Asp.net core Protect 外部 wwwroot 文件夹

Question

我正在创建一个 asp.net 核心应用程序并使用 .Net5。我正在 www-root 文件夹之外上传文件。这是我的目录配置。

 app.UseFileServer(new FileServerOptions
            {
                FileProvider = new PhysicalFileProvider(@$"{Configuration["AppConfiguration:PhysicalDirectoryBasePath"]}"),
                RequestPath = new PathString("/app-data"),
                EnableDirectoryBrowsing = false
            });

我想保护该文件夹，以便没有公共用户可以访问它。我想在访问文件之前检查标题

header contains app-token then allow file to access otherwise not

我无法停止公共用户的文件访问。如何做到这一点？

Answer 1

您可以为此使用middleware。即Map 允许为路径执行所需的中间件

app.Map("/app-data", appBuilder =>
{
    appBuilder.UseFilter();

    appBuilder.UseFileServer(new FileServerOptions
    {
        FileProvider = new PhysicalFileProvider($@"{Configuration["AppConfiguration:PhysicalDirectoryBasePath"]}"),
        RequestPath = new PathString(""), //empty, because root path is in Map now
        EnableDirectoryBrowsing = false
    });
}

过滤中间件

public class FilterMiddleware
{
    private readonly RequestDelegate _next;

    public FilterMiddleware(RequestDelegate next)
    {
        _next = next;
    }

    public async Task InvokeAsync(HttpContext httpContext)
    {
        if (httpContext.Request.Headers["API-KEY"] == "secret key")
        {
            //proceed serving files
            await _next(httpContext);
        }
        else
        {
            //return you custom response
            await httpContext.Response.WriteAsync("Forbidden");
        }
    }
}

扩展类允许调用UseFilter

public static class FilterMiddlewareExtensions
{
    public static IApplicationBuilder UseFilter(this IApplicationBuilder applicationBuilder)
    {
        return applicationBuilder.UseMiddleware<FilterMiddleware>();
    }
}