• 设为首页
  • 点击收藏
  • 手机版
    手机扫一扫访问
    迪恩网络手机版
  • 关注官方公众号
    微信扫一扫关注
    公众号

Asp.netCore认证和授权:Cookie认证

原作者: [db:作者] 来自: [db:来源] 收藏 邀请

关于asp.net core 的文章,博客园已经有很多大牛写过了。

这里我只是记录下自己在学习中的点滴和一些不懂的地方

Cookie一般是用户网站授权,当用户访问需要授权(authorization)的页面,程序会判断是否已经授权,并认证

 

添加认证代码:
引入命名空间:Microsoft.AspNetCore.Authentication.Cookies;

添加服务

public void ConfigureServices(IServiceCollection services)
        {
           

            services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_2);

            services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme) .AddCookie();
        }

 

注册中间件,添加到管道

 app.UseAuthentication();

注意:一定要在app.UseMvc之前添加

我们通过源码可以看到cookie的一些默认配置

// Copyright (c) .NET Foundation. All rights reserved.
// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.

using Microsoft.AspNetCore.Http;

namespace Microsoft.AspNetCore.Authentication.Cookies
{
    /// <summary>
    /// Default values related to cookie-based authentication handler
    /// </summary>
    public static class CookieAuthenticationDefaults
    {
        /// <summary>
        /// The default value used for CookieAuthenticationOptions.AuthenticationScheme
        /// </summary>
        public const string AuthenticationScheme = "Cookies";

        /// <summary>
        /// The prefix used to provide a default CookieAuthenticationOptions.CookieName
        /// </summary>
        public static readonly string CookiePrefix = ".AspNetCore.";

        /// <summary>
        /// The default value used by CookieAuthenticationMiddleware for the
        /// CookieAuthenticationOptions.LoginPath
        /// </summary>
        public static readonly PathString LoginPath = new PathString("/Account/Login");

        /// <summary>
        /// The default value used by CookieAuthenticationMiddleware for the
        /// CookieAuthenticationOptions.LogoutPath
        /// </summary>
        public static readonly PathString LogoutPath = new PathString("/Account/Logout");

        /// <summary>
        /// The default value used by CookieAuthenticationMiddleware for the
        /// CookieAuthenticationOptions.AccessDeniedPath
        /// </summary>
        public static readonly PathString AccessDeniedPath = new PathString("/Account/AccessDenied");

        /// <summary>
        /// The default value of the CookieAuthenticationOptions.ReturnUrlParameter
        /// </summary>
        public static readonly string ReturnUrlParameter = "ReturnUrl";
    }
}

 

 

我们可以自己修改:

  services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
                .AddCookie(option =>
                {
                    option.LoginPath = "/Login"; //没有授权,跳转的url
                    option.LogoutPath = "/Login"; //退出,的url
                });

 

因为cookie在有效期内都是有效的,如果用户资料修改了,客户端的Cookie是不知道的

网上有人提出了解决方案,如果用户修改了资料,在数据库用一个字段记录,cookie有个事件,在每次请求都会访问

option.Events.OnValidatePrincipal = ValidatePrincipal

想添加多个可以这样写:

 option.Events = new CookieAuthenticationEvents
                    {
                        OnValidatePrincipal = ValidatePrincipal,
                        //OnRedirectToLogin =
                    };

 

 public async Task ValidatePrincipal(CookieValidatePrincipalContext context)
        {
            var _Context = context.HttpContext.RequestServices.GetRequiredService<EFContext>();
            var s = context.HttpContext.RequestServices.GetService<EFContext>();

            var principal = context.Principal;

            var u = principal.Claims.Select(c => c.Type == "isEdit").FirstOrDefault();

            if (u)
            {
                //更新数据库状态
                //

                // 1. 验证失败 等同于 Principal = principal;
                context.RejectPrincipal();

                //登出
               await AuthenticationHttpContextExtensions.SignOutAsync(context.HttpContext, CookieAuthenticationDefaults.AuthenticationScheme);
                // 2. 验证通过,并会重新生成Cookie。
                //context.ShouldRenew = true;

            }
        }

 

用户登陆,网上有人这里解释的

 ClaimsIdentity(身份证),Claims(身份信息)
           ClaimsPrinciple (证件所有者)

这个也很恰当

https://www.cnblogs.com/dudu/p/6367303.html

  [HttpPost]
        public async Task<IActionResult> Login(string ReturnUrl, User model)
        {
            if (model.UserName=="cnblogs" && model.PassWord == "pwd")
            {
                /*
             ClaimsIdentity(身份证),Claims(身份信息)
           ClaimsPrinciple (证件所有者)
             */

                //身份信息
                var claims = new List<Claim> {
                    new Claim(ClaimTypes.Name,"sky"),
                    new Claim("Address","北京海淀"),
                };

                //身份证
                var claimsIdentity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme);

                //证件所有者
                var claimsPrinciple = new ClaimsPrincipal(claimsIdentity);

                /*
                 如果登陆选择了记住我,则将cookie持久化
                 这里默认持久化
                 */
                var properties = new AuthenticationProperties
                {
                    IsPersistent = true,
                    ExpiresUtc = DateTimeOffset.UtcNow.AddDays(1),
                    //ExpiresUtc = DateTime.Now.AddDays(1)

                };
                await HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, claimsPrinciple, properties);

                return Redirect(ReturnUrl);
            }
            else
                return View("index");
        }

 

博客园的大神文章,很多。就放几个参考吧

https://www.cnblogs.com/RainingNight/p/7587194.html

https://www.cnblogs.com/tdfblog/p/7416589.html

 


鲜花

握手

雷人

路过

鸡蛋
该文章已有0人参与评论

请发表评论

全部评论

专题导读
热门推荐
热门话题
阅读排行榜

扫描微信二维码

查看手机版网站

随时了解更新最新资讯

139-2527-9053

在线客服(服务时间 9:00~18:00)

在线QQ客服
地址:深圳市南山区西丽大学城创智工业园
电邮:jeky_zhao#qq.com
移动电话:139-2527-9053

Powered by 互联科技 X3.4© 2001-2213 极客世界.|Sitemap