asp.net-web-api - 是否有可能单独使用 allow anonymous 属性并删除 swagger 授权？

Question

我想删除授权，即仅针对 swagger 删除我的 Web API 应用程序的不记名 token 身份验证。对于 postman 等其他控制台应用程序，授权应该像往常一样工作。如果是这样，如何仅凭 Swagger 就可以实现。前提是我为我的应用程序使用 swashbuckle NuGet 包。

Answer 1

下面是我试过的代码，我对 swagger 和其他 url 使用了自定义授权，它在本地环境中工作正常，但我的 api 无法通过 https 服务器中其他 api 的部署后访问，出现未经授权的错误。

    public class CustomAuthorization : AuthorizationFilterAttribute
   {
    public override void OnAuthorization(HttpActionContext actionContext)
    {
        Uri currentUrl = HttpContext.Current.Request.UrlReferrer;
        if(currentUrl != null)
        {
            if (currentUrl.Segments.Contains("swagger"))
            {
                string accessToken = "";
                using (var client = new HttpClient())
                {
                    var form = new Dictionary<string, string>
                {
                    {"grant_type", "password"},
                    {"username", "user"},
                    {"password", "password"},
                    {"scope","scope"}
                };
                    string url = HttpContext.Current.Request.Url.GetLeftPart(UriPartial.Authority);

                    var tokenResponse = client.PostAsync(url + "/token", new FormUrlEncodedContent(form)).Result;
                    var token = tokenResponse.Content.ReadAsAsync<AuthorizationToken>(new[] { new JsonMediaTypeFormatter() }).Result;
                    accessToken = token.access_token;
                    HttpContext.Current.Request.Headers.Add("Authorization", "Bearer " + accessToken);
                }
            }
        }
        else
        {
            var principal = actionContext.RequestContext.Principal as ClaimsPrincipal;

            if (!principal.Identity.IsAuthenticated)
            {
                AuthorizationMessage autho = new AuthorizationMessage();
                autho.Message = "Missing access credentials.";
                autho.Type = "Unauthorize";
                actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.Unauthorized, autho);
            }
        }
    }
    class AuthorizationMessage
    {
        public string Type { get; set; }
        public string Message { get; set; }

    }
}