为 ASP.NET Core (6.0)服务应用添加ApiKey验证支持
2023-09-27 14:29:19 时间
这个代码段演示了如何为一个ASP.NET Core项目中添加Apikey验证支持。
首先,通过下面的代码创建项目
dotnet new webapi -minimal -o yourwebapi
然后修改已经生成的 builder.Services.AddSwaggerGen
这个方法,以便在Swagger 的页面可以输入ApiKey进行调试。
builder.Services.AddSwaggerGen((options) =>
{
options.AddSecurityDefinition("ApiKey", new OpenApiSecurityScheme
{
Type = SecuritySchemeType.ApiKey,
In = ParameterLocation.Header,
Name = "ApiKey"
});
options.AddSecurityRequirement(new OpenApiSecurityRequirement
{
{
new OpenApiSecurityScheme
{
Reference = new OpenApiReference
{
Type = ReferenceType.SecurityScheme,
Id = "ApiKey"
}
},
new string[] {}
}
});
});
在 var app = builder.Build();
这一行下方添加一个中间件,用来验证ApiKey。请注意,这里特意跳过了swagger目录。另外,这里的密钥校验是硬编码的,你可以修改成自己需要的方式。
app.Use(async (context, next) =>
{
var found = context.Request.Headers.TryGetValue("ApiKey", out var key);
if (context.Request.Path.StartsWithSegments("/swagger") || (found && key == "abc"))
{
await next(context);
}
else
{
context.Response.StatusCode = 401;
await context.Response.WriteAsync("没有合法授权");
return;
}
});
通过 dotnet watch run
将应用运行起来,并且访问 /swagger/index.html
这个网页,可以看到当前API项目的所有方法,并且可以输入ApiKey
然后你就可以在swagger
中进行API 调用测试了,当然你也可以通过 postman
等工具来测试。这里就不展开了。
完整代码如下,请参考
using Microsoft.OpenApi.Models;
var builder = WebApplication.CreateBuilder(args);
// Add services to the container.
// Learn more about configuring Swagger/OpenAPI at https://aka.ms/aspnetcore/swashbuckle
builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen((options) =>
{
options.AddSecurityDefinition("ApiKey", new OpenApiSecurityScheme
{
Type = SecuritySchemeType.ApiKey,
In = ParameterLocation.Header,
Name = "ApiKey"
});
options.AddSecurityRequirement(new OpenApiSecurityRequirement
{
{
new OpenApiSecurityScheme
{
Reference = new OpenApiReference
{
Type = ReferenceType.SecurityScheme,
Id = "ApiKey"
}
},
new string[] {}
}
});
});
var app = builder.Build();
app.Use(async (context, next) =>
{
var found = context.Request.Headers.TryGetValue("ApiKey", out var key);
if (context.Request.Path.StartsWithSegments("/swagger") || (found && key == "abc"))
{
await next(context);
}
else
{
context.Response.StatusCode = 401;
await context.Response.WriteAsync("没有合法授权");
return;
}
});
// Configure the HTTP request pipeline.
if (app.Environment.IsDevelopment())
{
app.UseSwagger();
app.UseSwaggerUI();
}
app.UseHttpsRedirection();
var summaries = new[]
{
"Freezing", "Bracing", "Chilly", "Cool", "Mild", "Warm", "Balmy", "Hot", "Sweltering", "Scorching"
};
app.MapGet("/weatherforecast", () =>
{
var forecast = Enumerable.Range(1, 5).Select(index =>
new WeatherForecast
(
DateTime.Now.AddDays(index),
Random.Shared.Next(-20, 55),
summaries[Random.Shared.Next(summaries.Length)]
))
.ToArray();
return forecast;
})
.WithName("GetWeatherForecast");
app.Run();
record WeatherForecast(DateTime Date, int TemperatureC, string? Summary)
{
public int TemperatureF => 32 + (int)(TemperatureC / 0.5556);
}
相关文章
- ASP.NET开发,从二层至三层,至面向对象
- java.net.ServerSocket 解析
- Asp.NET调用百度翻译
- ASP.NET自定义控件组件开发 第一章 第一章:从一个简单的控件谈起
- ASP.NET Core – ADO.NET
- Asp.net Core – CSS Isolation
- Asp.net core 学习笔记 (Logging 日志)
- ASP.NET Core 框架源码地址
- ASP.NET Core PartialAsync方法的使用说明
- asp.net core 2.0 中间件(Middleware)异常处理并且返回异常信息给调用者
- ASP.NET Core中如影随形的”依赖注入”[上]: 从两个不同的ServiceProvider说起
- ASP.NET Core真实管道详解[1]:中间件是个什么东西?
- [WCF权限控制]ASP.NET Roles授权[上篇]
- ASP.NET Core开发-读取配置文件Configuration
- ASP.NET Core 开发-Logging 使用NLog 写日志文件
- 在Azure Container Service创建Kubernetes(k8s)群集运行ASP.NET Core跨平台应用程序
- asp.net最常用的三十三种编程代码