ASP Net Core 2.2 仅向需要授权的方法添加储物柜图标 - Swagger UI答案

【问题标题】：ASP Net Core 2.2 add locker icon only to methods that require authorization - Swagger UIASP Net Core 2.2 仅向需要授权的方法添加储物柜图标 - Swagger UI
【发布时间】：2021-07-02 19:39:45
【问题描述】：

版本：

ASP Net Core Web API - 2.2
Swashbuckle.AspNetCore - 4.0.1

我目前拥有什么？

我已经在我的 Web API 项目中实现了 swagger。我在需要它的方法上使用带有[Authorize] 属性的JWT 授权。

所以我想要一种简单的方法来发送需要授权的请求。在我的ConfigureServices 类中，我添加了以下逻辑。

services.AddSwaggerGen(c =>
{

    // Other swagger options

    c.AddSecurityDefinition("Bearer", new ApiKeyScheme
    {
        In = "header",
        Description = "Please enter into field the word 'Bearer' following by space and your JWT token",
        Name = "Authorization",
        Type = "apiKey"
    });
    c.AddSecurityRequirement(new Dictionary<string, IEnumerable<string>>
    {
        { "Bearer", Enumerable.Empty<string>() },
    });

    // Other swagger options
});

它的作用如下：
它在 swagger 中添加了一个新按钮 - 授权。

问题是，它还在每个方法旁边添加了一个“打开”储物柜图标。不过，其中一些需要授权。

当我使用授权按钮成功授权时（它基本上为每个请求添加标题授权），我收到一个“关闭”的储物柜。

我知道这可能是指示授权令牌将通过请求发送的所需功能。我想要一种方法来显示哪些方法需要授权，哪些不需要。

我想要什么？

例如，匿名方法的“开放”储物柜和具有[Authorize] 属性的方法的“关闭”储物柜。

它可以是一个附加图标，在这个旁边或修改这个的行为，没问题。我怎样才能做到这一点？

可能的解决方案？

我相信一个可能的解决方案是创建一个 OperationFilter 并遍历所有方法并将“某物”仅附加到具有[Authorize] 属性的那些上。这是最好的解决方案吗？如果是这样，您将如何实施？

【问题讨论】：

另见：stackoverflow.com/a/68149047/5298150

标签： c# asp.net-core authorization swagger swashbuckle

【解决方案1】：

自从我问这个问题以来已经过去了一个多月。这是我的做法。

我从Startup.cs中删除了以下代码：

c.AddSecurityDefinition("Bearer", new ApiKeyScheme
{
    In = "header",
    Description = "Please enter into field the word 'Bearer' following by space and your JWT token",
    Name = "Authorization",
    Type = "apiKey"
});
c.AddSecurityRequirement(new Dictionary<string, IEnumerable<string>>
{
    { "Bearer", Enumerable.Empty<string>() },
});

我添加了以下一个：

c.OperationFilter<AddAuthHeaderOperationFilter>();

当然还有AddAuthHeaderOperationFilter.cs：

    public class AddAuthHeaderOperationFilter : IOperationFilter
    {
        private readonly IHttpContextAccessor httpContextAccessor;

        public AddAuthHeaderOperationFilter(IHttpContextAccessor httpContextAccessor)
        {
            this.httpContextAccessor = httpContextAccessor;
        }

        public void Apply(Operation operation, OperationFilterContext context)
        {
            var filterDescriptor = context.ApiDescription.ActionDescriptor.FilterDescriptors;
            var isAuthorized = filterDescriptor.Select(filterInfo => filterInfo.Filter).Any(filter => filter is AuthorizeFilter);
            var allowAnonymous = filterDescriptor.Select(filterInfo => filterInfo.Filter).Any(filter => filter is IAllowAnonymousFilter);

            if (isAuthorized && !allowAnonymous)
            {
                if (operation.Parameters == null)
                    operation.Parameters = new List<IParameter>();

                operation.Parameters.Add(new NonBodyParameter
                {
                    Name = "Authorization",
                    In = "header",
                    Description = "JWT access token",
                    Required = true,
                    Type = "string",
                    //Default = $"Bearer {token}"
                });

                operation.Responses.Add("401", new Response { Description = "Unauthorized" });
                operation.Responses.Add("403", new Response { Description = "Forbidden" });

                operation.Security = new List<IDictionary<string, IEnumerable<string>>>();

