ASP.Net Core 2.1+ Cookie 登录授权验证【简单Cookie验证】

系统管理员 2021-10-26 14:30 320阅读 0赞

[ASP.Net Core 2.1+ Cookie 登录授权验证【简单Cookie验证】][ASP.Net Core 2.1_ Cookie _Cookie]

原文: [ASP.Net Core 2.1+ Cookie 登录授权验证【简单Cookie验证】][ASP.Net Core 2.1_ Cookie _Cookie 1]

# 介绍 #

***本文章发布于博客园：[https://www.cnblogs.com/fallstar/p/11310749.html][https_www.cnblogs.com_fallstar_p_11310749.html]***  
***作者：fallstar***

本文章适用于：ASP.NET Core 2.1 +

今天想给一个asp.net core 的项目加上权限验证，于是研究了一下怎么加，

折腾了好一阵，发现原来Filter的方式被放弃了，现在使用Policy 和 Scheme 的方式来校验了。。。

然后开始猛查 msdn 和 stackoverflow ，然而。。。找到的都不合适，我就要简单容易的。。。

因为如果能直接用 ***AllowAnonymous***和***Authorize*** 可以省事好多的。

参照了 msdn ，有了第一版：

//Startup.cs
            public void ConfigureServices(IServiceCollection services)
            {
                services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
                    .AddCookie(x =>
                    {
                        x.LoginPath = new PathString("/Home/Login");//登录页面
                        x.LogoutPath = new PathString("/Home/Logout");//登出页面
                    });
            }
    
    //HomeController .cs
        /// <summary>
        /// 首页
        /// </summary>
        [Authorize]
        public class HomeController : Controller
        {
            /// <summary>
            /// 首页
            /// </summary>
            /// <returns></returns>
            public IActionResult Index()
            {
                return View();
            }
            /// <summary>
            /// 登录
            /// </summary>
            /// <returns></returns>
            [AllowAnonymous]
            public IActionResult Login()
            {
                return View();
            }
            /// <summary>
            /// 登出
            /// </summary>
            /// <returns></returns>
            public IActionResult Logout()
            {
                HttpContext.SignOutClain();
                return RedirectToAction("Login");
            }
        }

上面的代码很简单，就用于授权跳转，Index是首页需要权限，Login可以匿名访问。

接着是用于提供拓展方法的***WebHelper***

直接在控制器的Action 里面调用 HttpContext.Login 就可以了。

/// <summary>
        /// Web帮助类
        /// </summary>
        public static class WebHelper
        {
            #region Auth
            /// <summary>
            ///  登录
            /// </summary>
            public static bool Login(this HttpContext context, string username,string password)
            {
                //验证登录
                if (!(username != "admin" && password != "123456"))
                    return false;
                //成功就写入
                context.SignInClain(1, username, true, TimeSpan.FromHours(3));
                return true;
            }
    
            /// <summary>
            /// 将登录用户信息写入凭据，输出到cookie
            /// </summary>
            /// <param name="context"></param>
            /// <param name="userid"></param>
            /// <param name="username"></param>
            /// <param name="isAdmin"></param>
            public static async void SignInClain(this HttpContext context, int userid, string username, bool isAdmin = false, TimeSpan? expire = null)
            {
                var claims = new List<Claim>
                {
                    new Claim(ClaimTypes.Name, username),
                    new Claim(ClaimTypes.NameIdentifier,userid.ToString()),
                    new Claim(ClaimTypes.Role,isAdmin?"1":"0")
                };
                if (!expire.HasValue)
                    expire = TimeSpan.FromHours(3);
    
                var claimsIdentity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme);
                var authProperties = new AuthenticationProperties()
                {
                    ExpiresUtc = DateTime.UtcNow.Add(expire.Value),
                    IsPersistent = true,
                };
                await context.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, new ClaimsPrincipal(claimsIdentity), authProperties);
            }
    
            /// <summary>
            /// 登出，清除登录信息
            /// </summary>
            /// <param name="context"></param>
            public static async void SignOutClain(this HttpContext context)
            {
                await context.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
            }
            #endregion
        }

当我以为完事的时候。。。突然发现webapi也被带到 登录页面去了。。。这肯定是不行的。

接着我有苦苦研究文档，没有收获，最后，我仔细的查看配置项里面的类，然后找到了办法。

最终版就是下面这段了：

public void ConfigureServices(IServiceCollection services)
            {
                services.Configure<CookiePolicyOptions>(options =>
                {
                    // This lambda determines whether user consent for non-essential cookies is needed for a given request.
                    options.CheckConsentNeeded = context => true;
                    options.MinimumSameSitePolicy = SameSiteMode.Lax;
                });
    
                services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
                    .AddCookie(x =>
                    {
                        x.LoginPath = new PathString("/Home/Login");//登录页面
                        x.LogoutPath = new PathString("/Home/Logout");//登出页面
                        //多了下面这段针对WebApi的代码
                        x.Events.OnRedirectToLogin = z =>
                        {
                            if (z.HttpContext.Request.Path.StartsWithSegments("/api", StringComparison.OrdinalIgnoreCase))
                            {
                                z.HttpContext.Response.Redirect("/api/Login/UnAuth");//未授权错误信息的接口地址，返回json
                            }
                            else
                            {
                                z.HttpContext.Response.Redirect(z.RedirectUri);//其它安装默认处理
                            }
                            return Task.CompletedTask;
                        };
                    });
    
                services.AddSingleton<IHttpContextAccessor, HttpContextAccessor>();
    
                services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_1);
            }
    
           public void Configure(IApplicationBuilder app, IHostingEnvironment env)
            {
                //...
    
                app.UseCookiePolicy();
                app.UseAuthentication();
    
                //app.UseMvc
    
            }

OK~大吉告成了~~~

posted on 2019-08-07 23:38  [NET未来之路][NET] 阅读( ...) 评论( ...) [ 编辑][Link 1] 收藏

转载于:https://www.cnblogs.com/lonelyxmas/p/11318584.html

[ASP.Net Core 2.1_ Cookie _Cookie]: https://www.cnblogs.com/lonelyxmas/p/11318584.html
[ASP.Net Core 2.1_ Cookie _Cookie 1]: https://www.cnblogs.com/fallstar/p/aspnetcore2_cookie_auth_mvc_webapi.html
[https_www.cnblogs.com_fallstar_p_11310749.html]: https://www.cnblogs.com/fallstar/p/11310749.html
[NET]: https://www.cnblogs.com/lonelyxmas/
[Link 1]: https://i.cnblogs.com/EditPosts.aspx?postid=11318584