[关闭]
@xuxuzhaozhao 2017-12-21T08:19:49.000000Z 字数 6417 阅读 465

WebApi 前后端分离

webapi

AspNet WebApi 前后端分离,由于以后的ERP项目都将采用单页模式,索性完成前后端分离,其中最重要的就是授权相关的与之前采用Forms授权不同.
现在的授权模式将采用OWIN OAuth的方式,前台将登录获取token,然后将token放置在请求头.

1、使用Nuget包管理器安装稳定的最新的如下包:

  1.  1. Microsoft.AspNet.WebApi.Owin;
  2.  2. Microsoft.Owin.Host.SystemWeb;
  3.  3. Microsoft.AspNet.Identity.Owin;
  4.  4. Microsoft.Owin.Cors;

2、在webapi项目的根文件夹下创建OWIN Startup类

  1. using Microsoft.Owin;
  2. using Microsoft.Owin.Security.OAuth;
  3. using Owin;
  4. using System;
  5. using System.Web.Http;
  7. [assembly: OwinStartup(typeof(WebApi令牌身份验证.Startup))]
  8. namespace WebApi令牌身份验证
  9. {
  10.     public class Startup
  11.     {
  12.         public void Configuration(IAppBuilder app)
  13.         {
  14.             HttpConfiguration config = new HttpConfiguration();
  15.             ConfigureOAuth(app);
  17.             WebApiConfig.Register(config);
  18.             app.UseCors(Microsoft.Owin.Cors.CorsOptions.AllowAll);
  19.             app.UseWebApi(config);
  20.         }
  22.         public void ConfigureOAuth(IAppBuilder app)
  23.         {
  24.             OAuthAuthorizationServerOptions OAuthServerOptions = new OAuthAuthorizationServerOptions()
  25.             {
  26.                 AllowInsecureHttp = true,
  27.                 TokenEndpointPath = new PathString("/token"),
  28.                 AccessTokenExpireTimeSpan = TimeSpan.FromDays(1),
  29.                 Provider = new SimpleAuthorizationServerProvider()
  30.             };
  31.             app.UseOAuthAuthorizationServer(OAuthServerOptions);
  32.             app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions());
  33.         }
  34.     }
  35. }

3、根目录中新建Providers文件夹=>新建AuthorizationServerProvider.cs

  1. using Microsoft.Owin.Security.OAuth;
  2. using System.Security.Claims;
  3. using System.Threading.Tasks;
  4. using YiCheng.Common.DAL;
  6. namespace YiCheng.Web.Api.Providers
  7. {
  8.     /// <summary>
  9.     /// 授权access_token
  10.     /// </summary>
  11.     public class YAuthorizationServerProvider : OAuthAuthorizationServerProvider
  12.     {
  13.         public override async Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)
  14.         {
  15.             context.Validated();
  16.         }
  18.         /// <summary>
  19.         /// 返回Token令牌
  20.         /// </summary>
  21.         /// <param name="context"></param>
  22.         /// <returns></returns>
  23.         public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
  24.         {
  25.             context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin", new[] { "*" });
  27.             //验证码(暂未实现)
  28.             //var validateCode = context.Scope[0];
  30.             //对用户名、密码进行数据校验
  31.             var sql = $"SELECT COUNT(1) FROM 用户表 WHERE 账号 = @用户名 AND 密码 = @密码;";
  32.             var result = YDBHelper.ExecuteScalar2(sql, new
  33.             {
  34.                 用户名 = context.UserName,
  35.                 密码 = context.Password
  36.             }).ToString();
  38.             if (int.Parse(result) <= 0)
  39.             {
  40.                 context.SetError("登录错误.", "用户名或者密码错误!");
  41.                 return;
  42.             }
  44.             var identity = new ClaimsIdentity(context.Options.AuthenticationType);
  45.             identity.AddClaim(new Claim("yuser", context.UserName));
  47.             context.Validated(identity);
  48.         }
  49.     }
  50. }

