WebAPI學習筆記（1）實現Basic Auth基本授權驗證

1、Http基本認證只需要添加新的認證過濾屬性。該屬性類繼承自 System.Web.Http.AuthorizeAttribute，在 IsAuthorized(...)方法中讀取Http 頭部Authorization字段及其值，進行自定義驗證。

public class HttpBasicAuthAttribute : System.Web.Http.AuthorizeAttribute
    {
        public override void OnAuthorization(System.Web.Http.Controllers.HttpActionContext actionContext)
        {
            //從http請求的頭里面獲取身份驗證信息，驗證是否是請求發起方的ticket
            var authorization = actionContext.Request.Headers.Authorization;
            if ((authorization != null) && (authorization.Parameter != null))
            {
                //解密用戶ticket,並校驗用戶名密碼是否匹配
                var encryptTicket = authorization.Parameter;
                if (ValidateTicket(encryptTicket))
                {
                    base.IsAuthorized(actionContext);
                }
                else
                {
                    HandleUnauthorizedRequest(actionContext);
                }
            }
            //如果取不到身份驗證信息，則返回未驗證401
            else
            {
                HandleUnauthorizedRequest(actionContext);
            }
        }

        //校驗用戶名密碼（正式環境中應該是數據庫校驗）
        private bool ValidateTicket(string encryptTicket)
        {
            //解密Ticket
            string strTicket = System.Text.Encoding.Default.GetString(Convert.FromBase64String(encryptTicket));

            //從Ticket里面獲取用戶名和密碼
            var index = strTicket.IndexOf(":");
            string strUser = strTicket.Substring(0, index);
            string strPwd = strTicket.Substring(index + 1);

            if (strUser == "admin" && strPwd == "123456")
            {
                return true;
            }
            else
            {
                return false;
            }
        }
    }

2、在需要驗證的具體Controller類或封裝的基類中添加HttpBasicAuthAttribute類屬性。

[HttpBasicAuth]
public class BaseController : ApiController
{
        private string _adminUserToken = "";

        /// <summary>
        /// Admin User Token
        /// </summary>
        public string AdminUserToken
        {
            get { return _adminUserToken; }
            set { _adminUserToken = value; }
        }
}

3、這樣就完成了服務器端的設置。

4、用Postman調用：

5、Asp.net調用：

string Username = "admin";
string Password = "123456";
using (HttpClient client = new HttpClient())
{
    client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Basic", Convert.ToBase64String(Encoding.UTF8.GetBytes($"{Username}:{Password}")));

    HttpContent httpContent = new StringContent("", Encoding.UTF8);
    httpContent.Headers.ContentType = new MediaTypeHeaderValue("application/json");
    Uri address = new Uri("https://xxx/api/issues");

    var response = client.PostAsync(address, httpContent).Result.Content.ReadAsStringAsync().Result;//返回值
}

6、返回結果：

 

【原文出處】http://www.51aras.com/?id=39