C#: Swagger/Swashbuckle - 使用“AND”连接安全方案答案

【问题标题】：C#: Swagger/Swashbuckle - Connect security schemes with "AND"C#: Swagger/Swashbuckle - 使用“AND”连接安全方案
【发布时间】：2020-03-23 06:38:30
【问题描述】：

我有一个 ASP.NET Core Api，它需要为一个操作使用多个身份验证方案。我正在尝试通过在 Swagger UI 中显示所有必需的身份验证方案来记录这些操作。因此，我使用 Swashbuckle.AspNetCore (5.1.0) 库将OpenApiSecurityRequirement 动态添加到OpenApiOperation 中的IOperationFilter：

if (authorizeAttributes.Any(x => x.AuthenticationSchemes.Contains(InternalControllerBasicAuthentication.AuthenticationScheme)))
{
       requirements.Add(new OpenApiSecurityRequirement
       {
             {
                   new OpenApiSecurityScheme {
                        Reference = new OpenApiReference {
                            Type = ReferenceType.SecurityScheme,
                            Id = "credentials"
                        }
                   },
                   new [] { "Basic <credentials-value>" }
             }
      });
} 

if (authorizeAttributes.Any(x => x.AuthenticationSchemes.Contains(OneTimePasswordAuthentication.AuthenticationScheme)))
{
      requirements.Add(new OpenApiSecurityRequirement
      {
             {
                   new OpenApiSecurityScheme {
                        Reference = new OpenApiReference {
                            Type = ReferenceType.SecurityScheme,
                            Id = "one-time-password"
                        }
                   },
                   new [] { "Basic <one-time-password-value>" }
             }
      });
}

operation.Security = new List<OpenApiSecurityRequirement>(requirements);

此外，我使用SwaggerGenOptions 注册所有可能的方案：

var oneTimePasswordScheme = new OpenApiSecurityScheme
{
    Name = "one-time-password",
    In = ParameterLocation.Header,
    Scheme = "one-time-password",
    Type = SecuritySchemeType.ApiKey
};

options.AddSecurityDefinition("one-time-password", oneTimePasswordScheme);

var credentialsScheme = new OpenApiSecurityScheme
{
    Name = "credentials",
    In = ParameterLocation.Header,
    Scheme = "credentials",
    Type = SecuritySchemeType.ApiKey
};

options.AddSecurityDefinition("credentials", credentialsScheme);

除了在 UI 中使用 OR 连接器的 Swagger 外，一切正常：

有没有办法使用AND 连接器配置 Swagger？

任何帮助将不胜感激！

【问题讨论】：

标签： c# asp.net-core swagger-ui swashbuckle.aspnetcore

【解决方案1】：

不是为每个OpenApiSecurityScheme 添加一个OpenApiSecurityRequirement，而是需要将所有OpenApiSecurityScheme 对象放入一个OpenApiSecurityRequirement。

将安全要求与OR联系起来：

var requirements = new List<OpenApiSecurityRequirement>();
requirements.Add(new OpenApiSecurityRequirement
{
    {
        new OpenApiSecurityScheme {
            Reference = new OpenApiReference {
                Type = ReferenceType.SecurityScheme,
                Id = "scheme-1"
            }
        },
        new [] { "scheme-1-value" }
    }
});

requirements.Add(new OpenApiSecurityRequirement
{
    {
        new OpenApiSecurityScheme {
            Reference = new OpenApiReference {
                Type = ReferenceType.SecurityScheme,
                Id = "scheme-2"
            }
        },
        new [] { "scheme-2-value" }
    }
});

operation.Security = new List<OpenApiSecurityRequirement>(requirements);

用AND连接安全要求：

var requirement = new OpenApiSecurityRequirement();
requirement.Add(new OpenApiSecurityScheme {
        Reference = new OpenApiReference {
            Type = ReferenceType.SecurityScheme,
            Id = "scheme-1"
        }
    },
    new [] { "scheme-1-value" }
);

requirement.Add(new OpenApiSecurityScheme {
        Reference = new OpenApiReference {
            Type = ReferenceType.SecurityScheme,
            Id = "scheme-2"
        }
    },
    new [] { "scheme-2-value" }
);

operation.Security = new List<OpenApiSecurityRequirement> { requirement };

【讨论】：