我也在web API上工作,通过手机用户可以连接到它。 对于Authentication
我在.net中使用RSA
。手机客户端首先发送用户名和密码,然后创建令牌并将其发送给客户端。在接下来的请求中,客户端必须将此令牌附加到请求标头,并且我得到此令牌并从中提取用户名和密码。
RSA加密:
public class ApiRSA
{
private static string privateKey = // Generate a private key
private static string publicKey = // Generate a public key
public static string Decrypt(string data)
{
var rsa = new RSACryptoServiceProvider();
byte[] dataByte = Convert.FromBase64String(data);
rsa.FromXmlString(privateKey);
var decryptedByte = rsa.Decrypt(dataByte, false);
return Encoding.Unicode.GetString(decryptedByte);
}
public static string Encrypt(string data)
{
var rsa = new RSACryptoServiceProvider();
var dataByte = Encoding.Unicode.GetBytes(data);
rsa.FromXmlString(publicKey);
var encryptedByte = rsa.Encrypt(dataByte, false);
return Convert.ToBase64String(encryptedByte);
}
public static void GeneraterPrivatePublicKey(out string privateKey, out string publicKey)
{
var csp = new RSACryptoServiceProvider(1024);
var privKey = csp.ExportParameters(true);
var pubKey = csp.ExportParameters(false);
{
var sw = new System.IO.StringWriter();
var xs = new System.Xml.Serialization.XmlSerializer(typeof(RSAParameters));
xs.Serialize(sw, privKey);
privateKey = sw.ToString();
}
{
var sw = new System.IO.StringWriter();
var xs = new System.Xml.Serialization.XmlSerializer(typeof(RSAParameters));
xs.Serialize(sw, pubKey);
publicKey = sw.ToString();
}
}
}
这个类将加密的用户名和密码字符串(标记)。在登录方法中,您检查用户名和密码,并根据用户名和密码生成令牌并返回此令牌。 在任何进一步的请求中,客户端必须在请求头中附加这个令牌。
为了检查进一步的请求,您可以使用自定义验证属性:
public interface IApiAuthenticationProvider
{
bool IsValid(string username, string password);
}
public static class ApiAuthenticationEncrypter
{
public static string Encrypt(string username, string password)
{
return ApiRSA.Encrypt(/*join username and password*/);
}
public static void Decrypt(string token, out string username, out string password)
{
var usernameAndPass = ApiRSA.Decrypt(token).Split(/*split username and password*/);
username = usernameAndPass[0];
password = usernameAndPass[1];
}
}
public class ApiAuthenticationAttribute : ActionFilterAttribute
{
private IApiAuthenticationProvider AuthenticationProvider { get; set; }
public ApiAuthenticationAttribute(Type apiAuthenticationType)
{
Debug.Assert(typeof(IApiAuthenticationProvider).IsAssignableFrom(apiAuthenticationType));
AuthenticationProvider = (IApiAuthenticationProvider) Activator.CreateInstance(apiAuthenticationType);
}
public override void OnActionExecuting(HttpActionContext actionContext)
{
Debug.Assert(AuthenticationProvider != null);
Object httpContextBase;
bool isValid = actionContext.Request.Properties.TryGetValue("MS_HttpContext", out httpContextBase);
bool isLocal = isValid && ((HttpContextBase)httpContextBase).Request.IsLocal;
if (isLocal)
{
base.OnActionExecuting(actionContext);
return;
}
//// == Only Https request ==
//if (!String.Equals(actionContext.Request.RequestUri.Scheme, "https", StringComparison.OrdinalIgnoreCase))
//{
// actionContext.Response = new HttpResponseMessage(System.Net.HttpStatusCode.BadRequest)
// {
// Content = new StringContent("HTTPS Required")
// };
// return;
//}
// == Try to get Token ==
string token;
try
{
token = actionContext.Request.Headers.GetValues("AuthenticationToken").First();
}
catch (Exception)
{
actionContext.Response = new HttpResponseMessage(HttpStatusCode.BadRequest)
{
Content = new StringContent("AuthenticationToken not found"),
};
return;
}
// == Validate using validator provider ==
try
{
string username;
string password;
ApiAuthenticationEncrypter.Decrypt(token, out username, out password);
if (AuthenticationProvider.IsValid(username, password))
base.OnActionExecuting(actionContext);
else
throw new Exception();
}
catch (Exception)
{
actionContext.Response = new HttpResponseMessage(HttpStatusCode.Forbidden)
{
Content = new StringContent("Invalid UserName or Password")
};
return;
}
}
}
而且通过一个具体类型的IApiAuthenticationProvider
使用这个属性:
[ApiAuthentication(typeof (Concrete Type of IApiAuthenticationProvider))]
public class SomeController: ApiController
读Here
来源
2013-12-17 08:33:35
MRB
'[Authorize]'不适合你吗? – Tobberoth