WebAPI-Basic 基础验证

青旅半醒 2023-06-13 08:57 22阅读 0赞

文章内容是在网络上搜索的，经过验证，整理出来的，只为记录下来，供以后使用方便；

首先创建 RequestAuthorizeAttribute

using MySql.Data.MySqlClient;
    using System;
    using System.Collections.Generic;
    using System.Data;
    using System.Linq;
    using System.Net;
    using System.Net.Http;
    using System.Text;
    using System.Threading.Tasks;
    using System.Web.Helpers;
    using System.Web.Http;
    using System.Web.Http.Controllers;
    using System.Web.Security;
    using WebApi.Services;
    
    /// <summary>
    /// Basic 基础验证类
    /// </summary>
    namespace WebApi.udf
    {
        /// <summary>
        /// 自定义此特性用于接口的身份验证
        /// </summary>
        public class RequestAuthorizeAttribute : AuthorizeAttribute
        {
            private Sys_interface_userService sys_Interface_userService = new Sys_interface_userService();
            //重写基类的验证方式，加入我们自定义的Ticket验证
            public override void OnAuthorization(System.Web.Http.Controllers.HttpActionContext actionContext)
            {
                //从http请求的头里面获取身份验证信息，验证是否是请求发起方的ticket
                var authorization = actionContext.Request.Headers.Authorization;
                if ((authorization != null) && (authorization.Parameter != null))
                {
                    //解密用户ticket,并校验用户名密码是否匹配
                    var encryptTicket = authorization.Parameter;
                    if (ValidateTicket(encryptTicket))
                    {
                        base.IsAuthorized(actionContext);
                    }
                    else
                    {
                        HandleUnauthorizedRequest(actionContext);
                    }
                }
                //如果取不到身份验证信息，并且不允许匿名访问，则返回未验证401
                else
                {
                    var attributes = actionContext.ActionDescriptor.GetCustomAttributes<AllowAnonymousAttribute>().OfType<AllowAnonymousAttribute>();
                    bool isAnonymous = attributes.Any(a => a is AllowAnonymousAttribute);
                    if (isAnonymous) base.OnAuthorization(actionContext);
                    else HandleUnauthorizedRequest(actionContext);
                }
            }
    
            protected override void HandleUnauthorizedRequest(HttpActionContext actioncontext)
            {
                base.HandleUnauthorizedRequest(actioncontext);
    
                var response = actioncontext.Response = actioncontext.Response ?? new HttpResponseMessage();
                response.StatusCode = HttpStatusCode.Forbidden;
                var content = new
                {
                    code = -1,
                    success = false,
                    errs = new[] { "服务端拒绝访问：你没有权限，或者掉线了" }
                };
                response.Content = new StringContent(Json.Encode(content), Encoding.UTF8, "application/json");
            }
    
            //校验用户名密码（正式环境中应该是数据库校验）
            private bool ValidateTicket(string encryptTicket)
            {
                //解密Ticket
                var strTicket = FormsAuthentication.Decrypt(encryptTicket).UserData;
                //var strTicket = Encoding.UTF8.GetString(Convert.FromBase64String("encryptTicket"));
    
                //从Ticket里面获取用户名和密码
                var index = strTicket.IndexOf("&");
                    string strUser = strTicket.Substring(0, index);
                    string strPwd = strTicket.Substring(index + 1);
    
                DataTable dt = new DataTable();
                MySqlParameter[] paras = new MySqlParameter[] {
                    new MySqlParameter("UserName,", strUser),
                    new MySqlParameter("UserPwd,", strPwd)
                };
                dt = sys_Interface_userService.checkSys_interface_user(paras);
    
                if (dt.Rows.Count == 1)
                {
                    return true;
                }
                else
                {
                    return false;
                }
            }
        }
    }

