网站开发网站,建设网站什么费用,新都区网站建设,图片网站制作HTTP基本认证在HTTP中#xff0c;HTTP基本认证#xff08;Basic Authentication#xff09;是一种允许浏览器或其他客户端程序使用#xff08;用户名#xff0c;口令#xff09;请求资源的身份验证方式#xff0c;不要求cookie,session identifier、login page等标记或载… HTTP基本认证 在HTTP中HTTP基本认证Basic Authentication是一种允许浏览器或其他客户端程序使用用户名口令请求资源的身份验证方式不要求cookie,session identifier、login page等标记或载体。 所有浏览器据支持HTTP基本认证协议基本身证原理不保证传输凭证的安全性仅被based64编码并没有encrypted或者hashed一般部署在互信的内网在公网上应用BA协议通常与https结合。BA标准协议 BA协议的实施主要依靠约定的请求头/响应头 典型的浏览器和服务器的BA认证流程① 浏览器请求应用了BA的网站服务端响应一个401认证失败响应码并写入WWW-Authenticate响应头指示服务端支持BA协议。HTTP/1.1 401 Unauthorized
WWW-Authenticate: Basic realmour site
或在初次请求时发送正确Authorization标头从而避免被质询② 客户端以based64(用户名:口令) 作为Authorization标头值重新发送请求Authorization: Basic userid:password认证的范围与realm相关准确的realm由服务端定义因为服务端可能有多个不同的realm. 浏览器客户端对于WWW-Authenticate响应头弹出了口令输入窗。BA编程实践 ASP.NET Core网站利用FileServerMiddleware将部分路径映射到文件资源对该资源访问路径应用Http基本认证。服务端实现BA认证 ① 实现基本认证Handler认证、无口令质询、质询失败逻辑# ......
namespace EqidManager.Services
{public static class BasicAuthenticationScheme{public const string DefaultScheme Basic;}public class BasicAuthenticationOption:AuthenticationSchemeOptions{public string Realm { get; set; }public string UserName { get; set; }public string UserPwd { get; set; }}public class BasicAuthenticationHandler : AuthenticationHandlerBasicAuthenticationOption{private readonly BasicAuthenticationOption authOptions;public BasicAuthenticationHandler(IOptionsMonitorBasicAuthenticationOption options,ILoggerFactory logger,UrlEncoder encoder,ISystemClock clock): base(options, logger, encoder, clock){authOptions options.CurrentValue;}/// summary/// 认证逻辑/// /summaryprotected override async TaskAuthenticateResult HandleAuthenticateAsync(){if (!Request.Headers.ContainsKey(Authorization))return AuthenticateResult.Fail(Missing Authorization Header);string username, password;try{var authHeader AuthenticationHeaderValue.Parse(Request.Headers[Authorization]);var credentialBytes Convert.FromBase64String(authHeader.Parameter);var credentials Encoding.UTF8.GetString(credentialBytes).Split(:);username credentials[0];password credentials[1];var isValidUser IsAuthorized(username,password);if(isValidUser false)return AuthenticateResult.Fail(Invalid username or password);}catchreturn AuthenticateResult.Fail(Invalid Authorization Header);var claims new[] {new Claim(ClaimTypes.NameIdentifier,username),new Claim(ClaimTypes.Name,username),};var identity new ClaimsIdentity(claims, Scheme.Name);var principal new ClaimsPrincipal(identity);var ticket new AuthenticationTicket(principal, Scheme.Name);return await Task.FromResult(AuthenticateResult.Success(ticket));}/// summary/// 质询/// /summaryprotected override async Task HandleChallengeAsync(AuthenticationProperties properties){Response.Headers[WWW-Authenticate] $Basic realm\{Options.Realm}\;await base.HandleChallengeAsync(properties);}/// summary/// 认证失败/// /summaryprotected override async Task HandleForbiddenAsync(AuthenticationProperties properties){await base.HandleForbiddenAsync(properties); }private bool IsAuthorized(string username, string password){return username.Equals(authOptions.UserName, StringComparison.InvariantCultureIgnoreCase) password.Equals(authOptions.UserPwd);}}
}② 实现BasicAuthenticationMiddleware: 要求对HttpContext应用BA Scheme。// HTTP基本认证Middlewarepublic static class BasicAuthentication{public static void UseBasicAuthentication(this IApplicationBuilder app){app.UseMiddlewareBasicAuthenticationMiddleware();}}
public class BasicAuthenticationMiddleware
{private readonly RequestDelegate _next;private readonly ILogger _logger;public BasicAuthenticationMiddleware(RequestDelegate next, ILoggerFactory LoggerFactory){_next next;_logger LoggerFactory.CreateLoggerBasicAuthenticationMiddleware();}public async Task Invoke(HttpContext httpContext, IAuthenticationService authenticationService){var authenticated await authenticationService.AuthenticateAsync(httpContext, BasicAuthenticationScheme.DefaultScheme);_logger.LogInformation(Access Status authenticated.Succeeded);if (!authenticated.Succeeded){await authenticationService.ChallengeAsync(httpContext, BasicAuthenticationScheme.DefaultScheme, new AuthenticationProperties { });return;}await _next(httpContext);}
}③ ASP.NET Core 添加BA Scheme , 为待认证资源路径启用BA中间件注意这里使用UseWhen插入中间件。services.AddAuthentication(BasicAuthenticationScheme.DefaultScheme).AddSchemeBasicAuthenticationOption, BasicAuthenticationHandler(BasicAuthenticationScheme.DefaultScheme,null);
app.UseWhen(predicate:x x.Request.Path.StartsWithSegments(new PathString(_protectedResourceOption.Path)),configuration:appBuilder { appBuilder.UseBasicAuthentication()});
现可在浏览器测试进一步思考以上是浏览器在BA协议中的行为可尝试程序自动向服务端发起BA请求需要的同学看博客园源码。Thats All . BA认证是常见的基础认证协议文章期待以清晰的方式传递协议原理和编程实现要的同学阅读原文。往期精选ASP.NET Core跨平台技术内幕AspNetCore结合Redis实践消息队列实例解读Docker Swarm 基于docker-compose的Gitlab CI/CD实践排坑指南
