ASP.NET Core Minimal API多团队API权限隔离方案咨询

1. API分组+策略授权（首推） #

这是最安全且灵活的方案，通过权限策略实现API的访问隔离：

实现步骤： #

• 先注册两个对应团队的授权策略：

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("TeamAPolicy", policy =>
        policy.RequireClaim("Team", "TeamA"));
    options.AddPolicy("TeamBPolicy", policy =>
        policy.RequireClaim("Team", "TeamB"));
});

• 给不同团队的API绑定对应的策略：

// TeamA 专属API
app.MapGet("/api/customer-money/", ([FromServices] IMediator mediator, string customerIsin)
    => mediator.Send(new GetMoneyQuery(customerIsin)))
    .RequireAuthorization("TeamAPolicy");

app.MapGet("/api/customer-portfolio/", ([FromServices] IMediator mediator, string customerIsin)
    => mediator.Send(new GetPortfolioQuery(customerIsin)))
    .RequireAuthorization("TeamAPolicy");

app.MapGet("/api/customer-order/", ([FromServices] IMediator mediator, string customerIsin)
    => mediator.Send(new GetOrdersQuery(customerIsin)))
    .RequireAuthorization("TeamAPolicy");

// TeamB 专属API
app.MapPost("/api/add-order/", ([FromServices] IMediator mediator, AddOrderCommand cmd)
    => mediator.Send(cmd))
    .RequireAuthorization("TeamBPolicy");

app.MapDelete("/api/delete-order/", ([FromServices] IMediator mediator, [FromBody] DeleteOrderCommand cmd)
    => mediator.Send(cmd))
    .RequireAuthorization("TeamBPolicy");

app.MapPut("/api/modify-order/", ([FromServices] IMediator mediator,[FromBody] ModifyOrderCommand cmd)
    => mediator.Send(cmd))
    .RequireAuthorization("TeamBPolicy");

这种方式依赖身份认证（比如JWT），团队成员的请求需携带包含Team声明的令牌，权限控制精准，支持多环境复用，比环境配置的安全性高很多。

2. 路由前缀+中间件过滤 #

如果不想引入认证体系，可通过路由分组+中间件做访问拦截：

实现步骤： #

• 给两个团队的API设置不同路由前缀：

// TeamA 前缀 /team-a
var teamAGroup = app.MapGroup("/team-a");
teamAGroup.MapGet("/api/customer-money/", ([FromServices] IMediator mediator, string customerIsin)
    => mediator.Send(new GetMoneyQuery(customerIsin)));
teamAGroup.MapGet("/api/customer-portfolio/", ([FromServices] IMediator mediator, string customerIsin)
    => mediator.Send(new GetPortfolioQuery(customerIsin)));
teamAGroup.MapGet("/api/customer-order/", ([FromServices] IMediator mediator, string customerIsin)
    => mediator.Send(new GetOrdersQuery(customerIsin)));

// TeamB 前缀 /team-b
var teamBGroup = app.MapGroup("/team-b");
teamBGroup.MapPost("/api/add-order/", ([FromServices] IMediator mediator, AddOrderCommand cmd)
    => mediator.Send(cmd));
teamBGroup.MapDelete("/api/delete-order/", ([FromServices] IMediator mediator, [FromBody] DeleteOrderCommand cmd)
    => mediator.Send(cmd));
teamBGroup.MapPut("/api/modify-order/", ([FromServices] IMediator mediator,[FromBody] ModifyOrderCommand cmd)
    => mediator.Send(cmd));

• 编写中间件根据请求标识（请求头/IP）拦截非法访问：

app.Use(async (context, next) =>
{
    var isTeamARequest = context.Request.Path.StartsWithSegments("/team-a");
    var isTeamBRequest = context.Request.Path.StartsWithSegments("/team-b");

    // 可根据实际场景调整校验逻辑，比如IP白名单、专属请求头
    var teamHeader = context.Request.Headers["X-Team"].FirstOrDefault();
    if ((isTeamARequest && teamHeader != "TeamA") || (isTeamBRequest && teamHeader != "TeamB"))
    {
        context.Response.StatusCode = StatusCodes.Status403Forbidden;
        await context.Response.WriteAsync("Access Denied");
        return;
    }

    await next();
});

这种方案适合内部团队使用，实现简单，但安全性略低于授权策略。

3. 拆分独立API项目（最彻底隔离） #

如果两个团队的API业务边界清晰，直接拆成两个独立的Minimal API项目：

• 每个项目只包含对应团队的3个API
• 各自独立部署，配置专属端口、域名、认证规则
• 物理层面完全隔离，彻底避免跨团队访问风险

该方案适合业务独立性高的场景，后期维护更清晰，但部署成本会略高。

对比环境配置方案 #

用appsettings.json做环境配置的核心问题：

• 只能在部署阶段控制API是否注册，无法动态调整权限
• 同一环境下无法同时为两个团队提供服务，需部署多份不同配置的实例
• 无权限校验，只要拿到地址就能访问，安全性极低

综上，优先推荐策略授权方案；若业务边界清晰，拆分独立项目是长远最优解。

内容的提问来源于stack exchange，提问作者Ehsan Akbar