在 ASP.NET Core 中，使用 Swashbuckle.AspNetCore，如何保护对 Swagger UI 的访问，就像使用 [Authorize]-attribute 装饰它一样？
当有人试图访问我的网络应用程序上的/swagger-URL 时，我希望执行（等效于）[Authorize]-attribute，就像通常装饰的控制器/动作一样，这样我的自定义AuthenticationHandler<T> 被执行。
【问题讨论】：
标签： authentication asp.net-core swagger-ui swashbuckle
Swagger 中间件完全独立于 MVC 管道，因此不可能开箱即用。但是，通过一些逆向工程，我找到了一种解决方法。它涉及在自定义控制器中重新实现大部分中间件，因此有点复杂，显然它可能会随着未来的更新而中断。
首先，我们需要停止调用IApplicationBuilder.UseSwagger 和IApplicationBuilder.UseSwaggerUI，以免与我们的控制器冲突。
然后，我们必须通过修改 Startup.cs 来添加这些方法添加的所有内容：
public void ConfigureServices(IServiceCollection services)
{
services.AddSwaggerGen(c =>
{
c.SwaggerDoc("documentName", new Info { Title = "My API", Version = "v1" });
});
// RouteTemplate is no longer used (route will be set via the controller)
services.Configure<SwaggerOptions>(c =>
{
});
// RoutePrefix is no longer used (route will be set via the controller)
services.Configure<SwaggerUIOptions>(c =>
{
// matches our controller route
c.SwaggerEndpoint("/swagger/documentName/swagger.json", "My API V1");
});
}
public void Configure(IApplicationBuilder app)
{
// we need a custom static files provider for the Swagger CSS etc..
const string EmbeddedFileNamespace = "Swashbuckle.AspNetCore.SwaggerUI.node_modules.swagger_ui_dist";
app.UseStaticFiles(new StaticFileOptions
{
RequestPath = "/swagger", // must match the swagger controller name
FileProvider = new EmbeddedFileProvider(typeof(SwaggerUIMiddleware).GetTypeInfo().Assembly, EmbeddedFileNamespace),
});
}
最后要重新实现两件事：swagger.json文件的生成，以及swagger UI的生成。我们使用自定义控制器来做到这一点：
[Authorize]
[Route("[controller]")]
public class SwaggerController : ControllerBase
{
[HttpGet("{documentName}/swagger.json")]
public ActionResult<string> GetSwaggerJson([FromServices] ISwaggerProvider swaggerProvider,
[FromServices] IOptions<SwaggerOptions> swaggerOptions, [FromServices] IOptions<MvcJsonOptions> jsonOptions,
[FromRoute] string documentName)
{
// documentName is the name provided via the AddSwaggerGen(c => { c.SwaggerDoc("documentName") })
var swaggerDoc = swaggerProvider.GetSwagger(documentName);
// One last opportunity to modify the Swagger Document - this time with request context
var options = swaggerOptions.Value;
foreach (var filter in options.PreSerializeFilters)
{
filter(swaggerDoc, HttpContext.Request);
}
var swaggerSerializer = SwaggerSerializerFactory.Create(jsonOptions);
var jsonBuilder = new StringBuilder();
using (var writer = new StringWriter(jsonBuilder))
{
swaggerSerializer.Serialize(writer, swaggerDoc);
return Content(jsonBuilder.ToString(), "application/json");
}
}
[HttpGet]
[HttpGet("index.html")]
public ActionResult<string> GetSwagger([FromServices] ISwaggerProvider swaggerProvider, [FromServices] IOptions<SwaggerUIOptions> swaggerUiOptions)
{
var options = swaggerUiOptions.Value;
var serializer = CreateJsonSerializer();
var indexArguments = new Dictionary<string, string>()
{
{ "%(DocumentTitle)", options.DocumentTitle },
{ "%(HeadContent)", options.HeadContent },
{ "%(ConfigObject)", SerializeToJson(serializer, options.ConfigObject) },
{ "%(OAuthConfigObject)", SerializeToJson(serializer, options.OAuthConfigObject) }
};
using (var stream = options.IndexStream())
{
// Inject arguments before writing to response
var htmlBuilder = new StringBuilder(new StreamReader(stream).ReadToEnd());
foreach (var entry in indexArguments)
{
htmlBuilder.Replace(entry.Key, entry.Value);
}
return Content(htmlBuilder.ToString(), "text/html;charset=utf-8");
}
}
private JsonSerializer CreateJsonSerializer()
{
return JsonSerializer.Create(new JsonSerializerSettings
{
ContractResolver = new CamelCasePropertyNamesContractResolver(),
Converters = new[] { new StringEnumConverter(true) },
NullValueHandling = NullValueHandling.Ignore,
Formatting = Formatting.None,
StringEscapeHandling = StringEscapeHandling.EscapeHtml
});
}
private string SerializeToJson(JsonSerializer jsonSerializer, object obj)
{
var writer = new StringWriter();
jsonSerializer.Serialize(writer, obj);
return writer.ToString();
}
}
【讨论】：
您可以通过一个简单的中间件解决方案来实现这一目标
中间件
public class SwaggerAuthenticationMiddleware : IMiddleware
