ASP.NET Web API验证JWT持有者为对应课程所属教师的方法

Great question! Let's tackle this properly—you're on the right track with including the teacher's GUID in the JWT, but we can leverage ASP.NET's built-in authorization framework to make this clean and maintainable instead of manually parsing tokens. Here's the standard approach:

1. Stop manually parsing JWT tokens—use HttpContext.User #

ASP.NET's JWT middleware automatically validates and parses tokens for you, exposing all claims through the User property in your controller or authorization handlers. If your JWT includes a claim for the teacher's GUID (e.g., named TeacherId or using ClaimTypes.NameIdentifier), you can access it directly like this:

var teacherId = User.FindFirstValue("TeacherId"); // Or ClaimTypes.NameIdentifier if that's what you use

But instead of putting this check directly in your controller (which mixes authorization and business logic), we'll use a custom authorization policy—the recommended pattern for ASP.NET.

2. Create a custom authorization requirement and handler #

First, define a requirement to represent "must be the course's owner teacher":

// A marker class for our authorization requirement
public class CourseOwnerRequirement : IAuthorizationRequirement { }

Next, build an authorization handler that checks if the current user is either an admin or the course's owner teacher:

public class CourseOwnerAuthorizationHandler : AuthorizationHandler<CourseOwnerRequirement>
{
    private readonly ICourseService _courseService; // Inject your service to fetch course data

    public CourseOwnerAuthorizationHandler(ICourseService courseService)
    {
        _courseService = courseService;
    }

    protected override async Task HandleRequirementAsync(AuthorizationHandlerContext context, CourseOwnerRequirement requirement)
    {
        // Admins get full access—bypass the course check
        if (context.User.IsInRole("Admin"))
        {
            context.Succeed(requirement);
            return;
        }

        // Get the CourseID from the request (either route or query params)
        if (context.Resource is HttpContext httpContext)
        {
            if (!Guid.TryParse(httpContext.Request.Query["CourseID"], out Guid courseId))
            {
                // CourseID is missing or invalid—deny access
                context.Fail();
                return;
            }

            // Get the teacher's GUID from JWT claims
            var teacherIdClaim = context.User.FindFirst("TeacherId") 
                                 ?? context.User.FindFirst(ClaimTypes.NameIdentifier);
            if (teacherIdClaim == null || !Guid.TryParse(teacherIdClaim.Value, out Guid teacherId))
            {
                context.Fail();
                return;
            }

            // Check if the course belongs to this teacher
            var course = await _courseService.GetCourseByIdAsync(courseId);
            if (course != null && course.OwnerTeacherId == teacherId)
            {
                context.Succeed(requirement);
                return;
            }
        }

        // If none of the checks passed, deny access
        context.Fail();
    }
}

3. Register the policy in your startup configuration #

Add the custom policy to your authorization setup (in Program.cs or Startup.cs):

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("CanManageCourseParticipants", policy =>
    {
        // First, require the user to be either Admin or Teacher
        policy.RequireRole("Admin", "Teacher");
        // Then, add our custom course owner check
        policy.Requirements.Add(new CourseOwnerRequirement());
    });
});

// Register the authorization handler with DI
builder.Services.AddScoped<IAuthorizationHandler, CourseOwnerAuthorizationHandler>();

4. Update your controller to use the policy #

Replace your existing Authorize attribute with the new policy:

[HttpPost, Authorize(Policy = "CanManageCourseParticipants")]
public async Task<ActionResult<CourseParticipant>> AddCourseParticipant(Guid userID, Guid CourseID)
{
    return Ok(await _calendarParticipantService.AddCalendarParticipant(userID, CourseID));
}

Why this is better than manual token parsing #

• Separation of concerns: Authorization logic lives in dedicated handlers, not your controller business logic.
• Reusability: You can apply this policy to any other course-related endpoints (like updating/deleting participants) without duplicating code.
• Compliance with ASP.NET standards: Uses the built-in authorization framework, which is maintained and tested by Microsoft.

内容的提问来源于stack exchange，提问作者user16483107