MVC POST 请求失去授权 header - 如何使用 API Bearer Token 一旦检索

Question

上周我已经为现有的 MVC 应用程序创建了一个 API，现在正尝试保护 API 以及根据需要修改 MVC 端的安全性。

目前，MVC 应用程序设置为通过 OWIN/OAuth/Identity 使用应用程序 cookie。我试图合并 Web API 设置为在调用受限 API 方法时生成的 Bearer 令牌，但到目前为止收效甚微 - GET 请求工作得很好，但是 POST 请求在 API.

收到时失去授权 header

我已经创建了一个 SDK 客户端，MVC 应用正在使用它来调用 API，并且尝试了总共三种设置授权的方法 header调用 API，所有这些对于 GET 请求似乎工作得很好，但对于我需要发出的任何 POST 请求完全失败...

我可以在 MVC 控制器中设置请求 header:

HttpContext.Request.Headers.Add("Authorization", "Bearer " + response.AccessToken);

（其中 response.AccessToken 是先前从 API 检索到的令牌）
我可以通过 SDK 客户端上的扩展方法设置请求 header：

_apiclient.SetBearerAuthentication(token.AccessToken)

或者我可以在 SDK 客户端上手动设置请求 header：

_apiClient.Authentication = new AuthenticationHeaderValue("Bearer, accessToken);

（其中 accessToken 是之前检索到的令牌，传递给被调用的客户端方法）。

至此，关于导致问题的原因，我几乎没有什么可以继续的。到目前为止我唯一能够收集到的是 ASP.NET 导致所有 POST 请求首先发送带有 Expect header 的请求以获取 HTTP 100-Continue 响应，之后它将完成实际的 POST 请求。然而，似乎当它执行第二个请求时，授权 header 不再存在，因此 API 的授权属性将导致 401-Unauthorized 响应而不是实际运行 API 方法。

那么，我如何获取我能够从 API 检索到的 Bearer 令牌，并在后续请求中使用它， 包括各种 POST 我需要提出的要求？

除此之外，将此令牌存储在 MVC 应用程序本身上的最佳方式是什么？我宁愿避免将字符串传递给应用程序中可能需要它的每个方法，但我也一直在阅读，出于安全原因，将它存储在 cookie 中是一个非常糟糕的主意。

我通过这个问题后会立即感兴趣的几点：

使用 OAuth Bearer Tokens 是否意味着我不能再为 MVC 应用程序使用 ApplicationCookies？ And/or 它会导致以下代码在整个应用程序中无用吗？

User.Identity.GetUserId()

目前我被迫注释掉我的 API [Authorize] 属性以便继续我的工作，这显然不是理想的但它确实允许我暂时继续做事。

启动文件：

MVC：

public class Startup
{
    public void Configuration(IAppBuilder app)
    {
        ConfigureAuth(app);
    }

    private void ConfigureAuth(IAppBuilder app)
    {
        app.CreatePerOwinContext(ADUIdentityDbContext.Create);
        app.CreatePerOwinContext<ADUUserManager>(ADUUserManager.Create);
        
        app.UseOAuthBearerTokens(new OAuthAuthorizationServerOptions
                                 {
                                     AccessTokenExpireTimeSpan = TimeSpan.FromDays(1),
                                     //This should be set to FALSE before we move to production.
                                     AllowInsecureHttp =  true,
                                     ApplicationCanDisplayErrors = true,
                                     TokenEndpointPath = new PathString("/api/token"),

                                 });

        app.UseCookieAuthentication(new CookieAuthenticationOptions
                                    {
                                        AuthenticationType = DefaultAuthenticationTypes.ExternalBearer,
                                        CookieName = "ADU",
                                        ExpireTimeSpan = TimeSpan.FromHours(2),
                                        LoginPath = new PathString("/Account/Login"),
                                        SlidingExpiration = true,
                                        
                                    });
    }
}

API

public class Startup
{
    public void Configuration(IAppBuilder app)
    {
        HttpConfiguration config = new HttpConfiguration();

        config.DependencyResolver = new NinjectResolver(new Ninject.Web.Common.Bootstrapper().Kernel);

        WebApiConfig.Register(config);

        ConfigureOAuth(app);
        app.UseCors(Microsoft.Owin.Cors.CorsOptions.AllowAll);

        app.UseWebApi(config);
    }

    public void ConfigureOAuth(IAppBuilder app)
    {
        app.CreatePerOwinContext(ADUIdentityDbContext.Create);
        app.CreatePerOwinContext<ADUUserManager>(ADUUserManager.Create);