4、根目录中新建Filters文件夹=>新建YAuthorizeFilterAttribute.cs
继承AuthorizeAttribute,重写其中的授权方法,及对应的处理未授权的方法

  1. //=====================================================
  2. // Copyright © 2017-2018 xuxuzhaozhao
  3. // All rights reserved
  4. // GUID: 7b80855a-8d31-4dc1-b9b7-72a5b2d29536
  5. // CLR版本: 4.0.30319.42000
  6. // 新建项输入的名称: AxuzerFilter
  7. // 机器名称: WIN10-20170502F
  8. // 当前登录用户名: xuxuzhaozhao
  9. //======================================================
  11. using System.Configuration;
  12. using System.Linq;
  13. using System.Net;
  14. using System.Net.Http;
  15. using System.Security.Claims;
  16. using System.Text;
  17. using System.Web;
  18. using System.Web.Helpers;
  19. using System.Web.Http;
  20. using System.Web.Http.Controllers;
  21. using YiCheng.Business.Model;
  22. using YiCheng.Common.DAL;
  23. using YiCheng.Common.Pagination;
  24. using YiCheng.Common.Tools;
  25. using YiCheng.Model.OutputModel;
  27. // ReSharper disable All
  29. namespace YiCheng.Web.Api
  30. {
  31.     /// <summary>
  32.     /// 权限管理筛选器
  33.     /// </summary>
  34.     public class YAuthorizeFilterAttribute : AuthorizeAttribute
  35.     {
  36.         private readonly string SUPERADMIN = ConfigurationManager.AppSettings["SUPERADMIN"];
  38.         /// <summary>
  39.         /// 身份验证
  40.         /// </summary>
  41.         /// <param name="actionContext"></param>
  42.         public override void OnAuthorization(HttpActionContext actionContext)
  43.         {
  44.             var username = "";
  45.             var url = actionContext.RequestContext.Url.Request.RequestUri.AbsolutePath.ToUpper();
  47.             username = HttpContext.Current.User.Identity.Name;
  49.             #region 前后端彻底分离,使用OAuth来进行授权(2个小时过期时间)
  51.             if (string.IsNullOrEmpty(username))
  52.             {
  53.                 var x = actionContext.RequestContext.Principal.Identity;
  54.                 var identity = x as ClaimsIdentity;
  55.                 username = identity?.Claims.Where(t => t.Type == "yuser").Select(t => t.Value).SingleOrDefault();
  56.             }
  58.             #endregion
  60.             //统一约定，当前页面
  61.             var currentPage = HttpContext.Current.Request["currentPage"]?.ToUpper();
  63.             //统一约定，订单编号
  64.             var orderId = HttpContext.Current.Request["orderId"];
  66.             if (!string.IsNullOrEmpty(username))
  67.             {
  68.                 var user = new YUser(username);
  69.                 HttpContext.Current.User = user;
  71.                 if (IsAuth(url, user, currentPage, orderId))
  72.                 {
  73.                     base.IsAuthorized(actionContext);//为此请求授权
  74.                 }
  75.                 else
  76.                 {
  77.                     HandleUnauthorizedRequest(actionContext);
  78.                 }
  79.             }
  80.             //如果取不到身份验证信息,并且不允许匿名访问,则返回未验证401 
  81.             else
  82.             {
  83.                 var attributes = actionContext
  84.                                 .ActionDescriptor
  85.                                 .GetCustomAttributes<AllowAnonymousAttribute>()
  86.                                 .OfType<AllowAnonymousAttribute>();
  87.                 bool isAnonymous = attributes.Any(a => a is AllowAnonymousAttribute);
  88.                 if (isAnonymous) base.OnAuthorization(actionContext);
  89.                 else HandleUnauthorizedRequest(actionContext);
  90.             }
  91.         }
  93.         /// <summary>
  94.         /// 校验该用户是否有权操作此控制器
