【ASP.NET Core】使用最熟悉的Session验证方案

public class TestAuthenticationOptions
{
/// <summary>
/// 登录入口路径
/// </summary>
public string LoginPath { get; set; } = "/Home/Login"; /// <summary>
/// 存入Session的键名
/// </summary>
public string SessionKeyName { get; set; } = "uid"; /// <summary>
/// 返回URL参数名
/// </summary>
public string ReturnUrlKey { set; get; } = "return";
}

public class TestAuthenticationHandler : IAuthenticationSignInHandler
{
/// <summary>
/// 验证方案的名称，可以自行按需取名
/// </summary>
public const string TEST_SCHEM_NAME = "some_authen"; /// <summary>
/// 依赖注入获取的选项
/// </summary>
public TestAuthenticationOptions Options { get; private set; } public TestAuthenticationHandler(IOptions<TestAuthenticationOptions> opt)
{
Options = opt.Value;
} public HttpContext HttpContext { get; private set; }
public AuthenticationScheme Scheme { get; private set; } public Task<AuthenticateResult> AuthenticateAsync()
{
// 先要看看验证方案是否与当前方案匹配
if(Scheme.Name != TEST_SCHEM_NAME)
{
return Task.FromResult(AuthenticateResult.Fail("验证方案不匹配"));
}
// 再看Session
if(!HttpContext.Session.Keys.Contains(Options.SessionKeyName))
{
return Task.FromResult(AuthenticateResult.Fail("会话无效"));
}
// 验证通过
string un = HttpContext.Session.GetString(Options.SessionKeyName)??string.Empty;
ClaimsIdentity id = new(TEST_SCHEM_NAME);
id.AddClaim(new(ClaimTypes.Name, un));
ClaimsPrincipal prcp = new(id);
AuthenticationTicket ticket = new(prcp, TEST_SCHEM_NAME);
return Task.FromResult(AuthenticateResult.Success(ticket));
} public Task ChallengeAsync(AuthenticationProperties? properties)
{
// 跳转到登录入口
HttpContext.Response.Redirect($"{Options.LoginPath}?{Options.ReturnUrlKey}={HttpContext.Request.Path}");
return Task.CompletedTask;
} public async Task ForbidAsync(AuthenticationProperties? properties)
{
await HttpContext.ForbidAsync(Scheme.Name);
} public Task InitializeAsync(AuthenticationScheme scheme, HttpContext context)
{
// 获取一些必备对象的引用
HttpContext = context;
Scheme = scheme;
return Task.CompletedTask;
} public Task SignInAsync(ClaimsPrincipal user, AuthenticationProperties? properties)
{
// 获取用户名
string uname = user.Identity?.Name ?? string.Empty;
if(!string.IsNullOrEmpty(uname))
{
HttpContext.Session.SetString(Options.SessionKeyName, uname);
}
return Task.CompletedTask;
} public Task SignOutAsync(AuthenticationProperties? properties)
{
if(HttpContext.Session.Keys.Contains(Options.SessionKeyName))
{
HttpContext.Session.Remove(Options.SessionKeyName);
}
return Task.CompletedTask;
}
}

// 验证通过
string un = HttpContext.Session.GetString(Options.SessionKeyName)??string.Empty;
ClaimsIdentity id = new(TEST_SCHEM_NAME);
id.AddClaim(new(ClaimTypes.Name, un));
ClaimsPrincipal prcp = new(id);
AuthenticationTicket ticket = new(prcp, TEST_SCHEM_NAME);
return Task.FromResult(AuthenticateResult.Success(ticket));

