AuthorizationHandler 异常不通过 ExceptionFilter

Question

我在 ASP.NET Core MVC (dnx46) RC1 中有一个带有 AuthorizationHandler 的应用程序：

public class AppSumAuthAuthorizationHandler : AuthorizationHandler<AppSumAuthRequirement>
{
    private readonly IUserRepository _userRepository;
    private readonly IUserRoleRepository _userRoleRepository;

    public AppSumAuthAuthorizationHandler(IUserRepository userRepository, IUserRoleRepository userRoleRepository)
    {
        _userRepository = userRepository;
        _userRoleRepository = userRoleRepository;
    }
    protected override async void Handle(AuthorizationContext context, AppSumAuthRequirement requirement)
    {
        await HandleAsync(context,requirement);
    }

    protected override async Task HandleAsync(AuthorizationContext context, AppSumAuthRequirement requirement)
    {
        var currentUserName = context.User.Identity.Name;
        var currentUser = await _userRepository.GetAsync(u => u.UserName == context.User.Identity.Name);

        // Create user that does not yet exist
        if(currentUser == null)
        {
            var user = new User(currentUserName);
            /* Temporary add SysAdmin role */
            using(new CreatedBySystemProvider(_userRepository))
            {
                _userRepository.Add(user);
                await _userRepository.SaveChangesAsync();
                if (string.Equals(currentUserName, @"BIJTJES\NilsG", StringComparison.CurrentCultureIgnoreCase))
                {
                    user.AddRole(1);
                }
                currentUser = await _userRepository.GetAsync(u => u.Id == user.Id);
            }
        }
        var resource = (Microsoft.AspNet.Mvc.Filters.AuthorizationContext) context.Resource;
        var controllerActionDescriptor = resource.ActionDescriptor  as ControllerActionDescriptor;
        var controllerName = controllerActionDescriptor.ControllerName;
        var actionName = controllerActionDescriptor.Name;
        string moduleName;
        try
        {
            // Get the name of the module
            moduleName = ((ModuleAttribute)controllerActionDescriptor.ControllerTypeInfo.GetCustomAttributes(false).First(a => a.GetType().Name == "ModuleAttribute")).ModuleName;
        }
        catch(InvalidOperationException ex)
        {
            context.Fail();
            throw new InvalidOperationException($"The Module Attribute is required on basecontroller {controllerName}.", ex);
        }

        var access = new Access(moduleName, controllerName, actionName);

        if (await currentUser.HasPermissionTo(UrlAccessLevel.Access).OnAsync(access))
        {
            context.Succeed(requirement);
        }
        else
        {
            context.Fail();
        }
    }
}

要求class为空：

public interface IAppSumAuthRequirement : IAuthorizationRequirement
{

}
public class AppSumAuthRequirement : IAppSumAuthRequirement
{

}

Module属性也没什么特别的：

public class ModuleAttribute : Attribute
{
    public string ModuleName { get; private set; }
    public ModuleAttribute(string moduleName)
    {
        ModuleName = moduleName;
    }

    public override string ToString()
    {
        return ModuleName;
    }
}

异常过滤器：

    public class JsonExceptionFilterAttribute : ExceptionFilterAttribute
{
    public override void OnException(ExceptionContext context)
    {
        var exception = context.Exception;
        context.HttpContext.Response.StatusCode = 500;
        context.Result = new JsonResult(new Error
        {
            Message = exception.Message,
            InnerException = exception.InnerException?.InnerException?.Message,
            Data = exception.Data,
            ErrorCode = exception.HResult,
            Source = exception.Source,
            Stacktrace = exception.StackTrace,
            ErrorType = exception.GetType().ToString()
    });
    }
}

和策略在我的 Startup.cs:

中配置

public IServiceProvider ConfigureServices(IServiceCollection services)
    {
        services.AddMvc(options =>
        {
            options.Filters.Add(new JsonExceptionFilterAttribute());
            options.ModelBinders.Insert(0, new NullableIntModelBinder());
        }).AddJsonOptions(options => {
            options.SerializerSettings.ReferenceLoopHandling = Newtonsoft.Json.ReferenceLoopHandling.Ignore;
            options.SerializerSettings.ContractResolver = new Newtonsoft.Json.Serialization.CamelCasePropertyNamesContractResolver();
        });

        // Security
        services.AddAuthorization(options =>
        {
            options.AddPolicy("AppSumAuth",
                policy => policy.Requirements.Add(new AppSumAuthRequirement()));
        });
}

并在所有控制器上设置策略，通过继承BaseController:

[Authorize(Policy = "AppSumAuth")]
public class BaseController : Controller
{
    public BaseController()
    {

    }
}

因此，在我的处理程序中，我获得了控制器名称、操作名称和模块名称（来自控制器上设置的属性）：

[Module("Main")]

当控制器上没有设置此属性时，我想捕获异常并将其报告给调用控制器的开发人员并拒绝访问。为此，我添加了：

        catch(InvalidOperationException ex)
        {
            context.Fail();
            throw new InvalidOperationException($"The Module Attribute is required on basecontroller {controllerName}.", ex);
        }

控制器异常时完美调用JsonExceptionFilter。但是，当 AuthorizationHandler 中出现错误时不会调用它。

所以问题：

如何让 JsonExceptionFilter 捕获异常？ 我做错了什么？

解决方案：

Startup.cs:

public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
    {
        // For Windows Auth!
        app.UseIISPlatformHandler();

        app.UseStaticFiles();

        app.UseExceptionHandler(AppSumExceptionMiddleware.JsonHandler());

        app.UseMvc();
    }

还有我的中间件：

public class AppSumExceptionMiddleware
{
    public static Action<IApplicationBuilder> JsonHandler()
    {
        return errorApp =>
        {
            errorApp.Run(async context =>
            {
                var exception = context.Features.Get<IExceptionHandlerFeature>();
                if (exception != null)
                {
                    var exceptionJson = Encoding.UTF8.GetBytes(
                        JsonConvert.SerializeObject(new AppSumException(exception.Error), 
                        new JsonSerializerSettings
                        {
                            ContractResolver = new CamelCasePropertyNamesContractResolver()
                        })
                    );
                    context.Response.ContentType = "application/json";
                    await context.Response.Body.WriteAsync(exceptionJson, 0, exceptionJson.Length);
                }
            });
        };
    }
}

Answer 1

动作过滤器可以用作方法过滤器、控制器过滤器或全局过滤器，仅适用于 MVC HTTP 请求。在您的情况下，您需要使用 middleware，因为

Middleware is component that "sit" on the HTTP pipeline and examine all requests and responses.

因为你想在异常情况下工作，你可以使用现成的 ExceptionHandler 中间件：

        app.UseExceptionHandler(errorApp =>
        {
            errorApp.Run(async context =>
            {
                context.Response.StatusCode = 500; // for example

                var error = context.Features.Get<IExceptionHandlerFeature>();
                if (error != null)
                {
                    var ex = error.Error;
                    // custom logic
                }
            });
        });

AuthorizationHandler 异常不通过 ExceptionFilter

AuthorizationHandler exception not going through ExceptionFilter

c#

asp.net-core-mvc

.net-core

asp.net-core

解决方案：