Web Api项目中的MVC应用程序Cookie和令牌认证

Question

I'm currently working on a project which has 2 clients. An MVC client and an Android client.

I've implemented ASP .Net Identity for the authentication of my MVC controllers. The MVC project also includes some web API controllers. In my views, I call both the controllers, as well as some ajax calls to my web API .

Question: Is it possible to, when I make an ajax call from browser to the web API (or controllers), to use cookie based authentication , but when I make an ajax call from the android app, use token authentication ?

I'm using .Net Framework 4.6.1

Answer 1

define two policies: one for the API ( apipolicy ) and the other for normal MVC calls ( defaultpolicy ) in Startup.cs in ConfigureServices metod this:

services.AddAuthorization(options =>
{
    // define several authorization policies if needed
    options.AddPolicy("defaultpolicy", b =>
    {
        b.RequireAuthenticatedUser();
    });
    options.AddPolicy("apipolicy", b =>
    {
        b.RequireAuthenticatedUser();
        // define which authentication is used for this policy
        b.AuthenticationSchemes.Add(JwtBearerDefaults.AuthenticationScheme);
    });
});

to apply each policy you need to decorate controllers with the desired [Authorize ("policy")] Attribute like:

SampleDataApiController.cs - with apipolicy applied

[Authorize ("apipolicy")]
[Route("api/[controller]")]
public class SampleDataApiController : Controller
{
}

AccountController.cs - with defaultpolicy applied

[Authorize("defaultpolicy")]
[Route("[controller]/[action]")]
public class AccountController : Controller
{
}

As a sample here is my complete ConfigureServices method to give you an idea:

public void ConfigureServices(IServiceCollection services)
{
    services.AddMvc();

    services.AddAuthorization(options =>
    {
        options.AddPolicy("defaultpolicy", b =>
        {
            b.RequireAuthenticatedUser();
        });
        options.AddPolicy("apipolicy", b =>
        {
            b.RequireAuthenticatedUser();
            b.AuthenticationSchemes.Add(JwtBearerDefaults.AuthenticationScheme);
        });
    });

    services.AddAuthentication(options =>
    {
        options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
        options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
        options.DefaultChallengeScheme = "CustomScheme";
    })
    .AddCookie()
    .AddJwtBearer(options =>
    {
        // Bearer Logic
    })
    .AddOAuth("CustomScheme", options =>
    {
        // Oauth Logic
    });
}

I just added the following nuget for simplicity. Microsoft.AspNetCore.All