  95.         /// </summary>
  96.         /// <param name="url"></param>
  97.         /// <param name="user"></param>
  98.         /// <param name="currentPage"></param>
  99.         /// <param name="orderId"></param>
  100.         /// <returns></returns>
  101.         private bool IsAuth(string url, YUser user, string currentPage, string orderId)
  102.         {
  104.             if (user.角色.Contains(SUPERADMIN)) return true;
  105.             var flag = true;
  106.             //查询该账号是否有权限请求这个url
  107.             using (var db = new BaoJiaDb())
  108.             {
  109.                 //该Url是否允许匿名访问
  110.                 var 匿名url = $"SELECT TOP 1 匿名访问 FROM 请求Url表 WHERE UPPER(请求Url) = @请求Url";
  111.                 var t = YDBHelper.ExecuteScalar2(匿名url, new { 请求Url = url })?.ToString();
  112.                 if (string.IsNullOrEmpty(t)) throw new YException($"当前页面:{currentPage?.ToLower()},url:{url?.ToLower()},没有加到请求Url字典表中,请检查!", 98);
  113.                 var 匿名访问 = bool.Parse(t);
  114.                 if (匿名访问) return true;
  116.                 var sql1 = $@"SELECT COUNT(1) FROM 请求权限管理表 ua
  117.                                   LEFT JOIN dbo.请求Url表 u ON ua.请求UrlGUID = u.GUID
  118.                                   WHERE UPPER(u.请求Url) = @请求Url AND ua.种类 = '角色' AND UPPER(u.页面名) = @页面名 
  119.                                         AND ua.角色 IN ({YTools.Brackets(user.角色)}) AND ua.企业名称 = @企业名称";
  120.                 var 条件1 = int.Parse(YDBHelper.ExecuteScalar2(sql1, new
  121.                 {
  122.                     请求Url = url,
  123.                     页面名 = currentPage,
  124.                     企业名称 = user.企业名称
  125.                 }).ToString()) > 0;
  127.                 var sql2 = $@"SELECT COUNT(1) FROM 请求权限管理表 ua
  128.                                   LEFT JOIN dbo.请求Url表 u ON ua.请求UrlGUID = u.GUID
  129.                                   WHERE UPPER(u.请求Url) = @请求Url AND ua.种类 = '账号' AND UPPER(u.页面名) = @页面名 
  130.                                         AND ua.角色 = @账号 AND ua.企业名称 = @企业名称";
  131.                 var 条件2 = int.Parse(YDBHelper.ExecuteScalar2(sql1, new
  132.                 {
  133.                     请求Url = url,
  134.                     账号 = user.账号,
  135.                     页面名 = currentPage,
  136.                     企业名称 = user.企业名称
  137.                 }).ToString()) > 0;
  139.                 //只要该账号所属的其中一个角色允许访问该url，则该账号就可访问
  140.                 if (flag == true && (条件1 || 条件2))
  141.                     return true;
  142.             }
  143.             throw new YException($"当前页面:{currentPage?.ToLower()}的url{url?.ToLower()},未授权不可访问", 98);
  144.         }
  146.         /// <summary>
  147.         /// 处理未授权请求
  148.         /// </summary>
  149.         /// <param name="filterContext"></param>
  150.         protected override void HandleUnauthorizedRequest(HttpActionContext filterContext)
  151.         {
  152.             base.HandleUnauthorizedRequest(filterContext);
  154.             var response = filterContext.Response = filterContext.Response ?? new HttpResponseMessage();
  155.             response.StatusCode = HttpStatusCode.Forbidden;
  156.             //Result类 可自行创建,具体为返回的content信息
  157.             var content = new YResult();
  158.             content.Failure(99, "未授权用户或已过期请重新登录.");
  159.             content.Data = "/";
  160.             response.Content = new StringContent(Json.Encode(content), Encoding.UTF8, "application/json");
  161.         }
  162.     }
  163. }
添加新批注
在作者公开此批注前，只有你和作者可见。
回复批注