使用Web API令牌的SignalR授权

问题描述

我正尝试根据此处的示例项目 AngularJS身份验证，完全根据该示例项目授权SignalR请求 AngularJS使用网络令牌进行身份验证.我遇到的问题是，要使用SignalR授权，必须重写SignalR AuthorizeAttribute类，如下所示:

I am attempting to authorize SignalR requests exactly using the sample project here AngularJS Authentication based on this project AngularJS Authentication using web tokens. The problem I am having is, to use SignalR authorization, I had to override the SignalR AuthorizeAttribute class as below:

public class QueryStringBearerAuthorizeAttribute : AuthorizeAttribute
{
    public override bool AuthorizeHubConnection(HubDescriptor hubDescriptor, IRequest request)
    {
        var token = request.QueryString.Get("Bearer");
        var authenticationTicket = Startup.AuthServerOptions.AccessTokenFormat.Unprotect(token);

        if (authenticationTicket == null || authenticationTicket.Identity == null || !authenticationTicket.Identity.IsAuthenticated)
        {
            return false;
        }

        request.Environment["server.User"] = new ClaimsPrincipal(authenticationTicket.Identity);
        request.Environment["server.Username"] = authenticationTicket.Identity.Name;
        request.GetHttpContext().User = new ClaimsPrincipal(authenticationTicket.Identity);
        return true;
    }

    public override bool AuthorizeHubMethodInvocation(IHubIncomingInvokerContext hubIncomingInvokerContext, bool appliesToMethod)
    {
        var connectionId = hubIncomingInvokerContext.Hub.Context.ConnectionId;
        var environment = hubIncomingInvokerContext.Hub.Context.Request.Environment;
        var principal = environment["server.User"] as ClaimsPrincipal;

        if (principal != null && principal.Identity != null && principal.Identity.IsAuthenticated)
        {
            hubIncomingInvokerContext.Hub.Context = new HubCallerContext(new ServerRequest(environment), connectionId);

            return true;
        }

        return false;
    }
}

现在我的中心如下:

[QueryStringBearerAuthorize]
[HubName("realtime")]
public class WislerAppHub : Hub
{
    public string GetServerTime()
    {
        return DateTime.UtcNow.ToString();
    }
}

这个想法是，当一个信号连接请求到达这个类时，AuthorizeHubConnection应该触发并授权它.但是，永远不会调用此方法.第二种方法AuthorizeHubMethodInvocation被调用.

The idea is, when a signalr connection request hits this class, the AuthorizeHubConnection should fire and authorize it. However this method is never called. The second method, AuthorizeHubMethodInvocationis called though.

我做错了什么?为什么此覆盖无效?顺便说一句，我试图这样继承:QueryStringBearerAuthorizeAttribute : Attribute, IAuthorizeHubConnection, IAuthorizeHubMethodInvocation具有相同的结果.

What am I doing wrong? Why isn't this override working? BTW I tried inheriting thus: QueryStringBearerAuthorizeAttribute : Attribute, IAuthorizeHubConnection, IAuthorizeHubMethodInvocation with the same result.

谢谢.

推荐答案

好的，我知道了.对于那些遇到类似问题的人，上面的代码很好用，没有问题.无需在服务器端添加任何内容(即此代码)

Okay I got it working. For those reaching here on similar issues, the code above works well there is no issue with it. Nothing needs to be added on the server side (ie to this code)

问题出在信令端初始化和从客户端调用.我以某种方式认为，如果信号器没有先击中属性，就无法击中集线器.显然有！我刚刚更改了我的angularjs代码，即可使用.

The problem was with the signalr initialization and call from the client side. Somehow I assumed there was no way signalr could hit the hub without hitting the attribute first. Obviously there is! I just changed my angularjs code and it works.

这篇关于使用Web API令牌的SignalR授权的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！