webapi swagger自定義 HTTP Header驗證用戶

問題描述

webapi自定義的一種驗證方式(token放入header里),使用swagger測試時由於header里沒值所以一直拿不到用戶.

解決如下:(從標題2開始,標題1處處理全局驗證用戶)

1.新建GlobalAuthorizationFilter類

[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, Inherited = true, AllowMultiple = true),]
    public class GlobalAuthorizationFilter: AuthorizationFilterAttribute
    {
        
        

        public override void OnAuthorization(HttpActionContext actionContext)
        {
            // 這是一個基本例子，使用的ASP.NET Forms 身份驗證
            var context = HttpContext.Current;
            string methodName1 = actionContext.ActionDescriptor.ActionName;
            //var ad=actionContext.ActionDescriptor.MethodInfo;

            var session = context.Session;
            
            if(SysConfig.GetCurUser()==null) /*自定義驗證方式(從header取token並驗證);同樣適用於session驗證(先登錄,然后打開swagger測試)*/
            {
                PreUnauthorized(actionContext); /*用戶驗證未通過,則輸出 請登錄*/
                return;
            }
        }

        private void PreUnauthorized(HttpActionContext actionContext)
        {
            // 如果用戶沒有登錄，則返回一個通用的錯誤Model
            actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.Forbidden,"請登錄");
        }
    }

 

2.新建GlobalHttpHeaderFilter 類

 public class GlobalHttpHeaderFilter : IOperationFilter
    {
        public void Apply(Operation operation, SchemaRegistry schemaRegistry, ApiDescription apiDescription)
        {
            if (operation.parameters == null)
                operation.parameters = new List<Parameter>();

            ////var filterPipeline = apiDescription.ActionDescriptor.GetFilterPipeline(); //判斷是否添加權限過濾器
            ////var isAuthorized = filterPipeline.Select(filterInfo => filterInfo.Instance).Any(filter => filter is IAuthorizationFilter); //判斷是否允許匿名方法 

            var isNeedLogin = apiDescription.ActionDescriptor.GetCustomAttributes<GlobalAuthorizationFilter>().Any(); //是否有驗證用戶標記 if (isNeedLogin)//如果有驗證標記則 多輸出2個文本框(swagger form提交時會將這2個值放入header里)
            {
                operation.parameters.Add(new Parameter { name = "UserUUId", @in = "header", description = "UserUUId", required = false, type = "string" });
                operation.parameters.Add(new Parameter { name = "Sign", @in = "header", description = "Sign", required = false, type = "string" });
            }
        }
    }

 

3.修改app_start文件夾下swaggerconfig.cs文件

GlobalConfiguration.Configuration
.EnableSwagger(c =>
{
c.OperationFilter<Filters.GlobalHttpHeaderFilter>();/*添加此行*/

...

}

4.給需要驗證用戶的方法打上GlobalAuthorizationFilter標記

[HttpPost]
[Filters.GlobalAuthorizationFilter]
public T_User TestCurLoginUser()
{

　　return SysConfig.GetCurUser();
}

此時使用swagger測試該方法,會發現如上圖所示多了2個輸入框

而此時其他沒有打GlobalAuthorizationFilter標記的方法則沒有這2個輸入框

 

 

參考:http://www.cnblogs.com/Flyear/p/4875066.html

 

From:http://www.cnblogs.com/xuejianxiyang/p/6232986.html