post - MVC POST 请求丢失授权 header - 检索后如何使用 API 承载 token

Question

上周我为现有 MVC 应用程序创建了一个 API，现在正在尝试保护 API 并根据需要重新设计 MVC 端安全性。

目前，MVC 应用程序设置为通过 OWIN/OAuth/Identity 使用应用程序 cookie。我尝试合并 Web API 设置为在调用受限 API 方法时生成的不记名 token ，但到目前为止收效甚微 - GET 请求工作得很好，但 POST 请求在收到时会丢失授权 header API。

我创建了一个 SDK 客户端，MVC 应用程序使用它来调用 API，并尝试了总共三种方法来为任何给定的 API 调用设置授权 header ，所有这些似乎对于 GET 请求工作得很好，但对于我需要发出的任何 POST 请求完全失败...

我可以在 MVC Controller 中设置请求 header :

HttpContext.Request.Headers.Add("Authorization", "Bearer " + response.AccessToken);

(其中response.AccessToken是之前从API检索的 token )
我可以通过 SDK 客户端上的扩展方法设置请求 header :

_apiclient.SetBearerAuthentication(token.AccessToken)

或者我可以在 SDK 客户端上手动设置请求 header :

_apiClient.Authentication = new AuthenticationHeaderValue("Bearer, accessToken);

(其中 accessToken 是之前检索到的 token ，传递给正在调用的客户端方法)。

从现在起，我对导致问题的原因知之甚少。到目前为止，我唯一能了解到的是，ASP.NET 会导致所有 POST 请求首先发送带有 Expect header 的 HTTP 100-Continue 响应，之后它将完成实际的 POST 请求。然而，当它执行第二个请求时，Authorization header 似乎不再存在，因此 API 的 Authorize 属性将导致 401-Unauthorized 响应，而不是实际运行 API 方法。

那么，如何获取能够从 API 检索的 Bearer token ，并在后续请求中使用它，包括我需要发出的各种 POST 请求？

除此之外，在 MVC 应用程序本身上存储此 token 的最佳方式是什么？我宁愿避免将字符串传递给应用程序中可能需要它的每个方法，但我也一直读到，出于安全原因，将其存储在 cookie 中是一个非常糟糕的主意。

在我通过此问题后，我会立即感兴趣的其他几点:

使用 OAuth 承载 token 是否意味着我不能再对 MVC 应用程序使用 ApplicationCookie？和/或它会使以下代码在整个应用程序中毫无用处吗？

User.Identity.GetUserId()

目前，我被迫注释掉我的 API [Authorize] 属性，以便继续我的工作，这显然并不理想，但它确实允许我暂时继续处理事情。

启动文件:

MVC:

public class Startup
{
    public void Configuration(IAppBuilder app)
    {
        ConfigureAuth(app);
    }

    private void ConfigureAuth(IAppBuilder app)
    {
        app.CreatePerOwinContext(ADUIdentityDbContext.Create);
        app.CreatePerOwinContext<ADUUserManager>(ADUUserManager.Create);
        
        app.UseOAuthBearerTokens(new OAuthAuthorizationServerOptions
                                 {
                                     AccessTokenExpireTimeSpan = TimeSpan.FromDays(1),
                                     //This should be set to FALSE before we move to production.
                                     AllowInsecureHttp =  true,
                                     ApplicationCanDisplayErrors = true,
                                     TokenEndpointPath = new PathString("/api/token"),

                                 });

        app.UseCookieAuthentication(new CookieAuthenticationOptions
                                    {
                                        AuthenticationType = DefaultAuthenticationTypes.ExternalBearer,
                                        CookieName = "ADU",
                                        ExpireTimeSpan = TimeSpan.FromHours(2),
                                        LoginPath = new PathString("/Account/Login"),
                                        SlidingExpiration = true,
                                        
                                    });
    }
}

API

public class Startup
{
    public void Configuration(IAppBuilder app)
    {
        HttpConfiguration config = new HttpConfiguration();

        config.DependencyResolver = new NinjectResolver(new Ninject.Web.Common.Bootstrapper().Kernel);

        WebApiConfig.Register(config);

        ConfigureOAuth(app);
        app.UseCors(Microsoft.Owin.Cors.CorsOptions.AllowAll);

        app.UseWebApi(config);
    }

    public void ConfigureOAuth(IAppBuilder app)
    {
        app.CreatePerOwinContext(ADUIdentityDbContext.Create);
        app.CreatePerOwinContext<ADUUserManager>(ADUUserManager.Create);

