.NET Core 6微服务GraphQL Schema Stitching认证及令牌传递实现

方式一：全局HttpClient拦截器（推荐） #

通过自定义IHttpMessageHandlerBuilderFilter，拦截所有拼接Schema的请求，自动将网关收到的令牌传递给微服务：

// 注册拦截器
builder.Services.AddTransient<IHttpMessageHandlerBuilderFilter, AuthHeaderHandlerFilter>();

// 自定义过滤器类
public class AuthHeaderHandlerFilter : IHttpMessageHandlerBuilderFilter
{
    private readonly IHttpContextAccessor _httpContextAccessor;

    public AuthHeaderHandlerFilter(IHttpContextAccessor httpContextAccessor)
    {
        _httpContextAccessor = httpContextAccessor;
    }

    public Action<HttpMessageHandlerBuilder> Configure(Action<HttpMessageHandlerBuilder> next)
    {
        return builder =>
        {
            next(builder);
            builder.AdditionalHandlers.Add(new AuthHeaderHandler(_httpContextAccessor));
        };
    }
}

// 自定义消息处理器
public class AuthHeaderHandler : DelegatingHandler
{
    private readonly IHttpContextAccessor _httpContextAccessor;

    public AuthHeaderHandler(IHttpContextAccessor httpContextAccessor)
    {
        _httpContextAccessor = httpContextAccessor;
    }

    protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
    {
        var authHeader = _httpContextAccessor.HttpContext?.Request.Headers["Authorization"].FirstOrDefault();
        if (!string.IsNullOrEmpty(authHeader))
        {
            // 拆分Bearer令牌并添加到请求头
            var token = authHeader.Split(' ')[1];
            request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token);
        }
        return await base.SendAsync(request, cancellationToken);
    }
}

方式二：针对单个服务配置 #

如果只需给特定微服务传递令牌，可在添加Schema时直接配置HttpClient：

builder.Services.AddStitchedSchema(builder => builder
    .AddSchemaFromHttp("ServiceA", new Uri("https://localhost:5001/graphql"), configureClient: client =>
    {
        var httpContext = builder.Services.BuildServiceProvider().GetRequiredService<IHttpContextAccessor>().HttpContext;
        var authHeader = httpContext?.Request.Headers["Authorization"].FirstOrDefault();
        if (!string.IsNullOrEmpty(authHeader))
        {
            var token = authHeader.Split(' ')[1];
            client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token);
        }
    })
);

注意事项 #

• 微服务端需配置与网关一致的JWT验证规则，确保能正确解析令牌。
• 微服务的敏感GraphQL字段或类型需添加[Authorize]特性或HotChocolate的Authorize指令，实现细粒度授权。

内容的提问来源于stack exchange，提问作者Samad Kakkad