如何在Controller上添加Web API身份验证过滤器？

Question

我基于此链接https://docs.microsoft.com/en-us/aspnet/web-api/overview/security/authentication-filters实现了Web api 2，身份验证过滤器。

过滤器有效，但是我不能在Controller上申请？我只能像这样在全球范围内使用它；

public static class WebApiConfig
{
    public static void Register(HttpConfiguration config)
    {
        config.Filters.Add(new MyAuthenticationFilter()); // Global level

MyAuthenticationFilter实现

using Test1.Web.Areas.Api.Models;
using Test1.Web.Areas.Api.Provisioning;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Net.Http;
using System.Net.Http.Headers;
using System.Security.Principal;
using System.Threading;
using System.Threading.Tasks;
using System.Web.Http.Filters;


public class MyAuthenticationFilter : IAuthenticationFilter
{
    private static CustomerService = new CustomerService();
    public bool AllowMultiple => true;

    public async Task AuthenticateAsync(HttpAuthenticationContext context, CancellationToken cancellationToken)
    {
        // 1. Look for credentials in the request.
        HttpRequestMessage request = context.Request;
        AuthenticationHeaderValue authorization = request.Headers.Authorization;

        // 2. If there are no credentials, do nothing.
        if (authorization == null)
        {
            this.SetContextErrorResult(context);
            return;
        }

        string apiKey = authorization.Scheme;

        // 3. If there are credentials, check Schema exists. Schema has tapiKey value.
        // Authorization: apiKey
        if (string.IsNullOrWhiteSpace(apiKey))
        {
            this.SetContextErrorResult(context);
            return;
        }

        // 4. Validate tenant. Here we could use caching
        CustomerModel customer = CustomerService.Find(apiKey);
        if (customer == null)
        {
            this.SetContextErrorResult(context);
            return;
        }

        // 5. Credentials ok, set principal
        IPrincipal principal = new GenericPrincipal(new GenericIdentity(apiKey), new string[] { });
        context.Principal = principal;
        return;
    }

    public async Task ChallengeAsync(HttpAuthenticationChallengeContext context, CancellationToken cancellationToken)
    {
        // currently we don't need authentication challenge
        return;
    }

    private void SetContextErrorResult(HttpAuthenticationContext context)
    {
        context.ErrorResult = new AuthenticationFailedResponse();
    }
}




public class AuthenticationFailedResponse : IHttpActionResult
{
    public Task<HttpResponseMessage> ExecuteAsync(CancellationToken cancellationToken)
    {
        return Task.FromResult(Execute());
    }

    private HttpResponseMessage Execute()
    {
        HttpResponseMessage response = new HttpResponseMessage(HttpStatusCode.Unauthorized)
        {
            Content = new StringContent(JsonConvert.SerializeObject(new ApiErrorModel()
            {
                Message = "Authentication failed",
                Description = "Missing or incorrect credentials"
            }), Encoding.UTF8, "application/json")
        };

        return response;
    }
}

Answer 1

我的一个同事找到了解决方案：

[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
public class MyAuthenticationFilter : FilterAttribute, IAuthenticationFilter

上部代码必须添加到MyAuthentication中。现在我们可以在Controller上使用它：

[ApiExceptionFilter]
[RoutePrefix("api/provisioning/v0")]
[MyAuthenticationFilter]
public class ProvisioningController : ApiController