OData接口默认Basic认证异常：带Basic关键词请求报HTTP 500错误如何解决？

我有一个已实现Basic认证的OData接口，其认证类默认启用了Basic认证。当请求头不带“Basic”关键词传递凭证时，请求能正常工作；但带上该关键词时，会返回HTTP 500内部服务器错误。请问如何移除默认的Basic认证设置？

可正常工作的请求 #

无法正常工作的请求（预期应正常） #

当前认证类代码 #

public class HttpBasicAuthorizeAttribute:AuthorizeAttribute {

    public override void OnAuthorization(System.Web.Http.Controllers.HttpActionContext actionContext) {
        Debug.WriteLine(actionContext.Request.Headers);
        if (actionContext.Request.Headers.Authorization != null) {
            // get the Authorization header value from the request and base64 decode it
                            
            string userInfo = Encoding.Default.GetString(Convert.FromBase64String(actionContext.Request.Headers.Authorization.ToString()));
            // custom authentication logic
            if (string.Equals(userInfo,string.Format("{0}:{1}","name","=password"))) {
                IsAuthorized(actionContext);
            }
            else {
                HandleUnauthorizedRequest(actionContext);
            }
        }
        else {
            HandleUnauthorizedRequest(actionContext);
        }
    }

    protected override void HandleUnauthorizedRequest(System.Web.Http.Controllers.HttpActionContext actionContext) {
        actionContext.Response = new HttpResponseMessage(System.Net.HttpStatusCode.Unauthorized) {
            ReasonPhrase = "Unauthorized"
        };
    }
}

问题根源 #

1. 500错误原因：当请求头带“Basic”关键词时，actionContext.Request.Headers.Authorization.ToString()返回Basic xxxxxxx格式字符串，其中“Basic ”前缀不是有效Base64编码内容，直接解码会抛出格式异常，触发500错误。
2. 默认认证冲突：IIS或Web API自带的默认Basic认证可能与自定义认证逻辑冲突，需要禁用。

解决步骤 #

1. 修复自定义认证类逻辑

修改OnAuthorization方法，正确提取Basic认证凭证并处理异常：

public class HttpBasicAuthorizeAttribute : AuthorizeAttribute
{
    public override void OnAuthorization(System.Web.Http.Controllers.HttpActionContext actionContext)
    {
        Debug.WriteLine(actionContext.Request.Headers);
        var authHeader = actionContext.Request.Headers.Authorization;
        
        if (authHeader != null && string.Equals(authHeader.Scheme, "Basic", StringComparison.OrdinalIgnoreCase))
        {
            try
            {
                // 提取去除"Basic "前缀后的Base64凭证串
                string userInfo = Encoding.UTF8.GetString(Convert.FromBase64String(authHeader.Parameter));
                
                // 自定义认证逻辑
                if (string.Equals(userInfo, "name:=password"))
                {
                    base.IsAuthorized(actionContext);
                }
                else
                {
                    HandleUnauthorizedRequest(actionContext);
                }
            }
            catch (FormatException)
            {
                // 处理无效Base64编码的情况
                HandleUnauthorizedRequest(actionContext);
            }
        }
        else
        {
            HandleUnauthorizedRequest(actionContext);
        }
    }

    protected override void HandleUnauthorizedRequest(System.Web.Http.Controllers.HttpActionContext actionContext)
    {
        actionContext.Response = new HttpResponseMessage(System.Net.HttpStatusCode.Unauthorized)
        {
            ReasonPhrase = "Unauthorized"
        };
    }
}

2. 移除默认Basic认证设置

根据托管环境选择对应方式：

• IIS托管场景：
  在项目Web.config中添加配置，禁用IIS自带Basic认证：

  <system.webServer>
    <security>
      <authentication>
        <anonymousAuthentication enabled="true" />
        <basicAuthentication enabled="false" />
      </authentication>
    </security>
  </system.webServer>
  

• Web API配置场景：
  在WebApiConfig.cs中移除默认认证过滤器，仅保留自定义认证：

  public static void Register(HttpConfiguration config)
  {
      // 移除所有默认的Authorize过滤器
      config.Filters.RemoveAll(f => f is AuthorizeAttribute);
      // 注册自定义认证过滤器
      config.Filters.Add(new HttpBasicAuthorizeAttribute());
      
      // 其他OData/Web API配置代码...
  }
  

内容的提问来源于stack exchange，提问作者Broda