        OAuthAuthorizationServerOptions oAuthServerOptions = new OAuthAuthorizationServerOptions()
        {
            AllowInsecureHttp = true,
            TokenEndpointPath = new PathString("/api/token"),
            AccessTokenExpireTimeSpan = TimeSpan.FromDays(1),
            Provider = new SimpleAuthorizationServerProvider(),
        };

        //token generation
        app.UseOAuthAuthorizationServer(oAuthServerOptions);
        app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions());
    }
}

public class SimpleAuthorizationServerProvider : OAuthAuthorizationServerProvider
{
    private IUserBusinessLogic _userBusinessLogic;
    
    /// <summary>
    /// Creates the objects necessary to initialize the user business logic field and initializes it, as this cannot be done by dependency injection in this case.
    /// </summary>
    public void CreateBusinessLogic()
    {
        IUserRepository userRepo = new UserRepository();
        IGeneratedExamRepository examRepo = new GeneratedExamRepository();
        IGeneratedExamBusinessLogic examBLL = new GeneratedExamBusinessLogic(examRepo);
        _userBusinessLogic = new UserBusinessLogic(userRepo, examBLL);
    }

    public override async Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context) { context.Validated(); }

    public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
    {
        context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin", new[] { "*" });

        //create a claim for the user
        ClaimsIdentity identity = new ClaimsIdentity(context.Options.AuthenticationType);
        identity.AddClaim(new Claim("sub", user.Id));
        context.Validated(identity);
    }
}

Answer 1

在项目的其他方面花费大量时间后，实施其他功能实际上使解决这个问题变得容易得多 - 现在有一个 Response Wrapper Handler 作为 API 的一部分，以及该处理程序保存传入请求中的所有 Headers 并将它们添加到传出响应中。我相信这允许应用程序的 ASP.NET MVC 端在最初发送 200-OK 请求后再次发送授权 header。

我修改了我的身份验证以利用角色，但我会尝试排除该代码，因为它在这里不相关：

MVC Startup.cs:

    public class Startup
    {
        public void Configuration(IAppBuilder app) { ConfigureAuth(app); }

        /// <summary>
        ///     Configures authentication settings for OAuth.
        /// </summary>
        /// <param name="app"></param>
        private void ConfigureAuth(IAppBuilder app)
        {
            app.CreatePerOwinContext(ADUIdentityDbContext.Create);
            app.CreatePerOwinContext<ADUUserManager>(ADUUserManager.Create);

            app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions());

            app.UseCookieAuthentication(new CookieAuthenticationOptions
                                        {
                                            AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
                                            CookieName = "ADU",
                                            ExpireTimeSpan = TimeSpan.FromHours(2),
                                            LoginPath = new PathString("/Account/Login"),
                                            SlidingExpiration = true
                                        });
        }
    }

使用位置（AccountController）：

    private async Task CreateLoginCookie(AuthorizationToken response, User result)
        {
            //Create the claims needed to log a user in 
            //(uses UserManager several layers down in the stack)
            ClaimsIdentity cookieIdent = await _clientSDK.CreateClaimsIdentityForUser(response.AccessToken, result, true).ConfigureAwait(false);

            if (cookieIdent == null) throw new NullReferenceException("Failed to create claims for cookie.");
            cookieIdent.AddClaim(new Claim("AuthToken", response.AccessToken));

            AuthenticationProperties authProperties = new AuthenticationProperties();
            authProperties.AllowRefresh = true;
            authProperties.IsPersistent = true;
            authProperties.IssuedUtc = DateTime.Now.ToUniversalTime();

            IOwinContext context = HttpContext.GetOwinContext();
            AuthenticateResult authContext = await context.Authentication.AuthenticateAsync(DefaultAuthenticationTypes.ApplicationCookie);

            if (authContext != null)
                context.Authentication.AuthenticationResponseGrant = new AuthenticationResponseGrant(cookieIdent, authContext.Properties);

            //Wrapper methods for IOwinContext.Authentication.SignOut()/SignIn()
            SignOut();
            SignIn(authProperties, cookieIdent);
        }

在我的 SDK 层中，我创建了一个方法，我从用于访问我的 API 的各种其他方法中调用该方法，以便为每个传出请求设置授权（我想弄清楚如何将它变成一个属性，但我稍后会担心）：

    private void SetAuthentication()
        {
            ClaimsIdentity ident = (ClaimsIdentity)Thread.CurrentPrincipal.Identity;
            Claim claim;
            //Both of these methods (Thread.CurrentPrincipal, and ClaimsPrincipal.Current should work,
            //leaving both in for the sake of example.
            try
            {
                claim = ident.Claims.First(x => x.Type == "AuthToken");
            }
            catch (Exception)
            {
                claim = ClaimsPrincipal.Current.Claims.First(x => x.Type == "AuthToken");
            }
            
