使用API .net核心进行身份验证

问题描述 投票:2回答:2

我有以下设置。一种使用身份和令牌授权的Web API,包含整个用户管理和一些额外的API调用。

此外,我正在构建一个FE以使用.net核心再次使用API​​。我有我的登录表单并发布到FE,它使用RestSharp来做一个API请求,给出我从表单中获得的凭据。我收到一些用户数据和身份Cookie /令牌。我将cookie /令牌设置为响应,现在我的FE能够使用它来与ajax进行其他API调用。

但我的问题是,我怎么知道他在X分钟后仍然登录?如果Cookie /令牌过期,API调用将被拒绝,但我的FE-BE如何知道它们不再有效?我是否在每个请求中检查到期日? enter image description here

我要求这主要是为了挑战我构建系统的方式,以避免任何巨大的安全漏洞。

asp.net api cookies asp.net-core
2个回答
0
投票

经过与朋友的一些交谈后,更合适的解决方案(在我看来)如下。 (代码可以清理)

        //
    // POST: /Account/Login
    [HttpPost]
    [AllowAnonymous]
    [ValidateAntiForgeryToken]
    public async Task<IActionResult> Login(LoginViewModel model)
    {
        if (ModelState.IsValid)
        {
            // Do a rest call to the API
            Uri _baseUri = new Uri("http://localhost:8000/");
            var client = new RestClient(_baseUri + "api/Account/login");
            var request = new RestRequest(Method.POST);
            request.AddHeader("postman-token", "7ee2a21b-70d5-8a68-f0dd-518b8a61ddbf");
            request.AddHeader("cache-control", "no-cache");
            request.AddHeader("content-type", "application/x-www-form-urlencoded");
            request.AddParameter("application/x-www-form-urlencoded", "Email=blah%40gmail.com&password=a1Aa1Aa1A!&=", ParameterType.RequestBody);
            IRestResponse response = client.Execute(request);

            // Check the response
            if (response.StatusCode == HttpStatusCode.OK) {
                // Grab the cookie for the Identity
                // this can be replaced by a token in the future
                String cookie = response.Cookies.Where(c => c.Name == ".AspNetCore.Identity.Application").First().Value;
                // Store the cookie value to use it in sub-sequent requests                
                HttpContext.Session.SetString("IdentityCookieId", cookie);


                // Add claims to our new user, an example Name and an example Role 
                const string Issuer = "http://blah.com";
                var claims = new List<Claim>();
                claims.Add(new Claim(ClaimTypes.Name, "AnonymUser", ClaimValueTypes.String, Issuer));
                claims.Add(new Claim(ClaimTypes.Role, "Administrator", ClaimValueTypes.String, Issuer));

                var userIdentity = new ClaimsIdentity("SecuredLoggedIn");
                userIdentity.AddClaims(claims);
                var userPrincipal = new ClaimsPrincipal(userIdentity);

                // Sign in the user creating a cookie with X ammount of Expiry
                await HttpContext.Authentication.SignInAsync("Cookie", userPrincipal,
                    new AuthenticationProperties
                    {
                        ExpiresUtc = DateTime.UtcNow.AddMinutes(1),
                        IsPersistent = false,
                        AllowRefresh = false
                    });

                // Move back to the ReturnUrl or for me always to the dashboard
                return RedirectToLocal("/dashboard");
            }
        }

        return View(model);
    }

当然,你必须在Startup.cs下编辑ConfigureServices文件,在你的services.AddAuthorization();之前添加AddMvc()

并在Configure下添加

        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationScheme = "Cookie",
            LoginPath = new PathString("/account/login/"),
            AccessDeniedPath = new PathString("/Account/Forbidden/"),
            AutomaticAuthenticate = true,
            AutomaticChallenge = true
        });

0
投票

如果Cookie /令牌过期,API调用将被拒绝,但我的FE-BE如何知道它们不再有效?我是否在每个请求中检查到期日?

要确定授权访问是否已过期,请检查expires_in时间范围optionally comes with an OpenID Connect implicit flow response.

  • access_token
  • token_type
  • id_token
  • state
  • expires_in可选。自生成响应以来,访问令牌的到期时间(以秒为单位)。

由于access_token通常对客户端不透明,因此查明访问是否已过期的唯一其他方法是向发布者询问access_token。

但我的问题是,我怎么知道他在X分钟后仍然登录?

要确定您的用户是否仍在登录,请使用id_token而不是access_token

© www.soinside.com 2019 - 2024. All rights reserved.