CheckAccessCore返回False引发400错误请求

Question

我正在尝试为WCF Rest API调用实现基本授权。 一切似乎都很好，如果用户是有效用户，则将对他进行身份验证，然后将调用发送给相应的API进行处理。

另外，如果Auth标头不存在，它将引发异常并引发401-未授权，这似乎是合法的。

但是，当提供了Auth Header且它不正确时，它将返回“ FALSE”，我相信这是设计用于“ CheckAccessCore ”方法的。

每当重调False时，它都会向我的调用引发一个400 Bad Request，这似乎是不对的，因为Bad Request可能是出于正当理由，例如将不同的参数传递给API，然后再传递期望值等。

下面是我的CheckAccessCore方法

protected override bool CheckAccessCore(OperationContext operationContext)
        {
            //Extract the Authorization header, and parse out the credentials converting the Base64 string:
            var authHeader = WebOperationContext.Current.IncomingRequest.Headers["Authorization"];
            if ((authHeader != null) && (authHeader != string.Empty))
            {
                var svcCredentials = System.Text.ASCIIEncoding.ASCII
                        .GetString(Convert.FromBase64String(authHeader.Substring(6)))
                        .Split(':');
                var user = new { Name = svcCredentials[0], Password = svcCredentials[1] };
                if ((user.Name == "user1" && user.Password == "test"))
                {
                    //User is authrized and originating call will proceed
                    return true;
                }
                else
                {
                    //not authorized
                    return false;
                }
            }
            else
            {
                //No authorization header was provided, so challenge the client to provide before proceeding:
                WebOperationContext.Current.OutgoingResponse.Headers.Add("WWW-Authenticate: Basic realm=\"MyWCFService\"");
                //Throw an exception with the associated HTTP status code equivalent to HTTP status 401
                throw new WebFaultException(HttpStatusCode.Unauthorized);
            }
        }

API调用是通过C＃代码进行的，如下所示：

HttpWebRequest req = (HttpWebRequest)WebRequest.Create(serviceURL);

            //Add a header to the request that contains our credentials
            //DO NOT HARDCODE IN PRODUCTION!! Pull credentials real-time from database or other store.
            string svcCredentials = Convert.ToBase64String(ASCIIEncoding.ASCII.GetBytes("user1" + ":" + "test"));
            req.Headers.Add("Authorization", "Basic " + svcCredentials);

            //Just some example code to parse the JSON response using the JavaScriptSerializer
            try
            {
                using (WebResponse svcResponse = (HttpWebResponse)req.GetResponse())
                {
                    return svcResponse.GetResponseStream();
                }
            }
            catch (WebException e)
            {
                using (WebResponse response = e.Response)
                {
                    HttpWebResponse httpResponse = (HttpWebResponse)response;
                    Console.WriteLine("Error code: {0}", httpResponse.StatusCode);
                    using (Stream data = response.GetResponseStream())
                    using (var reader = new StreamReader(data))
                    {
                        string text = reader.ReadToEnd();
                        Console.WriteLine(text);
                        return null;
                    }
                }
            }

这里的问题是

1. 验证失败时， CheckAccessCore方法引发400错误请求是否正确？

2. 如果没有，那么代码有什么问题以及如何纠正。

谢谢阿舒托什

Answer 1

您需要设置StatusCode，然后返回false，请尝试以下操作：

WebOperationContext.Current.OutgoingResponse.StatusCode = System.Net.HttpStatusCode.Unauthorized;
return false;