c# - WebAPI - 统一来自 ApiController 和 OAuthAuthorizationServerProvider 的错误消息格式

Question

在我的 WebAPI 项目中，我使用 Owin.Security.OAuth添加 JWT 身份验证。里面GrantResourceOwnerCredentials在我的 OAuthProvider 中，我使用以下行设置错误:

context.SetError("invalid_grant", "Account locked.");

这返回给客户端:

{
  "error": "invalid_grant",
  "error_description": "Account locked."
}

在用户通过身份验证并尝试对我的一个 Controller 发出“正常”请求后，当模型无效时(使用 FluentValidation)，他得到以下响应:

{
  "message": "The request is invalid.",
  "modelState": {
    "client.Email": [
      "Email is not valid."
    ],
    "client.Password": [
      "Password is required."
    ]
  }
}

两个请求都返回 400 Bad Request , 但有时你必须寻找 error_description字段，有时为 message

I was able to create自定义响应消息，但这仅适用于我返回的结果。

我的问题是:是否可以替换 message与 error作为响应由 ModelValidatorProviders 返回在其他地方呢？

我读过 ExceptionFilterAttribute但我不知道这是否是一个好的起点。 FluentValidation 应该不是问题，因为它所做的只是向 ModelState 添加错误。 .

编辑:
接下来我要修复的是 WebApi 返回数据中的命名约定不一致 - 当从 OAuthProvider 返回错误时我们有error_details , 但返回时 BadRequest与 ModelState (来自 ApiController )我们有 modelState .如您所见，首先使用 snake_case第二个camelCase .

Answer 1

更新的答案(使用中间件)

由于 Web API 原始委托(delegate)处理程序的想法意味着它在管道中作为 OAuth 中间件还不够早，因此需要创建自定义中间件...

public static class ErrorMessageFormatter {

    public static IAppBuilder UseCommonErrorResponse(this IAppBuilder app) {
        app.Use<JsonErrorFormatter>();
        return app;
    }

    public class JsonErrorFormatter : OwinMiddleware {
        public JsonErrorFormatter(OwinMiddleware next)
            : base(next) {
        }

        public override async Task Invoke(IOwinContext context) {
            var owinRequest = context.Request;
            var owinResponse = context.Response;
            //buffer the response stream for later
            var owinResponseStream = owinResponse.Body;
            //buffer the response stream in order to intercept downstream writes
            using (var responseBuffer = new MemoryStream()) {
                //assign the buffer to the resonse body
                owinResponse.Body = responseBuffer;

                await Next.Invoke(context);

                //reset body
                owinResponse.Body = owinResponseStream;

                if (responseBuffer.CanSeek && responseBuffer.Length > 0 && responseBuffer.Position > 0) {
                    //reset buffer to read its content
                    responseBuffer.Seek(0, SeekOrigin.Begin);
                }

                if (!IsSuccessStatusCode(owinResponse.StatusCode) && responseBuffer.Length > 0) {
                    //NOTE: perform your own content negotiation if desired but for this, using JSON
                    var body = await CreateCommonApiResponse(owinResponse, responseBuffer);

                    var content = JsonConvert.SerializeObject(body);

                    var mediaType = MediaTypeHeaderValue.Parse(owinResponse.ContentType);
                    using (var customResponseBody = new StringContent(content, Encoding.UTF8, mediaType.MediaType)) {
                        var customResponseStream = await customResponseBody.ReadAsStreamAsync();
                        await customResponseStream.CopyToAsync(owinResponseStream, (int)customResponseStream.Length, owinRequest.CallCancelled);
                        owinResponse.ContentLength = customResponseStream.Length;
                    }
                } else {
                    //copy buffer to response stream this will push it down to client
                    await responseBuffer.CopyToAsync(owinResponseStream, (int)responseBuffer.Length, owinRequest.CallCancelled);
                    owinResponse.ContentLength = responseBuffer.Length;
                }
            }
        }

        async Task<object> CreateCommonApiResponse(IOwinResponse response, Stream stream) {

            var json = await new StreamReader(stream).ReadToEndAsync();

            var statusCode = ((HttpStatusCode)response.StatusCode).ToString();
            var responseReason = response.ReasonPhrase ?? statusCode;

            //Is this a HttpError
            var httpError = JsonConvert.DeserializeObject<HttpError>(json);
            if (httpError != null) {
                return new {
                    error = httpError.Message ?? responseReason,
                    error_description = (object)httpError.MessageDetail
                    ?? (object)httpError.ModelState
                    ?? (object)httpError.ExceptionMessage
                };
            }

            //Is this an OAuth Error
            var oAuthError = Newtonsoft.Json.Linq.JObject.Parse(json);
            if (oAuthError["error"] != null && oAuthError["error_description"] != null) {
                dynamic obj = oAuthError;
                return new {
                    error = (string)obj.error,
                    error_description = (object)obj.error_description
                };
            }

            //Is this some other unknown error (Just wrap in common model)
            var error = JsonConvert.DeserializeObject(json);
            return new {
                error = responseReason,
                error_description = error
            };
        }

        bool IsSuccessStatusCode(int statusCode) {
            return statusCode >= 200 && statusCode <= 299;
        }
    }
}

...并在添加身份验证中间件和 Web API 处理程序之前在管道中尽早注册。

public class Startup {
    public void Configuration(IAppBuilder app) {

        app.UseResponseEncrypterMiddleware();

        app.UseRequestLogger();

        //...(after logging middle ware)
        app.UseCommonErrorResponse();

        //... (before auth middle ware)