## ##

添加登录API的接口：

using System;
    using System.Collections.Generic;
    using System.Linq;
    using System.Net;
    using System.Net.Http;
    using System.Text;
    using System.Web;
    using System.Web.Http;
    using System.Web.Security;
    using WebApi.udf;
    using WebApi.Services;
    using System.Data;
    using MySql.Data.MySqlClient;
    
    namespace WebApi.Controllers
    {
        [RequestAuthorize]
        public class UserController : ApiController
        {
            private Sys_interface_userService sys_Interface_userService = new Sys_interface_userService();
            /// <summary>
            /// 用户登录
            /// </summary>
            /// <param name="strUser"></param>
            /// <param name="strPwd"></param>
            /// <returns></returns>
            [AllowAnonymous]
            [HttpGet]
            public object Login(string strUser, string strPwd)
            {
                if (!ValidateUser(strUser, strPwd))
                {
                    return new { bRes = false };
                }
    
                FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(0, strUser, DateTime.Now,
                                DateTime.Now.AddHours(1), true, string.Format("{0}&{1}", strUser, strPwd),
                                FormsAuthentication.FormsCookiePath);
    
    
                //返回登录结果、用户信息、用户验证票据信息
                var oUser = new UserInfo { bRes = true, UserName = strUser, Password = strPwd, Ticket = FormsAuthentication.Encrypt(ticket) };
    
    
                //将身份信息保存在session中，验证当前请求是否是有效请求
                HttpContext.Current.Session[strUser] = oUser;
                return oUser;
            }
    
            //校验用户名密码（正式环境中应该是数据库校验）
            private bool ValidateUser(string strUser, string strPwd)
            {
                DataTable dt = new DataTable();
                MySqlParameter[] paras = new MySqlParameter[] {
                    new MySqlParameter("UserName,", strUser),
                    new MySqlParameter("UserPwd,", strPwd)
                };
                dt = sys_Interface_userService.checkSys_interface_user(paras);
    
                if (dt.Rows.Count == 1)
                {
                    return true;
                }
                else
                {
                    return false;
                }
            }
        }
    
        public class UserInfo
        {
            public bool bRes { get; set; }
    
            public string UserName { get; set; }
    
            public string Password { get; set; }
    
            public string Ticket { get; set; }
        }
    }

开启 验证  在具体的Api接口增加我们上面自定义类的特性，如：

[RequestAuthorize]
        public class ChargingController : ApiController
        {
            /// <summary>
            /// 得到所有数据
            /// </summary>
            /// <returns>返回数据</returns>
            [HttpGet]
            public string GetAllChargingData()
            {
                return "Success";
            }
    
            /// <summary>
            /// 得到当前Id的所有数据
            /// </summary>
            /// <param name="id">参数Id</param>
            /// <returns>返回数据</returns>
            [HttpGet]
            public string GetAllChargingData(string id)
            {
                return "ChargingData" + id;
            }
    
        }

以下是几点说明：

1、如果想给所有的控制器加限制：只需要创建一个基类，所有的控制器继承这个基类即可：

namespace WebApi.Controllers
    {
        [RequestAuthorize]
        [EnableCors(origins: "*", headers: "*", methods: "*")]
        public class BaseApiController : ApiController
        {
        }
    }

2、不想使用验证的方法，在方法上，添加\[AllowAnonymous\]即可；

public class ChargingController : BaseApiController
        {
            /// <summary>
            /// 得到所有数据
            /// </summary>
            /// <returns>返回数据</returns>
            [HttpGet]
            public string GetAllChargingData()
            {
                return "Success";
            }
    
            /// <summary>
            /// 得到当前Id的所有数据
            /// </summary>
            /// <param name="id">参数Id</param>
            /// <returns>返回数据</returns>
            [HttpGet]
            [AllowAnonymous]
            public string GetAllChargingData(string id)
            {
                return "ChargingData" + id;
            }
    　　}

下面是在c\#调用webapi且是 Basic 验证

创建类WebRequestutils

public static class WebRequestutils
    {
         public static string HttpPut(string url, string body)
            {
                try
                {
                    //ServicePointManager.ServerCertificateValidationCallback = new RemoteCertificateValidationCallback(CheckValidationResult);
                    Encoding encoding = Encoding.UTF8;
                    HttpWebRequest request = (HttpWebRequest)WebRequest.Create(url);
                    request.Method = "PUT";
                    request.Accept = "text/html, application/xhtml+xml, */*";
                    request.ContentType = "application/json";
    
