{
response?.OnStarting(async () =>
{
filterContext.HttpContext.Response.StatusCode = (int)System.Net.HttpStatusCode.Unauthorized;
});
context.Fail();
return Task.CompletedTask;
}
var verb = this.httpContextAccessor.HttpContext.Request.Method;
var routeKey = string.Empty;
if (context.Resource is Endpoint endpoint)
{
var cad = endpoint.Metadata.OfType<ControllerActionDescriptor>().FirstOrDefault();
var controllerFullName = cad.ControllerTypeInfo.FullName;
var actionName = cad.ActionName;
var bindings = cad.Parameters;
var actionParams = ".";
if (bindings.Any())
{
bindings.ToList().ForEach(p => actionParams += p.ParameterType.Name + ".");
}
routeKey = $"{controllerFullName}.{actionName}{actionParams}{verb}";
}
var route = dbContext.Routes
.Include(t => t.Roles)
.FirstOrDefault(r => r.RouteKey == routeKey);
if (route != null && route.Roles.Any(role => context.User.HasClaim(c => c.Value == role)))
{
// user belong to a role associated to the route.
context.Succeed(requirement);
return Task.CompletedTask;
}
response?.OnStarting(async () =>
{
filterContext.HttpContext.Response.StatusCode = (int)System.Net.HttpStatusCode.Forbidden;
});
context.Fail();
return Task.CompletedTask;
}
}

Answer 1

在启用了端点路由 asp.net 核心 3.0 中，您可以注册IHttpContextAccessor以获取当前的 HttpContext，然后您可以获取http方法。

以以下基于策略的授权为例：

public class AccountRequirement : IAuthorizationRequirement { }
public class AccountHandler : AuthorizationHandler<AccountRequirement>
{
private readonly IHttpContextAccessor _httpContextAccessor;
public AccountHandler(IHttpContextAccessor httpContextAccessor)
{
_httpContextAccessor = httpContextAccessor ?? throw new ArgumentNullException(nameof(httpContextAccessor));
}
protected override Task HandleRequirementAsync(
AuthorizationHandlerContext context,
AccountRequirement requirement)
{
var httpMethod = _httpContextAccessor.HttpContext.Request.Method;
if (httpMethod == "POST")
{
context.Succeed(requirement);
}

return Task.CompletedTask;
}
}

启动中：

public void ConfigureServices(IServiceCollection services)
{
//...
services.AddControllersWithViews();
services.AddRazorPages();
services.AddSingleton<IHttpContextAccessor, HttpContextAccessor>();
services.AddAuthorization(options =>
{
options.AddPolicy("Account",
policy => policy.Requirements.Add(new AccountRequirement()));
});
services.AddSingleton<IAuthorizationHandler, AccountHandler>();
}