ASP.NET 核心。 如何在没有身份用户帐户的情况下创建身份验证 cookie？

Question

My app creates an Guid Event token

The customer visits the url of the event like so. https://example.com/event/a3b2e538-e87c-4444-a655-5171f263ac70

The customer is then redirected to a login form to provide the event password.

If the password maches the event token customer will be able to see the event. Can i acomblish this without an Identity user account? (I do not wish to follow the classical user identity login approach, in this case).

Maybe something like creating an auth cookie and use it, in the upcoming requests.

[HttpPost]
[Route("validate/{code}")]
public IActionResult Cookie(string code)
{
    var user = true;  //Validate event token against event password supplied by user 
    if (user == true)
    {
        var ident = _userManager.CreateAuthCookie(user, DefaultAuthenticationTypes.ApplicationCookie);

        HttpContext.GetOwinContext().Authentication.SignIn(new AuthenticationProperties { IsPersistent = false }, ident);
        
        return Redirect("Wherever");
    }
    ModelState.AddModelError("", "Invalid login attempt");
    return View();
}

Answer 1

I guess, I understand your point. You want to create a custom Owin Authentication Framework. The same thing can be achieved using JWT token. It has advantages over OWIN Authentication.

But if you want to design something like this using OWIN, Please take care of these:

• First and most important thing, the parameter passed in the url should not have any password or sensitive value. The URL token should be encoded (for encoding u can refer https://www.nuget.org/packages/Microsoft.Owin.Security/ ) and that encoded token can carry this information. While encoding, you can encode someID (not email address), some sourcecd (that tells the token is from the valid source), some time limit and how many times that token will be valid.

Now, when you get the call to your API end point, you can decode that token, validate and then extract that someID, and make a call to your DB to understand, if the user is valid.

Important: Encoding and decoding algorithm plays a very important role here. So, your encoding and decoding token should not be exposed anywhere.

If he is a valid user, then create a claimsIdentity object.

ClaimsIdentity identity = new ClaimsIdentity();
identity.AddClaim(new Claim(ClaimTypes.NameIdentifier, identity.FindFirst("sub").Value));
identity.AddClaim(new Claim("Name", <<add your claims like this>>));
identity = new ClaimsIdentity(identity.Claims, "ApplicationCookie");

AuthenticationProperties properties = new AuthenticationProperties();
AuthenticationManager.SignIn(properties, identity);

Setup Authentication class object in your controller or to a seperate file:

using Microsoft.Owin.Security;

        private IAuthenticationManager authenticationManager;
        public IAuthenticationManager AuthenticationManager
        {
            get
            {
                if (authenticationManager == null)
                    authenticationManager = HttpContext.GetOwinContext().Authentication;
                return authenticationManager;
            }
            set { authenticationManager = value; }
        }

You should also have OWIN layer configured in the middlelayer. You can configure OWIN middle layer based on.Net framework or.Net Core