在哪里返回 403 禁止状态？

Question

I'm using authorized routes to get data but since the Route is forbidden, I can't return an error.

[Route("getTotal")]
[HttpGet]
[Authorize(Roles = "Admin")]
public IActionResult GetTotalNumbers()
{
    var test = User.Claims;

    try
    {
        var logic = new DrainlockLogic(_appSettings);
        var ret = logic.GetTotalNumbers();
        return Ok(ret);
    }
    catch (Exception e)
    {
        return StatusCode(500, e);
    }
}

My error is always null.

this.homeService.getGratingNumbers()
  .pipe(
    map(itemData => {
      return itemData.map(value => {
        // return new ListItem(value.id, value.market, value.name);
        this.pieChartLabels2.push([value.name]);
        this.pieChartData2.push(value.id);
        mybackgroundColor2.push(['#'+(0x1000000+(Math.random())*0xffffff).toString(16).substr(1,6)])
      })
    })
  )
  .subscribe((listingItem) => {
    console.log(listingItem) // gives an array of listingItem
  },
  error => console.log("oh no: " + error));

It there a proper way to return a status for a forbidden role access?

Thr Problem is, i am not stepping into the Method GetTotalNumbers() if I have not the Role "Admin". Therefore i can't return my own status. So the Framework itslef is returning 403. I want to pass my own Message as an error.

Answer 1

As I commented under your question. You should be careful about the detailed message sent to the client. In this case, providing the required roles is not very risky. What you have for the reason of denying the user's access are contained in the AuthorizationFailure.FailedRequirements . Here I introduce to you how to extract that because the default DefaultAuthorizationService (of IAuthorizationService ) does not pass that down to the pipeline. The detailed pipeline starts from AuthorizeFilter (which may be converted from AuthorizeAttribute ):

AuthorizeFilter.OnAuthorizationAsync -> IPolicyEvaluator.AuthorizeAsync -> IAuthorizationService.AuthorizeAsync

So you can see that the result from IAuthorizationService.AuthorizeAsync is converted from AuthorizationResult to PolicyAuthorizationResult which contains much less info (of course losing all the Failure detail). Finally the PolicyAuthorizationResult is converted to just either ForbidResutl or ChallengeResult .

The idea to solve this problem is by creating your custom IAuthorizationService by inheriting from DefaultAuthorizationService and intercept the calls to AuthorizeAsync to capture the result into a shared in-memory, such as via the HttpContext.Features . Note that you can take some advantage of DI Interceptors which are available by third-party DI framework like autofac . Here we use the built-in DI framework so this is the best solution to help intercept the calls.

Once you have AuthorizationResult available after authorization, you can extract the Failure and convert to some friendly message (be careful to not expose sensitive info) to send to the client.

Here's the code:

public class HttpAppAuthorizationService : DefaultAuthorizationService, IAuthorizationService
{
    readonly IHttpContextAccessor _httpContextAccessor;
    public HttpAppAuthorizationService(IAuthorizationPolicyProvider policyProvider, 
        IAuthorizationHandlerProvider handlers, 
        ILogger<DefaultAuthorizationService> logger, 
        IAuthorizationHandlerContextFactory contextFactory, 
        IAuthorizationEvaluator evaluator, 
        IOptions<AuthorizationOptions> options,
        IHttpContextAccessor httpContextAccessor) : base(policyProvider, handlers, logger, contextFactory, evaluator, options)
    {
        _httpContextAccessor = httpContextAccessor;
    }
    async Task<AuthorizationResult> IAuthorizationService.AuthorizeAsync(ClaimsPrincipal user, object resource, IEnumerable<IAuthorizationRequirement> requirements)
    {
        var result = await base.AuthorizeAsync(user, resource, requirements);
        //capture the result for later using
        _setAuthorizationResultFeature(result);
        return result;
    }
    async Task<AuthorizationResult> IAuthorizationService.AuthorizeAsync(ClaimsPrincipal user, object resource, string policyName)
    {
        var result = await base.AuthorizeAsync(user, resource, policyName);
        //capture the result for later using
        _setAuthorizationResultFeature(result);
        return result;
    }
    void _setAuthorizationResultFeature(AuthorizationResult result)
    {
        var httpContext = _httpContextAccessor.HttpContext;
        if(httpContext != null)
        {
            httpContext.Features.Set<IAuthorizationResultFeature>(new AuthorizationResultFeature(result));
        }
    }
}

public interface IAuthorizationResultFeature
{
    AuthorizationResult AuthorizationResult { get; }
}
public class AuthorizationResultFeature : IAuthorizationResultFeature
{
    public AuthorizationResultFeature(AuthorizationResult result)
    {
        AuthorizationResult = result;
    }
    public AuthorizationResult AuthorizationResult { get; }
}

Register your custom IAuthorizationService in Startup.ConfigureServices :

services.AddSingleton<IAuthorizationService, HttpAppAuthorizationService>();

Now in a filter of IAsyncAlwaysRunResultFilter , you can extract the IAuthorizationResultFeature to get the detailed failure and convert it to the result you want:

public class CustomAsyncAlwaysRunResultFilterAttribute : Attribute, IAsyncAlwaysRunResultFilter
{
    public async Task OnResultExecutionAsync(ResultExecutingContext context, ResultExecutionDelegate next)
    {
        var msg = "";
        var authorizationResult = context.HttpContext.Features.Get<IAuthorizationResultFeature>()?.AuthorizationResult;
        if(authorizationResult?.Failure != null ) {
            var rolesRequirements = authorizationResult.Failure.FailedRequirements.OfType<RolesAuthorizationRequirement>();
            msg = $@"You need to have all following roles (each group requires at least one role): 
                     {string.Join(", ", rolesRequirements.Select(e => $"({string.Join(", ", e.AllowedRoles)})"))}";
            //sends back a plain text result containing the msg
            //this can be obtained by the client
            context.Result = new ContentResult { Content = msg, StatusCode = 403 };
        }            
        await next();            
    }
}

Actually you can take other kinds of AuthorizationRequirement into the process of formatting the message as well. The code above is just an example to format only the RolesAuthorizationRequirement (which suits your specific case here).

The IAsyncAlwaysRunResultFilter should be registered globally (in the way just like other kinds of filter). I hope you know how to do that (googling will surely provide you a quick result).

Answer 2

Debug your code and trace all steps. Make sure the code throws error.

Probably, the code does not throw error.

Are you sure this is throwing error?

var logic = new DrainlockLogic(_appSettings);
var ret = logic.GetTotalNumbers();  
return Ok(ret);

I guess the method GetTolalNumbers returns null instead of throwing error.