ASP.NET Core 8中无认证方案的API密钥授权策略配置问题

你遇到的错误是因为ASP.NET Core的授权系统依赖认证系统处理挑战（如返回401未授权响应），但你仅配置了授权策略，未指定任何认证方案或默认挑战方案。以下是两种解决方案：

方案一：规范的API密钥认证实现（推荐） #

这种方式将API密钥验证放在认证环节，符合ASP.NET Core的认证/授权职责划分：

1. 创建认证选项类 #

public class ApiKeyAuthenticationOptions : AuthenticationSchemeOptions
{
    public const string DefaultScheme = "ApiKey";
    public string ApiKeyHeaderName { get; set; } = "x-api-key";
}

2. 实现认证处理类 #

public class ApiKeyAuthenticationHandler(IOptionsMonitor<ApiKeyAuthenticationOptions> options, ILoggerFactory logger, UrlEncoder encoder, IConfiguration configuration)
    : AuthenticationHandler<ApiKeyAuthenticationOptions>(options, logger, encoder)
{
    private readonly string _validApiKey = configuration["Credentials:ApiKey"] ?? throw new InvalidOperationException("未配置API密钥");

    protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
    {
        if (!Request.Headers.TryGetValue(Options.ApiKeyHeaderName, out var apiKeyHeaderValues))
        {
            return AuthenticateResult.Fail("缺少API密钥请求头");
        }

        string receivedApiKey = apiKeyHeaderValues.ToString();

        if (string.IsNullOrEmpty(receivedApiKey))
        {
            return AuthenticateResult.Fail("API密钥为空");
        }

        if (receivedApiKey != _validApiKey)
        {
            return AuthenticateResult.Fail("无效的API密钥");
        }

        // 创建认证通过的身份标识
        var claims = new[] { new Claim(ClaimTypes.Name, "ApiKey用户") };
        var identity = new ClaimsIdentity(claims, Options.DefaultScheme);
        var principal = new ClaimsPrincipal(identity);
        var ticket = new AuthenticationTicket(principal, Options.DefaultScheme);

        return AuthenticateResult.Success(ticket);
    }
}

3. 配置认证与授权 #

在Program.cs中修改配置：

// 注册认证服务
builder.Services.AddAuthentication(ApiKeyAuthenticationOptions.DefaultScheme)
    .AddScheme<ApiKeyAuthenticationOptions, ApiKeyAuthenticationHandler>(ApiKeyAuthenticationOptions.DefaultScheme, options =>
    {
        options.ApiKeyHeaderName = "x-api-key"; // 可自定义请求头名称
    });

// 配置授权策略
builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("ApiKey", policy =>
    {
        policy.RequireAuthenticatedUser(); // 要求用户已通过认证
    });
});

// 注意中间件顺序：先认证，后授权
app.UseAuthentication();
app.UseAuthorization();

方案二：兼容原有授权代码的修改 #

如果你想保留现有的ApiKeyRequirement和ApiKeyHandler，只需补充认证配置：

1. 注册必要服务 #

在Program.cs中添加：

builder.Services.AddHttpContextAccessor();
builder.Services.AddScoped<IAuthorizationHandler, ApiKeyHandler>();

2. 添加空认证处理类 #

public class NoOpAuthenticationHandler(IOptionsMonitor<AuthenticationSchemeOptions> options, ILoggerFactory logger, UrlEncoder encoder)
    : AuthenticationHandler<AuthenticationSchemeOptions>(options, logger, encoder)
{
    protected override Task<AuthenticateResult> HandleAuthenticateAsync()
    {
        return Task.FromResult(AuthenticateResult.NoResult());
    }

    protected override Task HandleChallengeAsync(AuthenticationProperties properties)
    {
        // 挑战时返回401
        Response.StatusCode = StatusCodes.Status401Unauthorized;
        return Task.CompletedTask;
    }
}

3. 配置认证与授权 #

// 配置认证，设置默认挑战方案
builder.Services.AddAuthentication(options =>
{
    options.DefaultChallengeScheme = "ApiKey";
})
.AddScheme<AuthenticationSchemeOptions, NoOpAuthenticationHandler>("ApiKey", options => { });

// 修改授权策略，关联认证方案
builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("ApiKey", policy =>
    {
        policy.Requirements.Add(new ApiKeyRequirement());
        policy.AuthenticationSchemes.Add("ApiKey");
    });
});

// 中间件顺序不能错
app.UseAuthentication();
app.UseAuthorization();

内容的提问来源于stack exchange，提问作者iKingNinja