                //Add JWT bearer type
                operation.Security.Add(new Dictionary<string, IEnumerable<string>>
                {
                    { "Bearer", new string[] { } }
                });
            }
        }
    }

简而言之，这个 OperationFilter 类仅将储物柜图标添加到需要授权的方法中。储物柜总是打开的。所以不是完美的解决方案，但现在还可以。

这是它的外观：

注意：所以如果你想测试 API，你首先要获得一个令牌，然后在需要的地方填充它。

【讨论】：

您好，您可以提供 AddAuthHeaderOperationFilter.cs 所需的using 吗？
using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Mvc.Authorization; using Swashbuckle.AspNetCore.Swagger; using Swashbuckle.AspNetCore.SwaggerGen; using System; using System.Collections.Generic; using System.Linq; using System.Threading.Tasks;
我根据使用属性而不是过滤器更改了一些行 var customAttrs = context.ApiDescription.CustomAttributes(); var isAuthorized = customAttrs.Any(attr => attr is IAuthorizeData); var allowAnonymous = customAttrs.Any(attr => attr is IAllowAnonymous);

【解决方案2】：

对于 Swashbuckle 5.0.0 及更高版本的 AddAuthHeaderOperationFilter 来自@G.Dimov 的答案更改为以下（带有一些额外的样式编辑）：

public class AddAuthHeaderOperationFilter : IOperationFilter
{
    private readonly IHttpContextAccessor httpContextAccessor;

    public AddAuthHeaderOperationFilter(IHttpContextAccessor httpContextAccessor)
    {
        this.httpContextAccessor = httpContextAccessor;
    }

    public void Apply(Operation operation, OperationFilterContext context)
    {
        var filterDescriptor = context.ApiDescription.ActionDescriptor.FilterDescriptors;
        var isAuthorized = filterDescriptor.Select(filterInfo => filterInfo.Filter).Any(filter => filter is AuthorizeFilter);
        var allowAnonymous = filterDescriptor.Select(filterInfo => filterInfo.Filter).Any(filter => filter is IAllowAnonymousFilter);

        if (isAuthorized && !allowAnonymous)
        {
            if (operation.Parameters == null)
                operation.Parameters = new List<IParameter>();

            operation.Parameters.Add(new NonBodyParameter
            {
                Name = "Authorization",
                In = "header",
                Description = "JWT access token",
                Required = true,
                Type = "string"
            });

            operation.Responses.Add("401", new Response { Description = "Unauthorized" });
            operation.Responses.Add("403", new Response { Description = "Forbidden" });

            operation.Security = new List<IDictionary<string, IEnumerable<string>>>();

            //Add JWT bearer type
            operation.Security.Add(new Dictionary<string, IEnumerable<string>>
            {
                { "Bearer", new string[] { } }
            });
        }
    }
}

编辑

如果将 Authorization 标头定义为参数，则 Swagger UI 拒绝发送它。所以可能更好的选择是在 SwaggerGen 服务配置中创建一个安全定义（通常在 Startup.ConfigureServices 中）：

public void ConfigureServices(IServiceCollection services)
{
    // Service configuration
    services.AddSwaggerGen(c =>
    {
        // Configure Swagger
        // "Bearer" is the name for this definition. Any other name could be used
        c.AddSecurityDefinition("Bearer", new OpenApiSecurityScheme
            {
                Description = "Use bearer token to authorize",
                Type = SecuritySchemeType.Http,
                Scheme = "bearer",
                BearerFormat = "JWT"
            });
    }
}

