如何自定义OpenIddict产生的授权错误？

Question

我在 .NET Core 2 API 中使用 OpenIddict 进行身份验证。客户端我依赖任何 API 错误来遵循自定义方案。然而，当例如刷新令牌已过时，我似乎无法找到如何自定义发回的错误。

从未到达 /token 端点，因此错误不在 "my control" 下。

请求的结果是一个状态码400，具有以下JSON：

{"error":"invalid_grant","error_description":"The specified refresh token is no longer valid."}

我尝试使用自定义中间件来捕获所有状态代码（它确实如此），但在我的自定义中间件执行完成之前返回了结果。

如何正确自定义错误或拦截来更改它？谢谢！

Answer 1

The /token endpoint is never reached, so the error is not under "my control".

实际上达到了/token，grant_type的参数等于refresh_token。 但是refresh token过期时的拒绝逻辑我们没有处理。 源代码中的某种"hardcoded":

if (token == null)
{
    context.Reject(
        error: OpenIddictConstants.Errors.InvalidGrant,
        description: context.Request.IsAuthorizationCodeGrantType() ?
            "The specified authorization code is no longer valid." :
            "The specified refresh token is no longer valid.");

    return;
}

if (options.UseRollingTokens || context.Request.IsAuthorizationCodeGrantType())
{
    if (!await TryRedeemTokenAsync(token))
    {
        context.Reject(
            error: OpenIddictConstants.Errors.InvalidGrant,
            description: context.Request.IsAuthorizationCodeGrantType() ?
                "The specified authorization code is no longer valid." :
                "The specified refresh token is no longer valid.");

        return;
    }
}

这里的context.Reject来自汇编AspNet.Security.OpenIdConnect.Server.

有关详细信息，请参阅 source code on GitHub。

I've tried to use a custom middleware to catch all status codes (which it does), but the result is returned before the execution of my custom middleware has completed.

我试过了，我很确定我们可以使用自定义中间件来捕获所有状态码。关键是检测[=之后的状态码17=] 调用：

app.Use(async(context , next )=>{

    // passby all other end points
    if(! context.Request.Path.StartsWithSegments("/connect/token")){
        await next();
        return;
    }

    // since we might want to detect the Response.Body, I add some stream here .
    // if you only want to detect the status code , there's no need to use these streams
    Stream originalStream = context.Response.Body;
    var hijackedStream = new MemoryStream();
    context.Response.Body = hijackedStream;
    hijackedStream.Seek(0,SeekOrigin.Begin);

    await next();

    // if status code not 400 , pass by
    if(context.Response.StatusCode != 400){
        await CopyStreamToResponseBody(context,hijackedStream,originalStream);
        return;
    }

    // read and custom the stream 
    hijackedStream.Seek(0,SeekOrigin.Begin);
    using (StreamReader sr = new StreamReader(hijackedStream))
    {
        var raw= sr.ReadToEnd();
        if(raw.Contains("The specified refresh token is no longer valid.")){
            // custom your own response
            context.Response.StatusCode = 401;
            // ...
            //context.Response.Body = ... /
        }else{
            await CopyStreamToResponseBody(context,hijackedStream,originalStream);
        }
    }
});

// helper to make the copy easy
private async Task CopyStreamToResponseBody(HttpContext context,Stream newStream, Stream originalStream){

    newStream.Seek(0,SeekOrigin.Begin);
    await newStream.CopyToAsync(originalStream);
    context.Response.ContentLength =originalStream.Length;
    context.Response.Body = originalStream;
}

Answer 2

您可以使用 OpenIddict 的事件模型在将令牌响应负载写入响应流之前自定义它们。这是一个例子：

MyApplyTokenResponseHandler.cs

public class MyApplyTokenResponseHandler : IOpenIddictServerEventHandler<ApplyTokenResponseContext>
{
    public ValueTask HandleAsync(ApplyTokenResponseContext context)
    {
        var response = context.Response;
        if (string.Equals(response.Error, OpenIddictConstants.Errors.InvalidGrant, StringComparison.Ordinal) &&
           !string.IsNullOrEmpty(response.ErrorDescription))
        {
            response.ErrorDescription = "Your customized error";
        }

        return default;
    }
}

Startup.cs

services.AddOpenIddict()
    .AddCore(options =>
    {
        // ...
    })

    .AddServer(options =>
    {
        // ...
        options.AddEventHandler<ApplyTokenResponseContext>(builder =>
            builder.UseSingletonHandler<MyApplyTokenResponseHandler>());
    })

    .AddValidation();

如何自定义OpenIddict产生的授权错误？

How to customize the authorization error produced by OpenIddict?

asp.net-core

openiddict

MyApplyTokenResponseHandler.cs

Startup.cs