如何为ASP.NET Core中的特定ApiController配置中间件？

以下几种实现方式比全局中间件或URL匹配更高效，可精准作用于目标控制器：

1. 自定义ActionFilterAttribute（推荐） #

直接在目标控制器上标记特性，仅对该控制器的所有Action生效，无需全局扫描或URL判断，逻辑清晰且开销极低。

实现代码： #

// 自定义密钥检查过滤器
public class PrivateKeyCheckFilter : ActionFilterAttribute
{
    private const string _privateKeyHeader = "X-Private-Access-Key";
    private readonly string _validKey;

    // 从配置注入合法密钥
    public PrivateKeyCheckFilter(IConfiguration config)
    {
        _validKey = config["ApiSettings:PrivateAccessKey"];
    }

    public override void OnActionExecuting(ActionExecutingContext context)
    {
        if (!context.HttpContext.Request.Headers.TryGetValue(_privateKeyHeader, out var headerValue) 
            || !string.Equals(headerValue, _validKey, StringComparison.OrdinalIgnoreCase))
        {
            context.Result = new UnauthorizedResult();
            return;
        }

        base.OnActionExecuting(context);
    }
}

// 应用到目标控制器
[ApiController]
[Route("api/[controller]")]
[PrivateKeyCheckFilter] // 直接标记即可
public class PrivateDataController : ControllerBase
{
    [HttpGet]
    public IActionResult GetSensitiveData()
    {
        return Ok("敏感数据内容");
    }
}

2. 基于策略的授权 #

利用ASP.NET Core原生授权系统，定义密钥检查策略后绑定到目标控制器，适合需要复用检查逻辑或结合其他授权规则的场景。

实现代码： #

// 定义授权要求
public class PrivateKeyRequirement : IAuthorizationRequirement
{
    public string ValidKey { get; }
    public PrivateKeyRequirement(string validKey) => ValidKey = validKey;
}

// 授权处理程序
public class PrivateKeyHandler : AuthorizationHandler<PrivateKeyRequirement>
{
    private const string _privateKeyHeader = "X-Private-Access-Key";
    private readonly IHttpContextAccessor _httpContextAccessor;

    public PrivateKeyHandler(IHttpContextAccessor httpContextAccessor)
    {
        _httpContextAccessor = httpContextAccessor;
    }

    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, PrivateKeyRequirement requirement)
    {
        var request = _httpContextAccessor.HttpContext?.Request;
        if (request != null 
            && request.Headers.TryGetValue(_privateKeyHeader, out var headerValue)
            && string.Equals(headerValue, requirement.ValidKey, StringComparison.OrdinalIgnoreCase))
        {
            context.Succeed(requirement);
        }
        else
        {
            context.Fail();
        }

        return Task.CompletedTask;
    }
}

// Program.cs中注册策略
builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("PrivateKeyPolicy", policy =>
        policy.Requirements.Add(new PrivateKeyRequirement(builder.Configuration["ApiSettings:PrivateAccessKey"])));
});

builder.Services.AddSingleton<IAuthorizationHandler, PrivateKeyHandler>();
builder.Services.AddHttpContextAccessor();

// 应用到控制器
[ApiController]
[Route("api/[controller]")]
[Authorize(Policy = "PrivateKeyPolicy")]
public class PrivateDataController : ControllerBase
{
    [HttpGet]
    public IActionResult GetSensitiveData()
    {
        return Ok("敏感数据内容");
    }
}

3. 端点路由分支匹配 #

通过端点路由精准匹配目标控制器的路由路径，仅对该路径下的请求执行密钥检查中间件，比全局中间件更高效。

实现代码： #

// Program.cs中配置路由分支
app.UseWhen(context => 
    context.Request.Path.StartsWithSegments("/api/privatedata"), // 匹配目标控制器路由
    appBuilder => 
    {
        appBuilder.Use(async (context, next) =>
        {
            const string _privateKeyHeader = "X-Private-Access-Key";
            var validKey = app.Configuration["ApiSettings:PrivateAccessKey"];

            if (!context.Request.Headers.TryGetValue(_privateKeyHeader, out var headerValue) 
                || !string.Equals(headerValue, validKey, StringComparison.OrdinalIgnoreCase))
            {
                context.Response.StatusCode = StatusCodes.Status401Unauthorized;
                return;
            }

            await next();
        });
    });

app.MapControllers();

内容的提问来源于stack exchange，提问作者iKingNinja