Customize the behavior of AuthorizationMiddleware
Apps can register an IAuthorizationMiddlewareResultHandler to customize how AuthorizationMiddleware handles authorization results. Apps can use IAuthorizationMiddlewareResultHandler
to:
- Return customized responses.
- Enhance the default challenge or forbid responses.
The following code shows an example implementation of IAuthorizationMiddlewareResultHandler
that returns a custom response for specific authorization failures:
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Authorization.Policy;
public class SampleAuthorizationMiddlewareResultHandler : IAuthorizationMiddlewareResultHandler
{
private readonly AuthorizationMiddlewareResultHandler defaultHandler = new();
public async Task HandleAsync(
RequestDelegate next,
HttpContext context,
AuthorizationPolicy policy,
PolicyAuthorizationResult authorizeResult)
{
// If the authorization was forbidden and the resource had a specific requirement,
// provide a custom 404 response.
if (authorizeResult.Forbidden
&& authorizeResult.AuthorizationFailure!.FailedRequirements
.OfType<Show404Requirement>().Any())
{
// Return a 404 to make it appear as if the resource doesn't exist.
context.Response.StatusCode = StatusCodes.Status404NotFound;
return;
}
// Fall back to the default implementation.
await defaultHandler.HandleAsync(next, context, policy, authorizeResult);
}
}
public class Show404Requirement : IAuthorizationRequirement { }
Register this implementation of IAuthorizationMiddlewareResultHandler
in Program.cs
:
var builder = WebApplication.CreateBuilder(args);
builder.Services.AddSingleton<
IAuthorizationMiddlewareResultHandler, SampleAuthorizationMiddlewareResultHandler>();
var app = builder.Build();
Apps can register an IAuthorizationMiddlewareResultHandler to customize how AuthorizationMiddleware handles authorization results. Apps can use the IAuthorizationMiddlewareResultHandler
to:
- Return customized responses.
- Enhance the default challenge or forbid responses.
The following code shows an example implementation of IAuthorizationMiddlewareResultHandler
that returns a custom response for specific authorization failures:
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Authorization.Policy;
using Microsoft.AspNetCore.Http;
using System.Linq;
using System.Net;
using System.Threading.Tasks;
public class MyAuthorizationMiddlewareResultHandler : IAuthorizationMiddlewareResultHandler
{
private readonly AuthorizationMiddlewareResultHandler
DefaultHandler = new AuthorizationMiddlewareResultHandler();
public async Task HandleAsync(
RequestDelegate requestDelegate,
HttpContext httpContext,
AuthorizationPolicy authorizationPolicy,
PolicyAuthorizationResult policyAuthorizationResult)
{
// if the authorization was forbidden and the resource had specific requirements,
// provide a custom response.
if (Show404ForForbiddenResult(policyAuthorizationResult))
{
// Return a 404 to make it appear as if the resource does not exist.
httpContext.Response.StatusCode = (int)HttpStatusCode.NotFound;
return;
}
// Fallback to the default implementation.
await DefaultHandler.HandleAsync(requestDelegate, httpContext, authorizationPolicy,
policyAuthorizationResult);
}
bool Show404ForForbiddenResult(PolicyAuthorizationResult policyAuthorizationResult)
{
return policyAuthorizationResult.Forbidden &&
policyAuthorizationResult.AuthorizationFailure.FailedRequirements.OfType<
Show404Requirement>().Any();
}
}
public class Show404Requirement : IAuthorizationRequirement { }
Register MyAuthorizationMiddlewareResultHandler
in Startup.ConfigureServices
:
public void ConfigureServices(IServiceCollection services)
{
services.AddRazorPages();
services.AddSingleton<IAuthorizationMiddlewareResultHandler,
MyAuthorizationMiddlewareResultHandler>();
}
ASP.NET Core
Σχόλια
https://aka.ms/ContentUserFeedback.
Σύντομα διαθέσιμα: Καθ' όλη τη διάρκεια του 2024 θα καταργήσουμε σταδιακά τα ζητήματα GitHub ως μηχανισμό ανάδρασης για το περιεχόμενο και θα το αντικαταστήσουμε με ένα νέο σύστημα ανάδρασης. Για περισσότερες πληροφορίες, ανατρέξτε στο θέμα:Υποβολή και προβολή σχολίων για