Warm tip: This article is reproduced from serverfault.com, please click

c#-如何在特定区域允许授权方案

(c# - How to allow authorization scheme in specfic areas)

发布于 2020-12-09 10:15:07

我默认使用cookie身份验证方案。我有一个特定的区域,我想允许其他身份验证方案,否则,所有现有策略都应保持不变。

我想将AuthoriztionFilter添加到IPageHandlerModelConvention / IControllerModelConvention:

public class AreaFiltersConvention : IPageHandlerModelConvention
{
    public string[] Areas { get; set; }


    public void Apply(PageHandlerModel model)
    {
        if (this.Areas.Contains(model.Page.AreaName))
        {
            model.Page.Filters.Add(new AuthorizeFilter("AllowBasicAuthPolicy"));
        }
    }

我有两个问题:

  1. PageHandlerModel.Page 为null,因此无法添加AuthorizeFilter。

  2. 据我所知,我只能将其用于特定政策。我在OR条件下苦苦挣扎。

     services.AddAuthorization(options =>
     {
          options.AddPolicy("AllowBasicAuthPolicy", policy =>
          {
               policy.AddAuthenticationSchemes("Basic"); // this breaks existing policies
               policy.RequireAuthenticatedUser();
          });
     });
    
Questioner
Liero
Viewed
11
Rena 2020-12-10 16:40:07

你可以AuthorizeAreaPage在剃刀页面中使用内置约定,如下所示:

services.AddRazorPages(options =>
{
    options.Conventions.AuthorizeAreaPage("AreaName", "/PageName", "AllowBasicAuthPolicy");
});

参考:

https://docs.microsoft.com/zh-cn/aspnet/core/security/authorization/razor-pages-authorization?view=aspnetcore-5.0#require-authorization-to-access-an-area-page