                    byte[] buffer = encoding.GetBytes(body);
                    request.ContentLength = buffer.Length;
                    request.GetRequestStream().Write(buffer, 0, buffer.Length);
                    HttpWebResponse response = (HttpWebResponse)request.GetResponse();
                    using (StreamReader reader = new StreamReader(response.GetResponseStream(), Encoding.UTF8))
                    {
                        return reader.ReadToEnd();
                    }
                }
                catch (WebException we)
                {
                    return we.Message;
                }
            }
            public static string HttpPost(string url, string body)
            {
                try
                {
                    //ServicePointManager.ServerCertificateValidationCallback = new RemoteCertificateValidationCallback(CheckValidationResult);
                    Encoding encoding = Encoding.UTF8;
                    HttpWebRequest request = (HttpWebRequest)WebRequest.Create(url);
                    request.Method = "POST";
                    request.Accept = "text/html, application/xhtml+xml, */*";
                    request.ContentType = "application/json";
    
                    byte[] buffer = encoding.GetBytes(body);
                    request.ContentLength = buffer.Length;
                    request.GetRequestStream().Write(buffer, 0, buffer.Length);
                    HttpWebResponse response = (HttpWebResponse)request.GetResponse();
                    using (StreamReader reader = new StreamReader(response.GetResponseStream(), Encoding.UTF8))
                    {
                        return reader.ReadToEnd();
                    }
                }
                catch (WebException we) {
                    return we.Message;
                }
            }
         public static string HttpGet(string url)
            {
                try
                {
                    //ServicePointManager.ServerCertificateValidationCallback = new RemoteCertificateValidationCallback(CheckValidationResult);
                    Encoding encoding = Encoding.UTF8;
                    HttpWebRequest request = (HttpWebRequest)WebRequest.Create(url);
                    request.Method = "GET";
                    request.Accept = "text/html, application/xhtml+xml, */*";
                    request.ContentType = "application/json";
    
                    HttpWebResponse response = (HttpWebResponse)request.GetResponse();
                    using (StreamReader reader = new StreamReader(response.GetResponseStream(), Encoding.UTF8))
                    {
                        return reader.ReadToEnd();
                    }
                }catch(WebException we)
                {
                    return we.Message;
                }
            }
    
         public static string HttpPostBasic(string url, string body,string ticket)
            {
                try
                {
                    HttpWebRequest request = (HttpWebRequest)WebRequest.Create(url);
                    request.Method = "POST";
                    request.ContentType = "application/json";
                    request.Headers.Add("Authorization", "Basic " + ticket);
    
                    byte[] buffer = Encoding.UTF8.GetBytes(body);
                    request.ContentLength = buffer.Length;
                    request.GetRequestStream().Write(buffer, 0, buffer.Length);
                    HttpWebResponse response = (HttpWebResponse)request.GetResponse();
                    using (StreamReader reader = new StreamReader(response.GetResponseStream(), Encoding.UTF8))
                    {
                        return reader.ReadToEnd();
                    }
                }
                catch (WebException we)
                {
                    return we.Message;
                }
            }
    
         public static string HttpGetBasic(string url, string ticket)
            {
                try
                {
    
                    Encoding encoding = Encoding.UTF8;
                    HttpWebRequest request = (HttpWebRequest)WebRequest.Create(url);
                    request.Proxy = null;
                    request.KeepAlive = false;
                    request.Method = "GET";
                    request.ContentType = "application/json";
                    request.Headers.Add("Authorization", "Basic "+ ticket);
                    request.AutomaticDecompression = DecompressionMethods.GZip;
    
    
                    using (HttpWebResponse response = (HttpWebResponse)request.GetResponse())
                    {
                        using (StreamReader reader = new StreamReader(response.GetResponseStream(), encoding))
                        {
                            return reader.ReadToEnd();
                        }
                    }
                }
                catch (WebException we)
                {
                    return we.Message;
                }
            }        
    ｝

调用：

var oUser = WebRequestutils.HttpGet(strRequestLogin);
    UserInfo userinfo = JsonConvert.DeserializeObject<UserInfo>(oUser);
    var dataReturn = WebRequestutils.HttpGetBasic(strRequestGetDataIndexList,userinfo.Ticket);

其中UserInfo 同WebAPI中的一样，复制过来用即可；