2013-12-17 148 views
3

我正在开发使用Visual Studio 2013 MVC,webapi2和OData的REST风格的WebAPI的,授权网络API

这可以从移动客户端进行访问。

我遵循以下

​​3210

给现在我面临着一个授权一些困难的tuitorial。我希望api安全,并希望检查来自正确用户的请求。

以下是我的客户端代码

<head> 

    <script src="http://code.jquery.com/jquery-1.10.1.min.js"></script> 

    <script> 

    $(document).ready(function() { 

     $("#post").click(function() { 
     $.ajax({ 
       type: "GET", 
       url: "http://localhost:21900/odata/Products(1)", 
       success: function (data) { 
       alert(data); 
       }, 
       error: function (XMLHttpRequest, textStatus, errorThrown) { 
       alert(textStatus); 
       } 
      }); 
     }); 
    }); 
    </script> 
</head> 
<body> 
    <input type="submit" id="post" value="Post"/> 
</body> 

和服务器端代码

public class ProductsController : ODataController 
{ 
    private ProductServiceContext db = new ProductServiceContext(); 


    [Queryable] 
    public SingleResult<Product> GetProduct([FromODataUri] int key) 
    { 
     return SingleResult.Create(db.Products.Where(product => product.ID == key)); 
    } 
} 

我试着[授权]以上,但不是为我正常工作

任何帮助将不胜感激。

谢谢。

+0

'[Authorize]'不适合你吗? – Tobberoth

回答

0

我也在web API上工作,通过手机用户可以连接到它。 对于Authentication我在.net中使用RSA。手机客户端首先发送用户名和密码,然后创建令牌并将其发送给客户端。在接下来的请求中,客户端必须将此令牌附加到请求标头,并且我得到此令牌并从中提取用户名和密码。

RSA加密:

public class ApiRSA 
    { 
     private static string privateKey = // Generate a private key 

     private static string publicKey = // Generate a public key 

     public static string Decrypt(string data) 
     { 
      var rsa = new RSACryptoServiceProvider(); 

      byte[] dataByte = Convert.FromBase64String(data); 

      rsa.FromXmlString(privateKey); 
      var decryptedByte = rsa.Decrypt(dataByte, false); 

      return Encoding.Unicode.GetString(decryptedByte); 
     } 

     public static string Encrypt(string data) 
     { 
      var rsa = new RSACryptoServiceProvider(); 

      var dataByte = Encoding.Unicode.GetBytes(data); 

      rsa.FromXmlString(publicKey); 
      var encryptedByte = rsa.Encrypt(dataByte, false); 

      return Convert.ToBase64String(encryptedByte); 
     } 

     public static void GeneraterPrivatePublicKey(out string privateKey, out string publicKey) 
     { 
      var csp = new RSACryptoServiceProvider(1024); 

      var privKey = csp.ExportParameters(true); 
      var pubKey = csp.ExportParameters(false); 

      { 
       var sw = new System.IO.StringWriter(); 
       var xs = new System.Xml.Serialization.XmlSerializer(typeof(RSAParameters)); 
       xs.Serialize(sw, privKey); 
       privateKey = sw.ToString(); 
      } 

      { 
       var sw = new System.IO.StringWriter(); 
       var xs = new System.Xml.Serialization.XmlSerializer(typeof(RSAParameters)); 
       xs.Serialize(sw, pubKey); 
       publicKey = sw.ToString(); 
      } 
     } 
    } 

这个类将加密的用户名和密码字符串(标记)。在登录方法中,您检查用户名和密码,并根据用户名和密码生成令牌并返回此令牌。 在任何进一步的请求中,客户端必须在请求头中附加这个令牌。

