API认证授权

Question

What is the result if I did use No Auth type and in the same time I can pass the token inside the body and I will request that token and make my own filter?

Answer 1

You'll be much better off finding a replacement authorization and/or authentication library if you don't like the built-in one. If there's something about the default auth configuration, there's probably a way to change those defaults -- ASP.NET Core authorization and authentication have been greatly improved to support most common scenarios. I would recommend picking a preexisting library for these two functionality items and posting questions about them as you run into issues.

Answer 2

It's completely up to you. but I won't recommend passing token in the body.

In post request you have to pass some data along with the token then your request body will look like this

{
"Token":"sdfjklsklfjsdkljfskljflskjfskljflsdk",
"data":{
         "FirstName":"Pankaj",
         "LastName":"Rawat"
  }
}

C# Employee.cs

Public class Employee
{
public string FirstName {get; set;}
public string LastName {get; set;}
}

You will not able to map your post data directly with your type object and you need to write extra code to get token and data separate.

Most of the time, we pass all big JSON parameter in the method body, every time you need to deserialize your request body to get token (even token is invalid or not present)

You can write your own Auth filter but you should pass token in request header

Answer 3

In future, you might have to add multiple fallbacks for different content type case. Say for now you are passing the data in body as json string and later wish to handle authentication in a new API which uses form-data (to support files), then you would end up handling multiple cases.

I would recommend you to use headers to handle authentication related information. Authorization header

(Using existing libraries or building your own library is upto your choice)