ASP.NET Core是否有内置属性验证HttpOnlyCookie及角色权限？

ASP.NET Core提供了完整的内置认证授权体系，完全可以替代你自定义的AuthorizeWithCookieAttribute，还原生支持角色认证。以下是具体实现步骤：

1. 配置认证服务 #

在Program.cs中添加JWT认证配置，指定从HttpOnly Cookie中读取令牌：

var builder = WebApplication.CreateBuilder(args);

// 添加JWT认证服务
builder.Services.AddAuthentication(options =>
{
    options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddJwtBearer(options =>
{
    // 配置令牌验证参数，与你自定义逻辑保持一致
    options.TokenValidationParameters = new TokenValidationParameters
    {
        ValidateIssuerSigningKey = true,
        IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("this is my secret key more then 128 bits")),
        ValidateIssuer = false,
        ValidateAudience = false,
        ClockSkew = TimeSpan.Zero
    };

    // 自定义令牌获取逻辑：从Cookie读取authToken
    options.Events = new JwtBearerEvents
    {
        OnMessageReceived = context =>
        {
            context.Token = context.Request.Cookies["authToken"];
            return Task.CompletedTask;
        }
    };
});

// 添加授权服务
builder.Services.AddAuthorization();

// 其他服务配置...

var app = builder.Build();

// 注意中间件顺序：认证在前，授权在后
app.UseAuthentication();
app.UseAuthorization();

// 其他中间件...

app.Run();

2. 使用内置[Authorize]属性 #

直接用框架自带的[Authorize]属性替代自定义属性，还可以通过Roles参数指定角色权限：

[HttpGet("GetFruits")]
[Authorize] // 自动验证Cookie中的JWT是否存在且有效
public IActionResult GetFruits()
{
    // 可通过HttpContext.User直接获取用户Claims信息
    var userId = HttpContext.User.FindFirst(ClaimTypes.NameIdentifier)?.Value;
    return Ok(new { Fruits = new[] { "Apple", "Banana" }, UserId = userId });
}

// 角色认证示例：仅允许Admin角色访问
[HttpGet("AdminOnly")]
[Authorize(Roles = "Admin")]
public IActionResult AdminOnly()
{
    return Ok("仅管理员可见内容");
}

3. 登录时写入HttpOnly Cookie #

登录接口生成JWT后，将其写入HttpOnly Cookie（保证安全性）：

[HttpPost("Login")]
public IActionResult Login([FromBody] LoginRequest model)
{
    // 验证用户身份逻辑（示例）
    if (model.Username != "admin" || model.Password != "password")
    {
        return Unauthorized(new { message = "用户名或密码错误" });
    }

    // 生成JWT令牌，包含角色声明
    var tokenHandler = new JwtSecurityTokenHandler();
    var key = Encoding.UTF8.GetBytes("this is my secret key more then 128 bits");
    var tokenDescriptor = new SecurityTokenDescriptor
    {
        Subject = new ClaimsIdentity(new[] 
        {
            new Claim(ClaimTypes.NameIdentifier, "admin123"),
            new Claim(ClaimTypes.Role, "Admin")
        }),
        Expires = DateTime.UtcNow.AddHours(1),
        SigningCredentials = new SigningCredentials(new SymmetricSecurityKey(key), SecurityAlgorithms.HmacSha256Signature)
    };
    var token = tokenHandler.CreateToken(tokenDescriptor);
    var tokenString = tokenHandler.WriteToken(token);

    // 写入HttpOnly Cookie
    Response.Cookies.Append("authToken", tokenString, new CookieOptions
    {
        HttpOnly = true, // 禁止前端JS读取，防范XSS攻击
        Secure = builder.Environment.IsProduction(), // 生产环境强制HTTPS
        SameSite = SameSiteMode.Strict,
        Expires = DateTime.UtcNow.AddHours(1)
    });

    return Ok(new { message = "登录成功" });
}

public class LoginRequest
{
    public string Username { get; set; }
    public string Password { get; set; }
}

内置方案的优势 #

• 无需手动编写令牌验证逻辑，框架自动处理令牌解析、验证和Claims填充
• 原生支持角色、策略、声明等多种授权方式，扩展性更强
• 集成ASP.NET Core完整认证体系，支持注销、令牌刷新等场景
• 自动处理401/403响应，无需手动构造JsonResult

内容的提问来源于stack exchange，提问作者Muhammad Yahya