如何从请求头中动态获取Client ID和Client Secret？

当前代码硬编码添加了xyzClientId和xyzClientSecret请求头，需要改为从客户端传入的请求头中动态获取这两个参数，实现逻辑参考获取Bearer令牌的方式。

现有实现代码 #

public override async Task OnActionExecutionAsync(ActionExecutingContext context, ActionExecutionDelegate next)
{            
    bool isTenantForbidden = false;

    var headers = context.HttpContext.Request.Headers;
    headers.Add("xyzClientId", "someclientId");
    headers.Add("xyzClientSecret", "someClientSecret");           

    headers.TryGetValue("xyzClientId", out var clientId);
    headers.TryGetValue("xyxClientSecret", out var clientSecret); // 注意：此处存在拼写错误，应为xyzClientSecret

    var tenant = this.tenantService.GetTenant(clientId, clientSecret);
    
    isTenantForbidden = await this.ForbidTenant(tenant);            

    if (isTenantForbidden)
    {
        throw new Exception("Restricted resource!");
    }

    await next();
}

修改后的实现方案 #

public override async Task OnActionExecutionAsync(ActionExecutingContext context, ActionExecutionDelegate next)
{            
    bool isTenantForbidden = false;
    var headers = context.HttpContext.Request.Headers;

    // 从请求头读取客户端传入的xyzClientId
    if (!headers.TryGetValue("xyzClientId", out var clientId) || string.IsNullOrEmpty(clientId))
    {
        throw new ArgumentNullException(nameof(clientId), "请求头中缺少有效的xyzClientId");
    }

    // 从请求头读取客户端传入的xyzClientSecret
    if (!headers.TryGetValue("xyzClientSecret", out var clientSecret) || string.IsNullOrEmpty(clientSecret))
    {
        throw new ArgumentNullException(nameof(clientSecret), "请求头中缺少有效的xyzClientSecret");
    }

    var tenant = this.tenantService.GetTenant(clientId, clientSecret);
    
    isTenantForbidden = await this.ForbidTenant(tenant);            

    if (isTenantForbidden)
    {
        throw new Exception("Restricted resource!");
    }

    await next();
}

关键修改点 #

• 移除硬编码添加请求头的代码，改为直接读取客户端发送的请求头字段
• 增加参数有效性校验，确保客户端传入了必填且有效的xyzClientId和xyzClientSecret
• 修正原代码中xyxClientSecret的拼写错误

内容的提问来源于stack exchange，提问作者Ozan Ayko