忽略开发环境的授权答案

【问题标题】：Ignore authorization at development environment忽略开发环境的授权
【发布时间】：2020-05-28 03:27:12
【问题描述】：

我最近从 ASP .NET Core 2.2 迁移到 3.1，一切正常，但我遇到了忽略开发环境授权的问题。

我在 CORE 2.2 中使用的代码：

if (env.IsDevelopment())
{
    //On Development - ignore authorization
    services.AddMvc(opts => { opts.Filters.Add(new AllowAnonymousFilter()); })
       .SetCompatibilityVersion(CompatibilityVersion.Version_2_2);
}
else 
{
    services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_2);
}

这显然不适用于 CORE 3.1，但我找不到任何有效的等效代码。

除此之外，我尝试使用这段代码（如下）没有结果。

 services.AddControllers(opts =>
 {
     if (env.IsDevelopment())
     {
         opts.Filters.Add(new AllowAnonymousFilter());
     }
     else
     {
     }
 });

请帮帮我。

我的相关代码（CORE 3.1）：

public void InstallServices(IServiceCollection services, IConfiguration configuration, IWebHostEnvironment env, ILogger logger)
{
    services.AddControllers(opts =>
    {
        if (env.IsDevelopment())
        {
            opts.Filters.Add(new AllowAnonymousFilter());
        }
        else
        {
        }
    });

    services.AddAutoMapper(typeof(Startup));
    var jwtSettings = new JwtSettings();
    configuration.Bind(nameof(JwtSettings), jwtSettings);
    services.AddSingleton(jwtSettings);
    var tokenValidationParameters = new TokenValidationParameters
    {
        ValidateIssuer = false,
        ValidateAudience = false,
        ValidateIssuerSigningKey = true,
        IssuerSigningKey = jwtSettings.PrivateSigningSecretKey,
        ValidateLifetime = true,
        ClockSkew = TimeSpan.Zero
    };
    services.AddSingleton(tokenValidationParameters);

    services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
        .AddJwtBearer(options =>
        {
            options.SaveToken = true;
            options.TokenValidationParameters = tokenValidationParameters;
        });
    services.AddAuthorization(options =>
    {
        options.AddPolicy(Authorizations.RequireAdminOrManagerRole,
            policy => policy.RequireRole(Authorizations.Admin, Authorizations.Manager));
    });
    //deleted Swagger setup
}
public void InstallConfiguration(IApplicationBuilder app, IWebHostEnvironment env, IConfiguration configuration, ILogger logger)
{
    //deleted Swagger setup
    app.UseHttpsRedirection(); 
    app.UseMiddleware(typeof(ErrorHandlingMiddleware));
    app.UseRouting();
    app.UseAuthentication();
    app.UseAuthorization();
    app.UseEndpoints(endpoints => { endpoints.MapControllers(); });
}

【问题讨论】：

标签： asp.net asp.net-core asp.net-core-webapi asp.net-core-3.0 asp.net-core-3.1

【解决方案1】：

我找到了适合我的东西。如果您有更好的解决方案，请告诉我

我的配置：

app.UseHttpsRedirection(); 
app.UseMiddleware(typeof(ErrorHandlingMiddleware));
app.UseRouting();
if (env.IsStaging() || env.IsDevelopment())
{
    //on staging/development dont require authentication
    app.Use(async (context, next) =>
    {
        // Set claims for the test user.
        var claims = new[] { new Claim("role", "Admin"), new Claim("sub", "some guid") };
        var id = new ClaimsIdentity(claims, "DebugAuthorizationMiddleware", "name", "role");
        // Add the test user as Identity.
        context.User.AddIdentity(id);
        // User is now authenticated.
        await next.Invoke();
    });
}
else
    app.UseAuthentication();
app.UseAuthorization();
app.UseEndpoints(endpoints => { endpoints.MapControllers(); });

信用： Programmatically add [AllowAnonymous] attribute to all my controller methods

【讨论】：