MVC网站和Web-api身份验证/授权失败操作（框架4.6.1）

Question

I have an MVC web application using identity model authentication and authorization that works very well. The same web application also has supports a REST web api. Until now, the api calls have all worked unauthorized (by design). I now have a need to support authenticated api calls, but can't seem to separate the web api authentication failure behavior from that of the web site. It is not appropriate for the web api to redirect to the login page on authentication failure, it should instead return a 401 http response to the caller.

Controllers for the web pages use the AuthorizeAttribute on routes that should be authorized, and if a user who is not authorized attempts to access them, they are redirected to the login page.

I've implemented a custom IAuthenticationFilter so I can tag api calls with a HmacAuthenticationAttribute. (I'm pretty sure the specific authentication mechanism here doesn't matter.) When used in a stand-alone web-api prototype, it works perfectly and the response to the client is the correct Http 401 code if authentication fails.

When the exact same filter is added to the web api in my real web app, an authentication failure results in a redirect to the login page, and the client receives a Http 200 OK response, with the login page html in the body of the response. This is obviously NOT the desired behavior.

Can anyone provide any insight on how to separate the web page versus web api responses when using authentication attribute filters?

If not, I'll need to refactor to not use an attribute, and call my authentication as a method instead, but it doesn't seem that this should be necessary.

Answer 1

Your problem is that the authentication middleware runs on the request pipeline for all routes. You need to configure different authentication methods for different requests.

Take a look here for more info on Conditional Middleware.

Let's assume that your api authenticates by an api-key header, and your regular app authenticates via a cookie or bearer token.

In your Startup.cs

// This will authenticate calling applications based on the "api-key" header
app.UseWhen(context => context.Request.Headers.ContainsKey("api-key"), appBuilder =>
{
    appBuilder.UseMiddleware<HmacAuthentication>();
});


// Using the exact opposite, makes all other requests authenticate the normal way
app.UseWhen(context => !context.Request.Headers.ContainsKey("api-key"), appBuilder =>
{
    appBuilder.UseAuthentication();
    appBuilder.UseIdentityServer();
});

If you modify your HmacAttribute and put the same code into some middleware then you have 2 different paths for Authentication, and can use Authorize attributes or Policies as required.

Your middleware might look something like this:

public class HmacAuthentication
{

    private const string ApiKey = "api-key";
    private RequestDelegate _next;

    public ApiKeyMiddleware(RequestDelegate next)
    {
        _next = next;
    }

    public async Task Invoke(HttpContext context)
    {

        bool success = false;
        string[] claims = null;

        success = GetHeader(context.Request.Headers, out StringValues headerValue);

        if (success)
        {                
            success = ValidateKeyAndGetClaims(headerValue, out claims);                
        }

        if (success)
        {
            context.User = GetPrincipal(headerValue, claims);
            await _next(context);
        }
        else
        {
            context.Response.StatusCode = 401;
            await context.Response.WriteAsync("Unauthorized");
        }            
    }

    internal bool GetHeader(IHeaderDictionary headers, out StringValues headerValue)
    {
        return headers.TryGetValue(ApiKey, out headerValue);
    }

    internal bool ValidateKeyAndGetClaims(string, headerValue, out string[] claims)
    {
        // Validate the api-key.
        // Claims could depend on the key value or could be hardcoded
        claims = new [] { "IsAuthenticated" };
        return true;
    }        

    internal ClaimsPrincipal GetPrincipal(string apiKey, string[] claims)
    {
        var identity = new ClaimsIdentity();
        identity.AddClaim(new Claim(ClaimTypes.Name, apiKey));
        if (claims != null)
        {
            foreach(var claim in claims)
            {
                identity.AddClaim(new Claim(claim, string.Empty));
            }
        }

        return new ClaimsPrincipal(identity);
    }
}