如何在 Resolver 函数级别使用 GraphQL.NET 实现授权？

Question

我正在寻找有关如何使用 GraphQL.NET 和 ASP.NET CORE 2 在解析器函数级别实现授权的示例代码和示例。

基本上，如果请求未经授权，我试图阻止查询的执行。

任何人都可以帮助我获得一些好的教程或代码示例作为实现的参考。

Answer 1

对于graphql-dotnet/authorization ， AspNetCore的页面还没有发布，参考Add GraphQL.Server.Authorization.AspNetCore NuGet package #171 。

您可以实现Authorization.AspNetCore供您自己使用。

在实现Authorization.AspNetCore ，你可以像这样配置Authorize ：

• Startup.cs

   public class Startup { public Startup(IConfiguration configuration, IHostingEnvironment hostingEnvironment) { Configuration = configuration; Environment = hostingEnvironment; } public IConfiguration Configuration { get; } public IHostingEnvironment Environment { get; } // This method gets called by the runtime. Use this method to add services to the container. public void ConfigureServices(IServiceCollection services) { services.Configure<CookiePolicyOptions>(options => { // This lambda determines whether user consent for non-essential cookies is needed for a given request. options.CheckConsentNeeded = context => true; options.MinimumSameSitePolicy = SameSiteMode.None; }); services.AddAuthentication(option => { option.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme; option.DefaultChallengeScheme = CookieAuthenticationDefaults.AuthenticationScheme; option.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme; }).AddCookie(CookieAuthenticationDefaults.AuthenticationScheme); services.AddGraphQL(options => { options.EnableMetrics = true; options.ExposeExceptions = Environment.IsDevelopment(); //options. }) .AddGraphQLAuthorization(options => { options.AddPolicy("Authorized", p => p.RequireAuthenticatedUser()); //var policy = new AuthorizationPolicyBuilder() // . //options.AddPolicy("Authorized", p => p.RequireClaim(ClaimTypes.Name, "Tom")); }); //.AddUserContextBuilder(context => new GraphQLUserContext { User = context.User }); services.AddSingleton<MessageSchema>(); services.AddSingleton<MessageQuery>(); services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_1); } // This method gets called by the runtime. Use this method to configure the HTTP request pipeline. public void Configure(IApplicationBuilder app, IHostingEnvironment env) { if (env.IsDevelopment()) { app.UseDeveloperExceptionPage(); } else { app.UseExceptionHandler("/Home/Error"); app.UseHsts(); } app.UseHttpsRedirection(); app.UseStaticFiles(); app.UseCookiePolicy(); app.UseAuthentication(); app.UseGraphQL<MessageSchema>("/graphql"); app.UseGraphQLPlayground(new GraphQLPlaygroundOptions() { Path = "/ui/playground" }); app.UseGraphiQLServer(new GraphiQLOptions { GraphiQLPath = "/ui/graphiql", GraphQLEndPoint = "/graphql" }); app.UseMvc(routes => { routes.MapRoute( name: "default", template: "{controller=Home}/{action=Index}/{id?}"); }); } }

• 架构

  public class MessageQuery : ObjectGraphType<Message> { public MessageQuery() { Field(o => o.Content).Resolve(o => "This is Content").AuthorizeWith("Authorized"); Field(o => o.SentAt); Field(o => o.Sub).Resolve(o => "This is Sub"); } }

有关完整的演示，请参阅GraphQLNet 。

Answer 2

要获得 GraphQL.Net 在 ASP.NET Core 中工作的授权，首先安装这个包：

GraphQL.Server.Authorization.AspNetCore

在 Startup.cs 中，在 ConfigureServices 中添加以下内容。 确保添加这些 using 语句：

    using GraphQL.Validation;
    using GraphQL.Server.Authorization.AspNetCore;

public void ConfigureServices(IServiceCollection services)
{
    //... other code

    services.AddSingleton<IHttpContextAccessor, HttpContextAccessor>();

    services
        .AddTransient<IValidationRule, AuthorizationValidationRule>()
        .AddAuthorization(options =>
        {
            options.AddPolicy("LoggedIn", p => p.RequireAuthenticatedUser());
        });

    //... other code
}

现在您将能够在解析器级别使用AuthorizeWith()来保护该字段。 例子：

public class MyQuery : ObjectGraphType
{
    public MyQuery(ProductRepository productRepository)
    {
        Field<ListGraphType<ProductType>>(
            "products",
            resolve: context => productRepository.GetAllAsync() 
        ).AuthorizeWith("LoggedIn");
    }
}

您还可以通过将this.AuthorizeWith()添加到 Query 构造函数的顶部来保护所有查询，如下所示：

 public class MyQuery : ObjectGraphType
 {
     public MyQuery(ProductRepository productRepository)
     {
         this.AuthorizeWith("LoggedIn");
         Field<ListGraphType<ProductType>>(
             "products",
             resolve: context => productRepository.GetAllAsync() 
         );
     }
 }

这样，对您的 GraphQL 端点的任何未经身份验证的访问都将被拒绝。

现在就登录某人而言，有很多方法可以做到这一点。 这是一个基于 Cookie 的快速身份验证示例：

在 Startup.cs 的 ConfigureServices 中配置基于 cookie 的身份验证：

services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme).AddCookie(o =>
        {
            o.Cookie.Name = "graph-auth";
        });

使用突变登录某人：

public class Session
{
    public bool IsLoggedIn { get; set; }
}

public class SessionType : ObjectGraphType<Session>
{
    public SessionType()
    {
        Field(t => t.IsLoggedIn);
    }
}

public class MyMutation : ObjectGraphType
{
    public MyMutation(IHttpContextAccessor contextAccessor)
    {
        FieldAsync<SessionType>(
            "sessions",
            arguments: new QueryArguments(
                new QueryArgument<NonNullGraphType<StringGraphType>> { Name = "password" }),
            resolve: async context =>
            {
                string password = context.GetArgument<string>("password");

                // NEVER DO THIS...for illustration purpose only! Use a proper credential management system instead. :-)
                if (password != "123")
                    return new Session { IsLoggedIn = false };

                var principal = new ClaimsPrincipal(new ClaimsIdentity("Cookie"));
                await contextAccessor.HttpContext.SignInAsync(principal, new AuthenticationProperties
                {
                    ExpiresUtc = DateTime.UtcNow.AddMonths(6),
                    IsPersistent = true
                });

                return new Session { IsLoggedIn = true };
            });
    }
}