然后在操作中添加一个引用定义的安全要求：

public class AddAuthorizationHeaderOperationHeader : IOperationFilter
{
    public void Apply(OpenApiOperation operation, OperationFilterContext context)
    {
        var actionMetadata = context.ApiDescription.ActionDescriptor.EndpointMetadata;
        var isAuthorized = actionMetadata.Any(metadataItem => metadataItem is AuthorizeAttribute);
        var allowAnonymous = actionMetadata.Any(metadataItem => metadataItem is AllowAnonymousAttribute);

        if (!isAuthorized || allowAnonymous)
        {
            return;
        }
        if (operation.Parameters == null)
            operation.Parameters = new List<OpenApiParameter>();

        operation.Security = new List<OpenApiSecurityRequirement>();

        //Add JWT bearer type
        operation.Security.Add(new OpenApiSecurityRequirement
            {
                {
                    new OpenApiSecurityScheme
                    {                            
                        Reference = new OpenApiReference
                        {                               
                            Type = ReferenceType.SecurityScheme,
                            // Definition name. 
                            // Should exactly match the one given in the service configuration
                            Id = "Bearer"
                        }
                    }, new string[0]
                }
            }
        );
    }
}

【讨论】：

不错，很高兴它有帮助。
我会说版本 5 的最佳解决方案！ ?

【解决方案3】：

请按照以下步骤使用正确的挂锁实现 Swagger-

步骤-1

添加一个类并用IOperationFilter接口继承这个类。之后，实现IOperationFilter接口的Apply方法定义。

要实现Apply 方法，您需要OpenApiOperation 和OpenApiOperation 类型的两个参数。

public class AddSwaggerService : IOperationFilter
    {     

        public void Apply(OpenApiOperation operation, OperationFilterContext context)
        {
            var actionMetadata = context.ApiDescription.ActionDescriptor.EndpointMetadata;
            var isAuthorized = actionMetadata.Any(metadataItem => metadataItem is AuthorizeAttribute);
            var allowAnonymous = actionMetadata.Any(metadataItem => metadataItem is AllowAnonymousAttribute);

            if (!isAuthorized || allowAnonymous)
            {
                return;
            }
            if (operation.Parameters == null)
                operation.Parameters = new List<OpenApiParameter>();

            operation.Security = new List<OpenApiSecurityRequirement>();

            
            var security = new OpenApiSecurityRequirement
            {
                {
                    new OpenApiSecurityScheme
                    {
                        Reference = new OpenApiReference
                        {
                            Type = ReferenceType.SecurityScheme,                            
                            Id = "Bearer"
                        }
                    }, new List<string>()
                }
            };
            //add security in here
            operation.Security.Add(security);
        }

步骤 - 2

在Startup.cs 中的ConfigureServices 方法中添加swagger Generation Service。在此服务中，您需要添加我们在步骤 1 中实施的以下行。

c.OperationFilter<AddSwaggerService>();

 public void ConfigureServices(IServiceCollection services)
        {

//.........other Services.........
//.........other Services.........
//.........other Services.........

services.AddSwaggerGen(c =>
                c.SwaggerDoc(AppConstantKeys.APIName, new OpenApiInfo { Title = "title", Version = "APIVersion" });

                c.OperationFilter<AddSwaggerService>();
                c.AddSecurityDefinition("Bearer", new OpenApiSecurityScheme
                {
                    Description ="SwaggerShortDescription",
                    Name = "HeaderName",
                    In = ParameterLocation.Header,
                    Type = SecuritySchemeType.ApiKey,

                });
            });

//.........other Services.........
//.........other Services.........
//.........other Services.........

}

第三步 在中间件管道中添加 swagger。

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
//.........other middlewares.........
//.........other middlewares.........
//.........other middlewares.........
//.........other middlewares.........


            app.UseSwagger();
            app.UseSwaggerUI(c =>
            {
                c.SwaggerEndpoint("/swagger/v1/swagger.json", "SwaggerUIName");
                c.DocumentTitle = "SwaggerUITitle";
                c.DocExpansion(DocExpansion.None);
                c.RoutePrefix = string.Empty;
            });

//.........other middlewares.........
//.........other middlewares.........
//.........other middlewares.........
//.........other middlewares.........


}

第 4 步

构建并运行。

【讨论】：