WebAPI学习笔记（1）实现Basic Auth基本授权验证

1、Http基本认证只需要添加新的认证过滤属性。该属性类继承自 System.Web.Http.AuthorizeAttribute，在 IsAuthorized(...)方法中读取Http 头部Authorization字段及其值，进行自定义验证。

public class HttpBasicAuthAttribute : System.Web.Http.AuthorizeAttribute
    {
        public override void OnAuthorization(System.Web.Http.Controllers.HttpActionContext actionContext)
        {
            //从http请求的头里面获取身份验证信息，验证是否是请求发起方的ticket
            var authorization = actionContext.Request.Headers.Authorization;
            if ((authorization != null) && (authorization.Parameter != null))
            {
                //解密用户ticket,并校验用户名密码是否匹配
                var encryptTicket = authorization.Parameter;
                if (ValidateTicket(encryptTicket))
                {
                    base.IsAuthorized(actionContext);
                }
                else
                {
                    HandleUnauthorizedRequest(actionContext);
                }
            }
            //如果取不到身份验证信息，则返回未验证401
            else
            {
                HandleUnauthorizedRequest(actionContext);
            }
        }

        //校验用户名密码（正式环境中应该是数据库校验）
        private bool ValidateTicket(string encryptTicket)
        {
            //解密Ticket
            string strTicket = System.Text.Encoding.Default.GetString(Convert.FromBase64String(encryptTicket));

            //从Ticket里面获取用户名和密码
            var index = strTicket.IndexOf(":");
            string strUser = strTicket.Substring(0, index);
            string strPwd = strTicket.Substring(index + 1);

            if (strUser == "admin" && strPwd == "123456")
            {
                return true;
            }
            else
            {
                return false;
            }
        }
    }

2、在需要验证的具体Controller类或封装的基类中添加HttpBasicAuthAttribute类属性。

[HttpBasicAuth]
public class BaseController : ApiController
{
        private string _adminUserToken = "";

        /// <summary>
        /// Admin User Token
        /// </summary>
        public string AdminUserToken
        {
            get { return _adminUserToken; }
            set { _adminUserToken = value; }
        }
}

3、这样就完成了服务器端的设置。

4、用Postman调用：

5、Asp.net调用：

string Username = "admin";
string Password = "123456";
using (HttpClient client = new HttpClient())
{
    client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Basic", Convert.ToBase64String(Encoding.UTF8.GetBytes($"{Username}:{Password}")));

    HttpContent httpContent = new StringContent("", Encoding.UTF8);
    httpContent.Headers.ContentType = new MediaTypeHeaderValue("application/json");
    Uri address = new Uri("https://xxx/api/issues");

    var response = client.PostAsync(address, httpContent).Result.Content.ReadAsStringAsync().Result;//返回值
}

6、返回结果：

【原文出处】http://www.51aras.com/?id=39