var builder = WebApplication.CreateBuilder(args);
// 启用Session功能
builder.Services.AddSession(o =>
{
// 把时间缩短一些，好测试
o.IdleTimeout = TimeSpan.FromSeconds(5);
});
// 这个用来检查用户名和密码是否正确
builder.Services.AddSingleton<UserChecker>();
// 使用MVC功能
builder.Services.AddControllersWithViews();
// 注册刚刚定义的选项类，可以依赖注入
// 不要忘了，不然出大事
builder.Services.AddOptions<TestAuthenticationOptions>();
// 添加验证功能
builder.Services.AddAuthentication(opt =>
{
// 添加我们自定义的验证方案名
opt.AddScheme<TestAuthenticationHandler>(TestAuthenticationHandler.TEST_SCHEM_NAME, null);
});
// 添加授权功能
builder.Services.AddAuthorization(opt =>
{
// 注册授权策略，名为“demo2”
opt.AddPolicy("demo2", c =>
{
// 与我们前面定义的验证方案绑定
// 授权过程跟随该验证后发生
c.AddAuthenticationSchemes(TestAuthenticationHandler.TEST_SCHEM_NAME);
// 要求存在已登录用户的标识
c.RequireAuthenticatedUser();
});
});
var app = builder.Build();

public class UserChecker
{
private class UserInfo
{
public string Name { get; init; }
public string Password { get; init; }
} // 简单粗暴的用户信息，只为测试而生
static readonly IEnumerable<UserInfo> _Users = new UserInfo[]
{
new(){Name = "lucy", Password="123456"},
new(){Name= "tom", Password="abcd"},
new() {Name="jim", Password="xyz321"}
}; /// <summary>
/// 验证用户名和密码是否有效
/// </summary>
/// <param name="name">用户名</param>
/// <param name="pwd">用户密码</param>
/// <returns></returns>
public bool CheckLogin(string name, string pwd) => _Users.Any(u => u.Name == name.ToLower() && u.Password == pwd);
}

app.UseSession();
app.UseAuthentication();
app.UseAuthorization();
app.MapControllerRoute("main", "{controller=Home}/{action=Index}");

[Authorize("demo2")]
public class AdminController : Controller
{
public IActionResult MainLoad()
{
return View();
}
}

<h2>
这是管理后台
</h2>

public class HomeController : Controller
{
TestAuthenticationOptions _options; public HomeController(IOptions<TestAuthenticationOptions> o)
{
_options = o.Value;
} public IActionResult Index() => View(); public IActionResult Login()
{
// 获取返回的URL
if (!HttpContext.Request.Query.TryGetValue(_options.ReturnUrlKey, out var url))
{
url = string.Empty;
}
// 用模型来传递URL
return View((object)url.ToString());
} public async Task<IActionResult> PostLogin(
string name, //用户名
string pwd, //密码
string _url, //要跳回的URL
[FromServices]UserChecker usrchecker //用来验证用户名和密码
)
{
if(string.IsNullOrEmpty(name)
|| string.IsNullOrEmpty(pwd))
{
return View("Login", _url);
}
// 如果密码不正确
if (!usrchecker.CheckLogin(name, pwd))
return View("Login", _url);
// 准备登入用的材料
// 1、声明
Claim cname = new(ClaimTypes.Name, name);
// 2、标识
ClaimsIdentity id = new(TestAuthenticationHandler.TEST_SCHEM_NAME);
id.AddClaim(cname);
// 3、主体
ClaimsPrincipal principal = new(id);
// 登入
await HttpContext.SignInAsync(TestAuthenticationHandler.TEST_SCHEM_NAME, principal); if(!string.IsNullOrEmpty(_url))
{
// 重定向回到之前的URL
return Redirect(_url);
} return View("Login", _url);
}
}

@inject Microsoft.Extensions.Options.IOptions<DemoApp5.TestAuthenticationOptions> _opt
@model string<form method="post" asp-controller="Home" asp-action="PostLogin">
<p>
用户名：
<input name="name" type="text"/>
</p>
<p>
密 码：
<input name="pwd" type="password"/>
</p>
<button type="submit">确 定</button>
<input type="hidden" name="_url" value="@Model" />
</form>

<input type="hidden" name="_url" value="@Model" />

builder.Services.AddSession(o =>
{
// 把时间缩短一些，好测试
o.IdleTimeout = TimeSpan.FromSeconds(5);
o.Cookie.Name = "dyn_ssi";
});