{
//CHANGE THIS TO SOMETHING STRONGER SO BRUTE FORCE ATTEMPTS CAN BE AVOIDED
private const string UserName = "TestUser1";
private const string Password = "TestPassword1";
public async Task InvokeAsync(HttpContext context, RequestDelegate next)
{
//If we hit the swagger locally (in development) then don't worry about doing auth
if (context.Request.Path.StartsWithSegments("/swagger") && !IsLocalRequest(context))
{
string authHeader = context.Request.Headers["Authorization"];
if (authHeader != null && authHeader.StartsWith("Basic "))
{
// Get the encoded username and password
var encodedUsernamePassword = authHeader.Split(' ', 2, StringSplitOptions.RemoveEmptyEntries)[1]?.Trim();
// Decode from Base64 to string
var decodedUsernamePassword = Encoding.UTF8.GetString(Convert.FromBase64String(encodedUsernamePassword));
// Split username and password
var username = decodedUsernamePassword.Split(':', 2)[0];
var password = decodedUsernamePassword.Split(':', 2)[1];
// Check if login is correct
if (IsAuthorized(username, password))
{
await next.Invoke(context);
return;
}
}
// Return authentication type (causes browser to show login dialog)
context.Response.Headers["WWW-Authenticate"] = "Basic";
// Return unauthorized
context.Response.StatusCode = (int)HttpStatusCode.Unauthorized;
}
else
{
await next.Invoke(context);
}
}
private bool IsAuthorized(string username, string password) => UserName == username && Password == password;
private bool IsLocalRequest(HttpContext context)
{
if(context.Request.Host.Value.StartsWith("localhost:"))
return true;
//Handle running using the Microsoft.AspNetCore.TestHost and the site being run entirely locally in memory without an actual TCP/IP connection
if (context.Connection.RemoteIpAddress == null && context.Connection.LocalIpAddress == null)
return true;
if (context.Connection.RemoteIpAddress != null && context.Connection.RemoteIpAddress.Equals(context.Connection.LocalIpAddress))
return true;
return IPAddress.IsLoopback(context.Connection.RemoteIpAddress);
}
}
在启动时 -> 配置（确保在身份验证和授权后添加招摇的东西）
app.UseAuthentication();
app.UseAuthorization();
//Enable Swagger and SwaggerUI
app.UseMiddleware<SwaggerAuthenticationMiddleware>(); //can turn this into an extension if you ish
app.UseSwagger();
app.UseSwaggerUI(c => c.SwaggerEndpoint("/swagger/v1/swagger.json", "my test api"));
在 Startup -> ConfigureServices 注册中间件
services.AddTransient<SwaggerAuthenticationMiddleware>();
【讨论】：
嗯，我找到了解决问题的简单方法。 您需要执行以下操作：
希望这会有所帮助。
【讨论】：
我能够增强 @Ricky G 的答案以支持 asp.net 核心身份验证机制。
在 SwaggerAuthenticationMiddleware 中，
public async Task InvokeAsync(HttpContext context)
{
//Make sure we are hitting the swagger path, and not doing it locally as it just gets annoying :-)
if (context.Request.Path.StartsWithSegments("/swagger"))
{
if (!context.User.Identity.IsAuthenticated)
{
string authHeader = context.Request.Headers["Authorization"];
if (authHeader != null && authHeader.StartsWith("Basic "))
{
// Get the encoded username and password
var encodedUsernamePassword = authHeader.Split(' ', 2, StringSplitOptions.RemoveEmptyEntries)[1]?.Trim();
// Decode from Base64 to string
var decodedUsernamePassword = Encoding.UTF8.GetString(Convert.FromBase64String(encodedUsernamePassword));
// Split username and password
var username = decodedUsernamePassword.Split(':', 2)[0];
var password = decodedUsernamePassword.Split(':', 2)[1];
var signInManager = _httpContextAccessor.HttpContext.RequestServices.GetService<SignInManager<IdpUser>>();
var result = await signInManager.PasswordSignInAsync(username, password, false, lockoutOnFailure: false);
if (result.Succeeded)
{
await next.Invoke(context);
return;
}
}
// Return authentication type (causes browser to show login dialog)
context.Response.Headers["WWW-Authenticate"] = "Basic";
// Return unauthorized
context.Response.StatusCode = (int)HttpStatusCode.Unauthorized;
}
else
{
await next.Invoke(context);
return;
}
}
else
{
await next.Invoke(context);
}
}
在 Startup.cs 中你必须像下面这样注册 HttpContextAccessor。
services.TryAddSingleton<IHttpContextAccessor, HttpContextAccessor>();
【讨论】：