时间戳

首页 > 解决方案 > 每个操作方法的策略相同但所需参数不同

asp.net-core-webapi - 每个操作方法的策略相同但所需参数不同

问题描述

在一个.Net core Webapi 2.1项目中，我有很多动作方法。
所有操作方法都应针对相同的策略（名为FooPolicy）进行授权，但需要使用不同的参数。
基于 Microsoft 的文档：Policy-based-Authorization 一种方法是根据不同的输入参数声明大量策略： 

services.AddAuthorization(options =>
{
    options.AddPolicy("FooPolicy1", policy =>policy.Requirements.Add(new FooRequirement(1)));
    options.AddPolicy("FooPolicy2", policy =>policy.Requirements.Add(new FooRequirement(2)));
    options.AddPolicy("FooPolicy3", policy =>policy.Requirements.Add(new FooRequirement(3)));
    //... May be 30 more same policies here ...
});

正如我之前提到的，只有不同的部分在new FooRequirement(diffArgs). 此解决方案的另一个挑战是将每个添加FooPolicy到其相应的操作方法上，您可能会错过几个主题： 

[Authorize(Policy = "FooPolicy1")]
public IActionResult ActionMethodFoo1(...) {...}

[Authorize(Policy = "FooPolicy2")]
public IActionResult ActionMethodFoo2(...) {...}

[Authorize(Policy = "FooPolicy3")]
public IActionResult ActionMethodFoo3(...) {...}
...List still goes on...

是否有任何解决方案，例如：声明一次策略，但将其与不同的实例FooRequirement（类型为IAuthorizationHandler）一起使用？像这样： 

services.AddAuthorization(options =>
{
    options.AddPolicy("FooPolicy", policy =>policy.Requirements.Add(?));
});

并在操作方法上： 

[Authorize(Policy = "FooPolicy", required = new FooRequirement(1))]
public IActionResult ActionMethodFoo1(...) {...}

[Authorize(Policy = "FooPolicy", required = new FooRequirement(2))]
public IActionResult ActionMethodFoo2(...) {...}

[Authorize(Policy = "FooPolicy", required = new FooRequirement(3))]
public IActionResult ActionMethodFoo3(...) {...}

主要思想是一次申报政策。最近的两个代码块是psudo-code，有没有人知道具有类似概念的实际解决方案？

标签： asp.net-core-webapiasp.net-authorizationpolicy-based-security

解决方案

你可以实现你自己的IAuthorizationFilter

  1. 风俗IAuthorizationFilter 

    public class CustomAuthorize : IAuthorizationFilter         
 {
        private readonly int _input;

public CustomAuthorize(int input)
{
    _input = input;
}

public void OnAuthorization(AuthorizationFilterContext context)
{
    //custom validation rule
    if (_input == 1)
    {
        context.Result = new ForbidResult();
    }
}
}

  2. 风俗CustomAuthorizeAttribute 

    public class CustomAuthorizeAttribute : TypeFilterAttribute
{
public CustomAuthorizeAttribute(int input) : base(typeof(CustomAuthorize))
{
    Arguments = new object[] { input };
}
}

  3. 利用 

    [CustomAuthorizeAttribute(1)]
public IActionResult About()

推荐阅读