为了检查进一步的请求,您可以使用自定义验证属性:

public interface IApiAuthenticationProvider 
    { 
     bool IsValid(string username, string password); 
    } 

public static class ApiAuthenticationEncrypter 
{ 
    public static string Encrypt(string username, string password) 
    { 
     return ApiRSA.Encrypt(/*join username and password*/); 
    } 

    public static void Decrypt(string token, out string username, out string password) 
    { 
     var usernameAndPass = ApiRSA.Decrypt(token).Split(/*split username and password*/); 
     username = usernameAndPass[0]; 
     password = usernameAndPass[1]; 
    } 
} 

public class ApiAuthenticationAttribute : ActionFilterAttribute 
    { 
     private IApiAuthenticationProvider AuthenticationProvider { get; set; } 

     public ApiAuthenticationAttribute(Type apiAuthenticationType) 
     { 
      Debug.Assert(typeof(IApiAuthenticationProvider).IsAssignableFrom(apiAuthenticationType)); 
      AuthenticationProvider = (IApiAuthenticationProvider) Activator.CreateInstance(apiAuthenticationType); 
     } 

     public override void OnActionExecuting(HttpActionContext actionContext) 
     { 
      Debug.Assert(AuthenticationProvider != null); 

      Object httpContextBase; 
      bool isValid = actionContext.Request.Properties.TryGetValue("MS_HttpContext", out httpContextBase); 
      bool isLocal = isValid && ((HttpContextBase)httpContextBase).Request.IsLocal; 

      if (isLocal) 
      { 
       base.OnActionExecuting(actionContext); 
       return; 
      } 


      //// == Only Https request == 
      //if (!String.Equals(actionContext.Request.RequestUri.Scheme, "https", StringComparison.OrdinalIgnoreCase)) 
      //{ 
      // actionContext.Response = new HttpResponseMessage(System.Net.HttpStatusCode.BadRequest) 
      // { 
      //  Content = new StringContent("HTTPS Required") 
      // }; 
      // return; 
      //} 

      // == Try to get Token == 
      string token; 
      try 
      { 
       token = actionContext.Request.Headers.GetValues("AuthenticationToken").First(); 
      } 
      catch (Exception) 
      { 
       actionContext.Response = new HttpResponseMessage(HttpStatusCode.BadRequest) 
       { 
        Content = new StringContent("AuthenticationToken not found"), 
       }; 
       return; 
      } 

      // == Validate using validator provider == 
      try 
      { 
       string username; 
       string password; 
       ApiAuthenticationEncrypter.Decrypt(token, out username, out password); 

       if (AuthenticationProvider.IsValid(username, password)) 
        base.OnActionExecuting(actionContext); 
       else 
        throw new Exception(); 
      } 
      catch (Exception) 
      { 
       actionContext.Response = new HttpResponseMessage(HttpStatusCode.Forbidden) 
       { 
        Content = new StringContent("Invalid UserName or Password") 
       }; 
       return; 
      } 
     } 
    } 

而且通过一个具体类型的IApiAuthenticationProvider使用这个属性:

[ApiAuthentication(typeof (Concrete Type of IApiAuthenticationProvider))] 
public class SomeController: ApiController 

Here

4

你有创建如下新属性: -

[AttributeUsageAttribute(AttributeTargets.Class | AttributeTargets.Method, Inherited = true, AllowMultiple = true)] 
    public class AuthorizeAttribute : AuthorizationFilterAttribute 
    {  
     public override void OnAuthorization(System.Web.Http.Controllers.HttpActionContext actionContext) 
     { 
      base.OnAuthorization(actionContext);    

      ////check authentication and return if not authorized 
      if (actionContext != null) 
      { 
       if (!WebSecurity.IsAuthenticated) 
       { 
        actionContext.Response = new HttpResponseMessage(HttpStatusCode.Unauthorized) { RequestMessage = actionContext.ControllerContext.Request }; 
        return; 
       }    

      } 
     } 
    } 

创建上述过滤器属性后,您可以将其添加到webapiconfig.cs文件中,如下所示,以便过滤所有请求。

config.Filters.Add(new AuthorizeAttribute()); 

,你还可以添加它perticular方法或类似以下

[AuthorizeAttribute] 
public class TestController : ApiController 
1

有保护Web API应用程序的方法很多。基本身份验证,OAuth,HMAC,API密钥,自定义令牌。一个好的首发可以找到here其中还提供了一个示例应用程序下载。