缺少令牌时从 OpenIdDict 验证更改响应代码答案

【问题标题】：Change response code from OpenIdDict validation when token is missing缺少令牌时从 OpenIdDict 验证更改响应代码
【发布时间】：2020-06-20 22:26:07
【问题描述】：

我有使用 OpenIddict 3.0 的不记名令牌身份验证。当客户端访问缺少令牌的授权控制器时，我希望它返回错误代码 401 Unauthorized not 400 Bad Request。

这是错误消息的来源，但 http 状态代码来自哪里，我将如何覆盖它？

OpenIddictValidationHandlers.cs

public ValueTask HandleAsync([NotNull] ProcessAuthenticationContext context)
{
    if (context == null)
    {
        throw new ArgumentNullException(nameof(context));
    }
    if (string.IsNullOrEmpty(context.Request.AccessToken))
    {
        context.Logger.LogError("The request was rejected because the access token was missing.");
        context.Reject(
            error: Errors.InvalidRequest,
            description: "The access token is missing.");
        return default;
    }
    context.Token = context.Request.AccessToken;
    return default;
}

还有我的 Startup.cs

...
var openId = services.AddOpenIddict()
...
    .AddValidation(config =>
    {
        config.UseLocalServer();
        config.UseAspNetCore();
    });

【问题讨论】：

标签： asp.net-core openiddict

【解决方案1】：

感谢您报告此问题，该问题已在 3.0.0-alpha1.20163.83 版本中得到修复：OpenIddict 现在将对由于缺少访问令牌而被拒绝的请求返回 401 错误。

负责选择适当 HTTP 状态码的事件处理程序在OpenIddict.Validation.AspNetCore：

/// <summary>
/// Contains the logic responsible of attaching an appropriate HTTP status code.
/// Note: this handler is not used when the OpenID Connect request is not initially handled by ASP.NET Core.
/// </summary>
public class AttachHttpResponseCode<TContext> : IOpenIddictValidationHandler<TContext> where TContext : BaseRequestContex
{
    /// <summary>
    /// Gets the default descriptor definition assigned to this handler.
    /// </summary>
    public static OpenIddictValidationHandlerDescriptor Descriptor { get; }
        = OpenIddictValidationHandlerDescriptor.CreateBuilder<TContext>()
            .AddFilter<RequireHttpRequest>()
            .UseSingletonHandler<AttachHttpResponseCode<TContext>>()
            .SetOrder(AttachCacheControlHeader<TContext>.Descriptor.Order - 1_000)
            .Build();

    /// <summary>
    /// Processes the event.
    /// </summary>
    /// <param name="context">The context associated with the event to process.</param>
    /// <returns>
    /// A <see cref="ValueTask"/> that can be used to monitor the asynchronous operation.
    /// </returns>
    public ValueTask HandleAsync([NotNull] TContext context)
    {
        if (context == null)
        {
            throw new ArgumentNullException(nameof(context));
        }

        if (context.Response == null)
        {
            throw new InvalidOperationException("This handler cannot be invoked without a response attached.");
        }

        // This handler only applies to ASP.NET Core requests. If the HTTP context cannot be resolved,
        // this may indicate that the request was incorrectly processed by another server stack.
        var response = context.Transaction.GetHttpRequest()?.HttpContext.Response;
        if (response == null)
        {
            throw new InvalidOperationException("The ASP.NET Core HTTP request cannot be resolved.");
        }

        response.StatusCode = context.Response.Error switch
        {
            null => 200,

            Errors.InvalidToken => 401,
            Errors.MissingToken => 401,

            Errors.InsufficientAccess => 403,
            Errors.InsufficientScope  => 403,

            _ => 400
        };

        return default;
    }
}

【讨论】：