ASP.NET Core 6 Web API基于外部API的自定义授权实现方案咨询

嘿，我来给你捋捋这个问题——其实动态策略名称+字符串解析并不是唯一的解决方案，还有几种更贴合你场景的实现方式，我给你逐个拆解清楚：

这种方式完全适配你“不同Action传不同参数”的需求，代码可读性拉满，不用搞复杂的字符串解析。

首先定义一个自定义授权属性，允许直接在Action上指定要传给外部API的参数：

public class ExternalApiAuthorizeAttribute : AuthorizeAttribute
{
    public string PermissionParam { get; }

    // 构造函数直接接收参数，用起来更方便
    public ExternalApiAuthorizeAttribute(string permissionParam)
    {
        PermissionParam = permissionParam;
    }
}

然后实现对应的授权处理器，负责调用外部API验证权限：

public class ExternalApiAuthorizationHandler : AuthorizationHandler<ExternalApiAuthorizeAttribute>
{
    private readonly IHttpClientFactory _httpClientFactory;
    private readonly IHttpContextAccessor _httpContextAccessor;

    public ExternalApiAuthorizationHandler(IHttpClientFactory httpClientFactory, IHttpContextAccessor httpContextAccessor)
    {
        _httpClientFactory = httpClientFactory;
        _httpContextAccessor = httpContextAccessor;
    }

    protected override async Task HandleRequirementAsync(AuthorizationHandlerContext context, ExternalApiAuthorizeAttribute requirement)
    {
        // 从请求头里提取已有的JWT令牌
        var authHeader = _httpContextAccessor.HttpContext.Request.Headers["Authorization"].ToString();
        var jwtToken = authHeader.Replace("Bearer ", string.Empty);
        if (string.IsNullOrWhiteSpace(jwtToken))
        {
            context.Fail();
            return;
        }

        // 调用外部API验证权限，携带JWT和当前Action指定的参数
        var client = _httpClientFactory.CreateClient();
        var request = new HttpRequestMessage(HttpMethod.Post, "https://your-external-auth-api/validate");
        request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwtToken);
        request.Content = new FormUrlEncodedContent(new Dictionary<string, string>
        {
            {"permission", requirement.PermissionParam}
        });

        var response = await client.SendAsync(request);
        if (response.IsSuccessStatusCode)
        {
            var isAuthorized = await response.Content.ReadFromJsonAsync<bool>();
            if (isAuthorized)
            {
                context.Succeed(requirement);
            }
            else
            {
                context.Fail();
            }
        }
        else
        {
            // 外部API调用失败时，默认拒绝访问
            context.Fail();
        }
    }
}

最后在Program/Startup里注册处理器：

services.AddScoped<IAuthorizationHandler, ExternalApiAuthorizationHandler>();

之后在Action上直接用这个属性就行，参数一目了然：

[ExternalApiAuthorize("order:view")]
public IActionResult GetUserOrders()
{
    // 业务逻辑
}

[ExternalApiAuthorize("payment:process")]
public IActionResult ProcessPayment()
{
    // 业务逻辑
}

如果你的参数不是固定字符串，需要从请求里动态获取（比如路由参数、QueryString甚至请求体内容），那这个方式更灵活。

先定义一个授权需求类，支持动态提供参数：

public class DynamicExternalPermissionRequirement : IAuthorizationRequirement
{
    // 用委托动态获取参数
    public Func<HttpContext, Task<string>> ParamProvider { get; }

    public DynamicExternalPermissionRequirement(Func<HttpContext, Task<string>> paramProvider)
    {
        ParamProvider = paramProvider;
    }
}

对应的处理器逻辑和之前类似，只是参数是动态获取的：

public class DynamicExternalPermissionHandler : AuthorizationHandler<DynamicExternalPermissionRequirement>
{
    private readonly IHttpClientFactory _httpClientFactory;
    private readonly IHttpContextAccessor _httpContextAccessor;

    public DynamicExternalPermissionHandler(IHttpClientFactory httpClientFactory, IHttpContextAccessor httpContextAccessor)
    {
        _httpClientFactory = httpClientFactory;
        _httpContextAccessor = httpContextAccessor;
    }

    protected override async Task HandleRequirementAsync(AuthorizationHandlerContext context, DynamicExternalPermissionRequirement requirement)
    {
        var httpContext = _httpContextAccessor.HttpContext;
        var jwtToken = httpContext.Request.Headers["Authorization"].ToString().Replace("Bearer ", "");
        if (string.IsNullOrWhiteSpace(jwtToken))
        {
            context.Fail();
            return;
        }

        // 动态获取参数（比如从路由里拿订单ID）
        var permissionParam = await requirement.ParamProvider(httpContext);
        if (string.IsNullOrWhiteSpace(permissionParam))
        {
            context.Fail();
            return;
        }

        // 调用外部API验证权限，逻辑和方案1一致
        var client = _httpClientFactory.CreateClient();
        var request = new HttpRequestMessage(HttpMethod.Post, "https://your-external-auth-api/validate");
        request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwtToken);
        request.Content = new FormUrlEncodedContent(new Dictionary<string, string>
        {
            {"permission", permissionParam}
        });

        var response = await client.SendAsync(request);
        if (response.IsSuccessStatusCode)
        {
            var isAuthorized = await response.Content.ReadFromJsonAsync<bool>();
            context.Succeed(isAuthorized ? requirement : null);
        }
        else
        {
            context.Fail();
        }
    }
}

注册服务后，在控制器里通过IAuthorizationService手动触发授权：

public class OrdersController : ControllerBase
{
    private readonly IAuthorizationService _authorizationService;

    public OrdersController(IAuthorizationService authorizationService)
    {
        _authorizationService = authorizationService;
    }

    public async Task<IActionResult> GetOrderDetails(int orderId)
    {
        // 动态生成参数：比如结合用户ID和订单ID
        var requirement = new DynamicExternalPermissionRequirement(async ctx => 
        {
            var userId = ctx.User.FindFirstValue(ClaimTypes.NameIdentifier);
            return $"order:view:{userId}:{orderId}";
        });

        var authResult = await _authorizationService.AuthorizeAsync(User, null, requirement);
        if (!authResult.Succeeded)
        {
            return Forbid();
        }

        // 后续业务逻辑
        return Ok();
    }
}

官方说的动态策略名称+字符串解析确实能用，但需要额外做字符串拆分逻辑，容易出错，可读性也不如前面两种。比如你可以定义一个通用策略，然后用[Authorize(Policy = "ExternalApi:order:view")]这样的格式，再在策略解析里把冒号后的部分提取出来当参数。

不过这种方式没必要作为首选，除非你有特殊的全局策略管理需求。

动态策略名称+字符串解析绝对不是唯一推荐方案，反而自定义授权属性是最适配你场景的——直接在Action上标注参数，清晰易懂，维护成本低。如果参数需要动态生成，再考虑基于资源的授权。

内容的提问来源于stack exchange，提问作者user9297554