        OAuthAuthorizationServerOptions oAuthServerOptions = new OAuthAuthorizationServerOptions()
        {
            AllowInsecureHttp = true,
            TokenEndpointPath = new PathString("/api/token"),
            AccessTokenExpireTimeSpan = TimeSpan.FromDays(1),
            Provider = new SimpleAuthorizationServerProvider(),
        };

        //token generation
        app.UseOAuthAuthorizationServer(oAuthServerOptions);
        app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions());
    }
}

public class SimpleAuthorizationServerProvider : OAuthAuthorizationServerProvider
{
    private IUserBusinessLogic _userBusinessLogic;
    
    /// <summary>
    /// Creates the objects necessary to initialize the user business logic field and initializes it, as this cannot be done by dependency injection in this case.
    /// </summary>
    public void CreateBusinessLogic()
    {
        IUserRepository userRepo = new UserRepository();
        IGeneratedExamRepository examRepo = new GeneratedExamRepository();
        IGeneratedExamBusinessLogic examBLL = new GeneratedExamBusinessLogic(examRepo);
        _userBusinessLogic = new UserBusinessLogic(userRepo, examBLL);
    }

    public override async Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context) { context.Validated(); }

    public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
    {
        context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin", new[] { "*" });

        //create a claim for the user
        ClaimsIdentity identity = new ClaimsIdentity(context.Options.AuthenticationType);
        identity.AddClaim(new Claim("sub", user.Id));
        context.Validated(identity);
    }
}

Answer 1

在项目的其他方面投入了大量时间之后，实现其他功能实际上使解决这个问题变得更加容易 - 现在有一个响应包装处理程序作为 API 的一部分，并且该处理程序的一部分保存了来自的所有 header 传入的请求并将它们添加到传出的响应中。我相信这允许应用程序的 ASP.NET MVC 端在最初发送 200-OK 请求后再次发送授权 header 。

我已经修改了我的身份验证以便利用角色，但我将尝试排除该代码，因为它不应与此处相关:

MVC Startup.cs:

    public class Startup
    {
        public void Configuration(IAppBuilder app) { ConfigureAuth(app); }

        /// <summary>
        ///     Configures authentication settings for OAuth.
        /// </summary>
        /// <param name="app"></param>
        private void ConfigureAuth(IAppBuilder app)
        {
            app.CreatePerOwinContext(ADUIdentityDbContext.Create);
            app.CreatePerOwinContext<ADUUserManager>(ADUUserManager.Create);

            app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions());

            app.UseCookieAuthentication(new CookieAuthenticationOptions
                                        {
                                            AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
                                            CookieName = "ADU",
                                            ExpireTimeSpan = TimeSpan.FromHours(2),
                                            LoginPath = new PathString("/Account/Login"),
                                            SlidingExpiration = true
                                        });
        }
    }

使用地点(AccountController):

    private async Task CreateLoginCookie(AuthorizationToken response, User result)
        {
            //Create the claims needed to log a user in 
            //(uses UserManager several layers down in the stack)
            ClaimsIdentity cookieIdent = await _clientSDK.CreateClaimsIdentityForUser(response.AccessToken, result, true).ConfigureAwait(false);

            if (cookieIdent == null) throw new NullReferenceException("Failed to create claims for cookie.");
            cookieIdent.AddClaim(new Claim("AuthToken", response.AccessToken));

            AuthenticationProperties authProperties = new AuthenticationProperties();
            authProperties.AllowRefresh = true;
            authProperties.IsPersistent = true;
            authProperties.IssuedUtc = DateTime.Now.ToUniversalTime();

            IOwinContext context = HttpContext.GetOwinContext();
            AuthenticateResult authContext = await context.Authentication.AuthenticateAsync(DefaultAuthenticationTypes.ApplicationCookie);

            if (authContext != null)
                context.Authentication.AuthenticationResponseGrant = new AuthenticationResponseGrant(cookieIdent, authContext.Properties);

            //Wrapper methods for IOwinContext.Authentication.SignOut()/SignIn()
            SignOut();
            SignIn(authProperties, cookieIdent);
        }

在我的 SDK 层中，我创建了一个方法，从用于访问 API 的各种其他方法中调用该方法，以便为每个传出请求设置授权(我想弄清楚如何将其变成一个属性，但我稍后会担心):

    private void SetAuthentication()
        {
            ClaimsIdentity ident = (ClaimsIdentity)Thread.CurrentPrincipal.Identity;
            Claim claim;
            //Both of these methods (Thread.CurrentPrincipal, and ClaimsPrincipal.Current should work,
            //leaving both in for the sake of example.
            try
            {
                claim = ident.Claims.First(x => x.Type == "AuthToken");
            }
            catch (Exception)
            {
                claim = ClaimsPrincipal.Current.Claims.First(x => x.Type == "AuthToken");
            }
            