        //...code removed for brevity
    }
} 

这个例子只是一个基本的开始。能够扩展这个起点应该足够简单。

尽管在此示例中，公共(public)模型看起来像从 OAuthProvider 返回的模型，但可以使用任何公共(public)对象模型。

使用一些内存单元测试对其进行了测试，并通过 TDD 使其能够正常工作。

[TestClass]
public class UnifiedErrorMessageTests {
    [TestMethod]
    public async Task _OWIN_Response_Should_Pass_When_Ok() {
        //Arrange
        var message = "\"Hello World\"";
        var expectedResponse = "\"I am working\"";

        using (var server = TestServer.Create<WebApiTestStartup>()) {
            var client = server.HttpClient;
            client.DefaultRequestHeaders.Accept.Clear();
            client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));

            var content = new StringContent(message, Encoding.UTF8, "application/json");

            //Act
            var response = await client.PostAsync("/api/Foo", content);

            //Assert
            Assert.IsTrue(response.IsSuccessStatusCode);

            var result = await response.Content.ReadAsStringAsync();

            Assert.AreEqual(expectedResponse, result);
        }
    }

    [TestMethod]
    public async Task _OWIN_Response_Should_Be_Unified_When_BadRequest() {
        //Arrange
        var expectedResponse = "invalid_grant";

        using (var server = TestServer.Create<WebApiTestStartup>()) {
            var client = server.HttpClient;
            client.DefaultRequestHeaders.Accept.Clear();
            client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));

            var content = new StringContent(expectedResponse, Encoding.UTF8, "application/json");

            //Act
            var response = await client.PostAsync("/api/Foo", content);

            //Assert
            Assert.IsFalse(response.IsSuccessStatusCode);

            var result = await response.Content.ReadAsAsync<dynamic>();

            Assert.AreEqual(expectedResponse, (string)result.error_description);
        }
    }

    [TestMethod]
    public async Task _OWIN_Response_Should_Be_Unified_When_MethodNotAllowed() {
        //Arrange
        var expectedResponse = "Method Not Allowed";

        using (var server = TestServer.Create<WebApiTestStartup>()) {
            var client = server.HttpClient;
            client.DefaultRequestHeaders.Accept.Clear();
            client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));

            //Act
            var response = await client.GetAsync("/api/Foo");

            //Assert
            Assert.IsFalse(response.IsSuccessStatusCode);

            var result = await response.Content.ReadAsAsync<dynamic>();

            Assert.AreEqual(expectedResponse, (string)result.error);
        }
    }

    [TestMethod]
    public async Task _OWIN_Response_Should_Be_Unified_When_NotFound() {
        //Arrange
        var expectedResponse = "Not Found";

        using (var server = TestServer.Create<WebApiTestStartup>()) {
            var client = server.HttpClient;
            client.DefaultRequestHeaders.Accept.Clear();
            client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));

            //Act
            var response = await client.GetAsync("/api/Bar");

            //Assert
            Assert.IsFalse(response.IsSuccessStatusCode);

            var result = await response.Content.ReadAsAsync<dynamic>();

            Assert.AreEqual(expectedResponse, (string)result.error);
        }
    }

    public class WebApiTestStartup {
        public void Configuration(IAppBuilder app) {

            app.UseCommonErrorMessageMiddleware();

            var config = new HttpConfiguration();
            config.Routes.MapHttpRoute(
                name: "DefaultApi",
                routeTemplate: "api/{controller}/{id}",
                defaults: new { id = RouteParameter.Optional }
            );

            app.UseWebApi(config);
        }
    }

    public class FooController : ApiController {
        public FooController() {

        }
        [HttpPost]
        public IHttpActionResult Bar([FromBody]string input) {
            if (input == "Hello World")
                return Ok("I am working");

            return BadRequest("invalid_grant");
        }
    }
}

原始答案(使用 DelegatingHandler)

考虑使用 DelegatingHandler

引用网上找到的一篇文章。

Delegating handlers are extremely useful for cross cutting concerns. They hook into the very early and very late stages of the request-response pipeline making them ideal for manipulating the response right before it is sent back to the client.

此示例是对HttpError 响应的统一错误消息的简化尝试

public class HttpErrorHandler : DelegatingHandler {

    protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken) {
        var response = await base.SendAsync(request, cancellationToken);

        return NormalizeResponse(request, response);
    }

    private HttpResponseMessage NormalizeResponse(HttpRequestMessage request, HttpResponseMessage response) {
        object content;
        if (!response.IsSuccessStatusCode && response.TryGetContentValue(out content)) {

            var error = content as HttpError;
            if (error != null) {

                var unifiedModel = new {
                    error = error.Message,
                    error_description = (object)error.MessageDetail ?? error.ModelState
                };

                var newResponse = request.CreateResponse(response.StatusCode, unifiedModel);

                foreach (var header in response.Headers) {
                    newResponse.Headers.Add(header.Key, header.Value);
                }

                return newResponse;
            }

        }
        return response;
    }
}

虽然这个示例非常基础，但扩展它以满足您的自定义需求是微不足道的。

现在只需将处理程序添加到管道中即可

public static class WebApiConfig {
    public static void Register(HttpConfiguration config) {

        config.MessageHandlers.Add(new HttpErrorHandler());

        // Other code not shown...
    }
}

Message handlers are called in the same order that they appear in MessageHandlers collection. Because they are nested, the response message travels in the other direction. That is, the last handler is the first to get the response message.

Source: HTTP Message Handlers in ASP.NET Web API