Question

之后是,该在制作的APICI中设置认证过滤器的指南。这完全容易,除非在测试时,我获得这一例外。

No authenticationScheme was specified, and there was no DefaultChallengeScheme found. The default schemes can be set using either AddAuthentication(string defaultScheme) or AddAuthentication(Action configureOptions).

每当我试图打一个终点。

I ve look at this Guide,其中还规定了authenticationScheme 。 like

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme,
        options => builder.Configuration.Bind("JwtSettings", options))
    .AddCookie(CookieAuthenticationDefaults.AuthenticationScheme,
        options => builder.Configuration.Bind("CookieSettings", options));

但我不想这样做。是否有办法通过属性使用认证过滤器?

在这方面,我是如何安排的。

基本过滤器:

[AttributeUsage(AttributeTargets.All)]
public class BasicFilter : AuthorizeAttribute, IAuthenticationFilter
{        
    async public Task AuthenticateAsync(HttpAuthenticationContext context, CancellationToken cancellationToken)
    {
        BaseRequest? request = await AuthenticationHelper.RequestIsValid<BaseRequest>(context);
        if (request == null)
        {
            context.ErrorResult = new AuthenticationFailureResult(context.Request);
            return;
        }

        GenericPrincipal principal = new GenericPrincipal(new GenericIdentity("User"), null);
        context.Principal = principal;
    }

    public Task ChallengeAsync(HttpAuthenticationChallengeContext context, CancellationToken cancellationToken)
    {
        var challenge = new AuthenticationHeaderValue("None");
        context.Result = new ChallengeUnauthorizedResult(challenge, context.Result);

        return Task.FromResult(0);
    }
}

而随后又扔下了<条码>[巴塞尔代码]和<条码>[阿法明]等终点:

    [Authorize]
    [BasicFilter]
    [HttpPost]
    async public Task<ActionResult> CreateAccount()
    {
    }

Answer 1

http://learn.microsoft.com/en-us/aspnet/web-api/overview/security/authentication-filters”rel=“nofollow noreferer” 您提及的是 as-net 而不是p.net 核心数据。

在p.net芯中,我们可以授权过滤特性如下:

public  class CustomAuthorizeAttribute : Attribute, IAuthorizationFilter
 {
     public void OnAuthorization(AuthorizationFilterContext context)
     {
         if (context != null)
         {
             //wirte your logic here
         }
     }
 }

Notice although the build-in Authorization filter would call the build-in authorization system,custom authorization filters require a custom authorization framework,which means you have to read claims from jwt/cookie and validate them yourself

另外,请查看这一图表:

如果请求是坏的,或者没有在授权的过滤器中进行有约束力/示范性鉴定,那么你就不得不在行动基金会/PageFilter(RazorPage)中检查。

友情链接