            _apiClient.SetBearerAuthentication(claim.Value);
        }

API启动.cs

        /// <summary>
        ///     Configures the settings used by the framework on application start.  Dependency Resolver, OAuth, Routing, and CORS
        ///     are configured.
        /// </summary>
        /// <param name="app"></param>
        public void Configuration(IAppBuilder app)
        {
            HttpConfiguration config = new HttpConfiguration();

            config.DependencyResolver = new NinjectResolver(new Bootstrapper().Kernel);

            WebApiConfig.Register(config);

            ConfigureOAuth(app);
            app.UseCors(CorsOptions.AllowAll);

            app.UseWebApi(config);
        }

        /// <summary>
        ///     Configures authentication options for OAuth.
        /// </summary>
        /// <param name="app"></param>
        public void ConfigureOAuth(IAppBuilder app)
        {
            app.CreatePerOwinContext(ADUIdentityDbContext.Create);
            app.CreatePerOwinContext<ADUUserManager>(ADUUserManager.Create);

            OAuthAuthorizationServerOptions oAuthServerOptions = new OAuthAuthorizationServerOptions
                                                                 {
                                                                     AllowInsecureHttp = true,
                                                                     TokenEndpointPath = new PathString("/api/token"),
                                                                     AccessTokenExpireTimeSpan = TimeSpan.FromDays(1),
                                                                     Provider = new SimpleAuthorizationServerProvider()
                                                                 };

            //token generation
            app.UseOAuthAuthorizationServer(oAuthServerOptions);
            app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions());
        }

SimpleAuthorizationServerProvider.cs:

    /// <summary>
        ///     Creates an access bearer token and applies custom login validation logic to prevent invalid login attempts.
        /// </summary>
        /// <param name="context"></param>
        /// <returns></returns>
        public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
        {
            context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin", new[] { "*" });

            // Performs any login logic required, such as accessing Active Directory and password validation.
            User user = await CustomLoginLogic(context).ConfigureAwait(false);

            //If a use was not found, add an error if one has not been added yet
            if((user == null) && !context.HasError) SetInvalidGrantError(context);

            //Break if any errors have been set.
            if (context.HasError) return;

            //create a claim for the user
            ClaimsIdentity identity = new ClaimsIdentity(context.Options.AuthenticationType);

            //Add some basic information to the claim that will be used for the token.
            identity.AddClaim(new Claim("Id", user?.Id));
            identity.AddClaim(new Claim("TimeOf", DateTime.Now.ToShortDateString() + " " + DateTime.Now.ToLongTimeString()));

            //Roles auth
            SetRoleClaim(user, ref identity);

            context.Validated(identity);
        }

最后，将所有内容包装在一起的明显关键:

    public class ResponseWrappingHandler : DelegatingHandler
    {
        /// <summary>
        /// Catches the request before processing is completed and wraps the resulting response in a consistent response wrapper depending on the response returned by the api.
        /// </summary>
        /// <param name="request">The request that is being processed.</param>
        /// <param name="cancellationToken">A cancellation token to cancel the processing of a request.</param>
        /// <returns></returns>
        protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
        {
            HttpResponseMessage response = await base.SendAsync(request, cancellationToken);

            //Calls Wrapping methods depending on conditions,
            //All of the Wrapping methods will make a call to PreserveHeaders()
        }

        /// <summary>
        /// Creates a response based on the provided request with the provided response's status code and request headers, and the provided response data.
        /// </summary>
        /// <param name="request">The original request.</param>
        /// <param name="response">The reqsponse that was generated.</param>
        /// <param name="responseData">The data to include in the wrapped response.</param>
        /// <returns></returns>
        private static HttpResponseMessage PreserveHeaders(HttpRequestMessage request, HttpResponseMessage response, object responseData)
        {
            HttpResponseMessage newResponse = request.CreateResponse(response.StatusCode, responseData);

            foreach (KeyValuePair<string, IEnumerable<string>> header in response.Headers)
                newResponse.Headers.Add(header.Key, header.Value);

            return newResponse;
        }

完成所有这些后，我的项目现在可以使用授权/身份验证，而无需客户端 secret 等(这是我雇主的目标之一)。