asp.net MVC Web API-记录发送给用户的新承载令牌

Question

I currently have Visual Studio 2017 with a Web API Single Authentication Project.

I simply want to log when a bearer token (after successful authentication) is given to the user onto a text file. Ie when a user sends a request to /Token and receives a relevant token back.

I am not sure where to find the method / where this variable is returned. Ie what class / function etc. Before this token is return I simply want to add a few lines of code. (Ie I have a few lines of code ready to log onto a text file the token, date & time, username, etc, I just don't know where to put these!).

Part of my logging codes involves saving the User-Agent in the Request sent to /Token. I am beginning to think I may have to do something in ApplicationOAuthProvider.cs but I am unsure how to retrieve the user's Request in the current context to extract User-agent data.

For now I would like to save, User-Agent (have been using Request.Headers.Useragent prior), Username (have been using User.Identity.GetUserName() prior), Date & Time (DateTime.Now), Actual Token returned to the user.

Edit 2: I've successfully retrieved the User-Agent using

var myString = context.Request.Headers.Get("User-Agent");

By adding it after the (user==null) check in ApplicationOAuthProvider.cs

Now I'm trying to figure out how to intercept the actual token being returned to the user, and the user who's receiving this token (ie Username).

Thanks!

Answer 1

If I understood your problem well enough, I guess you want to log some info after successful token-based authentication and the retrieve that info for in the API controller context or any authorize attribute context.

If that is the issue, I shall advise you to use claims , claim is a way to save and retrieve rich authentication info. for example, the user-agent which you mentioned.

you can create a class which is inherited by OAuthAuthorizationServerProvider and then override the GrantResourceOwnerCredentials which I guess you've already done. Just after you authorize the user with your logic and before generating the ticket and sending back the token, you can add any claims you want for the user, or even in your case generate a log file(which in my opinion is not a very valid way). I hope that helps.