            _apiClient.SetBearerAuthentication(claim.Value);
        }

API Startup.cs

        /// <summary>
        ///     Configures the settings used by the framework on application start.  Dependency Resolver, OAuth, Routing, and CORS
        ///     are configured.
        /// </summary>
        /// <param name="app"></param>
        public void Configuration(IAppBuilder app)
        {
            HttpConfiguration config = new HttpConfiguration();

            config.DependencyResolver = new NinjectResolver(new Bootstrapper().Kernel);

            WebApiConfig.Register(config);

            ConfigureOAuth(app);
            app.UseCors(CorsOptions.AllowAll);

            app.UseWebApi(config);
        }

        /// <summary>
        ///     Configures authentication options for OAuth.
        /// </summary>
        /// <param name="app"></param>
        public void ConfigureOAuth(IAppBuilder app)
        {
            app.CreatePerOwinContext(ADUIdentityDbContext.Create);
            app.CreatePerOwinContext<ADUUserManager>(ADUUserManager.Create);

            OAuthAuthorizationServerOptions oAuthServerOptions = new OAuthAuthorizationServerOptions
                                                                 {
                                                                     AllowInsecureHttp = true,
                                                                     TokenEndpointPath = new PathString("/api/token"),
                                                                     AccessTokenExpireTimeSpan = TimeSpan.FromDays(1),
                                                                     Provider = new SimpleAuthorizationServerProvider()
                                                                 };

            //token generation
            app.UseOAuthAuthorizationServer(oAuthServerOptions);
            app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions());
        }

SimpleAuthorizationServerProvider.cs:

    /// <summary>
        ///     Creates an access bearer token and applies custom login validation logic to prevent invalid login attempts.
        /// </summary>
        /// <param name="context"></param>
        /// <returns></returns>
        public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
        {
            context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin", new[] { "*" });

            // Performs any login logic required, such as accessing Active Directory and password validation.
            User user = await CustomLoginLogic(context).ConfigureAwait(false);

            //If a use was not found, add an error if one has not been added yet
            if((user == null) && !context.HasError) SetInvalidGrantError(context);

            //Break if any errors have been set.
            if (context.HasError) return;

            //create a claim for the user
            ClaimsIdentity identity = new ClaimsIdentity(context.Options.AuthenticationType);

            //Add some basic information to the claim that will be used for the token.
            identity.AddClaim(new Claim("Id", user?.Id));
            identity.AddClaim(new Claim("TimeOf", DateTime.Now.ToShortDateString() + " " + DateTime.Now.ToLongTimeString()));

            //Roles auth
            SetRoleClaim(user, ref identity);

            context.Validated(identity);
        }

最后，将所有内容包装在一起的明显关键：

    public class ResponseWrappingHandler : DelegatingHandler
    {
        /// <summary>
        /// Catches the request before processing is completed and wraps the resulting response in a consistent response wrapper depending on the response returned by the api.
        /// </summary>
        /// <param name="request">The request that is being processed.</param>
        /// <param name="cancellationToken">A cancellation token to cancel the processing of a request.</param>
        /// <returns></returns>
        protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
        {
            HttpResponseMessage response = await base.SendAsync(request, cancellationToken);

            //Calls Wrapping methods depending on conditions,
            //All of the Wrapping methods will make a call to PreserveHeaders()
        }

        /// <summary>
        /// Creates a response based on the provided request with the provided response's status code and request headers, and the provided response data.
        /// </summary>
        /// <param name="request">The original request.</param>
        /// <param name="response">The reqsponse that was generated.</param>
        /// <param name="responseData">The data to include in the wrapped response.</param>
        /// <returns></returns>
        private static HttpResponseMessage PreserveHeaders(HttpRequestMessage request, HttpResponseMessage response, object responseData)
        {
            HttpResponseMessage newResponse = request.CreateResponse(response.StatusCode, responseData);

            foreach (KeyValuePair<string, IEnumerable<string>> header in response.Headers)
                newResponse.Headers.Add(header.Key, header.Value);

            return newResponse;
        }

有了所有这些，我的项目现在可以使用 authorization/authentication 而无需客户端机密等（这是我雇主的目标之一）。

MVC POST 请求失去授权 header - 如何使用 API Bearer Token 一旦检索

MVC POST requests losing Authorization header - how to use API Bearer Token once retrieved

post

asp.net-authorization

oauth-2.0

asp.net-mvc-5

asp.net-web-api2