ASP.NET WebAPI 安全与身份验证 基础验证与非对称加密

因为安全需要,又没有申请HTTPS证书 只对密码进行了非对称加密 同时服务端验证了是否有证书

本文参考了：

MSDN 13年6月的期刊（启用和自定义 ASP.NET Web API 服务的安全性 ）：https://msdn.microsoft.com/zh-cn/magazine/dn201748.aspx

与园子里（C#使用RSA证书文件加密和解密示例）：http://www.cnblogs.com/eshizhan/archive/2012/10/07/2713680.html

根据实际使用环境做了一定修改：

服务端 HttpModel 验证：

 /// <summary>
    /// 身份验证
    /// </summary>
    public class PHVHttpAuthentication : IHttpModule, IDisposable
    {
        /// <summary>
        /// 初始化
        /// </summary>
        /// <param name="context"></param>
        public void Init(HttpApplication context)
        {
            context.AuthenticateRequest += AuthenticateRequests;
            context.EndRequest += TriggerCredentials;
        }

        private static void TriggerCredentials(object sender, EventArgs e)
        {
            HttpResponse resp = HttpContext.Current.Response;
            if (resp.StatusCode == 401)
            {
                resp.Headers.Add("WWW-Authenticate", @"Basic realm='PHVIS'");
            }
        }

        private static void AuthenticateRequests(object sender, EventArgs e)
        {
            System.Web.HttpClientCertificate cert = HttpContext.Current.Request.ClientCertificate;

            if (cert != null && cert.IsValid) //验证证书是否存在并且有效
            {
                string authHeader = HttpContext.Current.Request.Headers["Authorization"];

                if (authHeader != null)
                {
                    AuthenticationHeaderValue authHeaderVal = AuthenticationHeaderValue.Parse(authHeader);
                    if (authHeaderVal.Parameter != null)
                    {
                        byte[] unencoded = Convert.FromBase64String(authHeaderVal.Parameter);
                        string userpw = Encoding.GetEncoding("iso-8859-1").GetString(unencoded);

                        string[] creds = userpw.Split(':');
                        string path = HttpContext.Current.Server.MapPath("~/App_Data/token.pfx");
                        X509Certificate2 prvcrt = new X509Certificate2(path, "rootshell", X509KeyStorageFlags.Exportable);
                        RSACryptoServiceProvider prvkey = (RSACryptoServiceProvider)prvcrt.PrivateKey;
                        var passwordbits = SecurityHelper.RSADecrypt(Convert.FromBase64String(creds[1]), prvkey.ExportParameters(true), false);
                        var password = Encoding.GetEncoding("iso-8859-1").GetString(passwordbits);
                        if (creds[0] == "Peter" && password == "123")
                        {
                            GenericIdentity gi = new GenericIdentity(creds[0]);
                            Thread.CurrentPrincipal = new GenericPrincipal(gi, null);
                            HttpContext.Current.User = Thread.CurrentPrincipal;

                            //string[] roles = "manager,admin".Split(',');
                            //Thread.CurrentPrincipal = new GenericPrincipal(gi, roles);
                        }
                    }
                }
            }
            else
            {

            }


        }

        /// <summary>
        /// 销毁
        /// </summary>
        public void Dispose()
        {

        }


    }

Web.Config配置：

 <modules>
      <add name="EthanAuthorize"  type="Security.PHVHttpAuthentication, Security"/>
    </modules>

完成这两步就已经可以实现对用户名和密码的验证了
接下来就是在需要调用的API上加上AuthorizeAttribute标记既可：

 /// <summary>
        /// 获取数据
        /// </summary>
        /// <param name="appId">微信AppD</param>
        /// <returns></returns>
        [Authorize(Users = "Peter")]
        public string Get(string appId)
        {
            if (User.Identity.IsAuthenticated)
            {
                return "ok";
            }
            else
            {
                return "error";
            }
        }

附上非对称加密的类：

 /// <summary>
    /// 加密解密类
    /// </summary>
    public class SecurityHelper
    {
       
        /// <summary>
        /// 非对称加密
        /// </summary>
        /// <param name="DataToEncrypt">待加密的数据</param>
        /// <param name="RSAKeyInfo">公玥信息</param>
        /// <param name="DoOAEPPadding"></param>
        /// <returns></returns>
        public static byte[] RSAEncrypt(byte[] DataToEncrypt, RSAParameters RSAKeyInfo, bool DoOAEPPadding)
        {
            try
            {
                byte[] encryptedData;
                //Create a new instance of RSACryptoServiceProvider.
                using (RSACryptoServiceProvider RSA = new RSACryptoServiceProvider())
                {

                    //Import the RSA Key information. This only needs
                    //toinclude the public key information.
                    RSA.ImportParameters(RSAKeyInfo);

                    //Encrypt the passed byte array and specify OAEP padding.  
                    //OAEP padding is only available on Microsoft Windows XP or
                    //later.  
                    encryptedData = RSA.Encrypt(DataToEncrypt, DoOAEPPadding);
                }
                return encryptedData;
            }
            //Catch and display a CryptographicException  
            //to the console.
            catch (CryptographicException e)
            {
                Console.WriteLine(e.Message);

                return null;
            }

        }

        /// <summary>
        /// 非对称解密
        /// </summary>
        /// <param name="DataToDecrypt">待解密信息</param>
        /// <param name="RSAKeyInfo">私钥信息</param>
        /// <param name="DoOAEPPadding"></param>
        /// <returns></returns>
        public static byte[] RSADecrypt(byte[] DataToDecrypt, RSAParameters RSAKeyInfo, bool DoOAEPPadding)
        {
            try
            {
                byte[] decryptedData;
                //Create a new instance of RSACryptoServiceProvider.
                using (RSACryptoServiceProvider RSA = new RSACryptoServiceProvider())
                {
                    //Import the RSA Key information. This needs
                    //to include the private key information.
                    RSA.ImportParameters(RSAKeyInfo);

                    //Decrypt the passed byte array and specify OAEP padding.  
                    //OAEP padding is only available on Microsoft Windows XP or
                    //later.  
                    decryptedData = RSA.Decrypt(DataToDecrypt, DoOAEPPadding);
                }
                return decryptedData;
            }
            //Catch and display a CryptographicException  
            //to the console.
            catch (CryptographicException e)
            {
                Console.WriteLine(e.ToString());

                return null;
            }

        }
    }

客户端的使用代码：

 X509Certificate2 pubcrt = new X509Certificate2(System.Web.HttpContext.Current.Server.MapPath("~/App_Data/token.cer"));
                    string DefaultUserAgent = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)";
                    HttpWebRequest request = WebRequest.Create(string.Format("http://api.xxxxxx.com/api/token?appid={0}", appid)) as HttpWebRequest;
                    request.Method = "GET";
                    request.UserAgent = DefaultUserAgent;
                    request.ClientCertificates.Add(pubcrt);

                    RSACryptoServiceProvider pubkey = (RSACryptoServiceProvider)pubcrt.PublicKey.Key;
                    UTF8Encoding ByteConverter = new UTF8Encoding();
                    byte[] dataToEncrypt = ByteConverter.GetBytes("123");
                    string password = Convert.ToBase64String(SecurityHelper.RSAEncrypt(dataToEncrypt, pubkey.ExportParameters(false), false));

                    request.Credentials= new NetworkCredential("Peter", password);

                    var result= request.GetResponse() as HttpWebResponse;

                    var sr = new StreamReader(result.GetResponseStream(), Encoding.UTF8);

                    //返回结果网页（html）代码
                    string content = sr.ReadToEnd();