.Net Core Web API 基本身份验证授权在 Azure 上不起作用

Question

我在 .net core 3.0 following this tutorial by Jason Watmore 中为 Web API 编写了自定义身份验证处理程序。 Authorize 属性非常适合 IIS Express。但是，当我将代码发布到 Azure Web App 时，授权属性不会触发。没有身份验证质询，数据未经身份验证就返回。

Azure 身份验证授权设置

这里是自定义的 BasicAuthenticationHandler

public class BasicAuthenticationHandler : AuthenticationHandler<AuthenticationSchemeOptions>
    {
        private readonly IAPIRepo _apiRepo;

        public BasicAuthenticationHandler(IOptionsMonitor<AuthenticationSchemeOptions> options,
                                            ILoggerFactory logger, UrlEncoder encoder, 
                                             ISystemClock clock,
                                              IAPIRepo apiRepo): base(options, logger, encoder, clock)
        {
            _apiRepo = apiRepo;
        }
        protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
        {
            //throw new NotImplementedException();
            if (!Request.Headers.ContainsKey("Authorization"))
                return AuthenticateResult.Fail("Missing Authorization Header");
            User user = null;
            try
            {
                var authHeader = AuthenticationHeaderValue.Parse(Request.Headers["Authorization"]);
                var credentialBytes = Convert.FromBase64String(authHeader.Parameter);
                var credentials = Encoding.UTF8.GetString(credentialBytes).Split(new[] { ':' }, 2);
                var username = credentials[0];
                var password = credentials[1];
                user = _apiRepo.Authenticate(username, password);
            }
            catch
            {
                return AuthenticateResult.Fail("Invalid Authorization Header");
            }

            if (user == null)
                return AuthenticateResult.Fail("Invalid Username or Password");

            var claims = new[] {
                new Claim(ClaimTypes.NameIdentifier, user.User_Id.ToString()),
                new Claim(ClaimTypes.Name, user.UserName),
            };
            var identity = new ClaimsIdentity(claims, Scheme.Name);
            var principal = new ClaimsPrincipal(identity);
            var ticket = new AuthenticationTicket(principal, Scheme.Name);

            return AuthenticateResult.Success(ticket);
        }
    }

Startup.cs

  services.AddScoped<IAPIRepo, APIRepo>();

            services.AddAuthentication("BasicAuthentication")
                .AddScheme<AuthenticationSchemeOptions, BasicAuthenticationHandler>("BasicAuthentication", null);

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {

        app.UseRouting();

        app.UseAuthentication();

        app.UseAuthorization();

        app.UseEndpoints(endpoints =>
        {
            endpoints.MapControllers();
        });
    }

编辑：.net core 2.2 和 3.1 之间的区别。将运行时间更改为 3.1 修复了问题

Answer 1

看起来您使用的是 .NET Core 3.0 的 Startup.cs 而不是文章中使用的 3.1。

.Net Core Web API 基本身份验证授权在 Azure 上不起作用

.Net Core Web API Basic Authentication Authorize does not work on Azure

azure

authorize

azure-web-app-service

asp.net-core-webapi