如何使用asp.net核心api在标头中使用x-auth-token授权请求？

Question

I generated token included user info and her roles using asp.net core web api and get it at client, then put it in x-auth-token in request header. How cal I authorize user (with her roles) in asp.net api controllers and actions? My setting in startup.cs is like below but I can not catch request in my action!

var securityKey = Environment.GetEnvironmentVariable("SECURITY_KEY");
var symmetricSecurityKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(securityKey));

services
    .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
      options.TokenValidationParameters = new TokenValidationParameters()
              {
               ValidateIssuer = true,
               ValidateAudience = true,
               ValidateIssuerSigningKey = true,

               ValidIssuer = "shoniz.com",
               ValidAudience = "readers",
               IssuerSigningKey = symmetricSecurityKey
              };
    });

Answer 1

The code in your example is an settings of authentication (JWT scheme). First, you have to add middleware, which will authenticate user. This part of code should be present in Startup.cs ( Configure() method).

app.UseAuthentication();

Once this middleware is called, all the authentication schemes are taken into account. When the authentication will success, HttpContext.User will be set (including all your issues claims).

The second part is authorization. The simplest way is to use [Authorize] attribute you can use as an annotation along with your action methods and controllers. You can add custom role names or policy restriction.

[Authorize(Roles = "admin")]
public class CmsControllerBase : Controller
{
}