在SignalR属性中检查授权 [英] Check authorize in SignalR attribute

问题描述

我在ServiceStack上有一些服务，并在此项目中使用SignalR.

现在，我想保护集线器连接(仅对经过身份验证的用户进行访问)，但是我使用ServiceStack框架身份验证(不是ASP.NET身份验证)和ServiceStack的会话(在此会话和身份验证标志中写入AuthUserId).

因此，当用户尝试连接到集线器时-集线器必须检查身份验证...

(是的，我可以从集线器请求Cookie(例如，方法OnConnected)，但是SignalR在Authorize Attribute中检查身份验证-我必须在此类中(而不是在集线器中)进行认证

( http://www.asp.net/signalr/overview/signalr-20/security/hub-authorization )

所以，我创建了类

[AttributeUsage(AttributeTargets.Class, Inherited = false, AllowMultiple = false)]
public class AuthorizeMyAttribute : AuthorizeAttribute
{
   protected override bool UserAuthorized(System.Security.Principal.IPrincipal user)
   {
     //... how can i request Cookies? / or may be can access for ServiceStack session...
     //    and return true or false
   }
}

我能做什么? 谢谢！

解决方案

AuthorizeAttribute还有两个虚拟方法:

• AuthorizeHubConnection(HubDescriptor hubDescriptor, IRequest request)
• AuthorizeHubMethodInvocation(IHubIncomingInvokerContext hubIncomingInvokerContext, bool appliesToMethod)

http://msdn.microsoft. com/en-us/library/microsoft.aspnet.signalr.authorizeattribute(v = vs.118).aspx

这两种方法的默认实现都使用请求的IPrincipal调用UserAuthorized.

AuthorizeHubConnection传递了 IRequest 直接.

在AuthorizeHubMethodInvocation中，您可以从IHubIncomingInvokerContext访问IRequest对象，如下所示:hubIncomingInvokerContext.Hub.Context.Request.

i have some services on ServiceStack and use SignalR in this project.

And now, i would like to secure hub connection (access only for authenticated users), but i use ServiceStack framework authentication.. (not asp.net authentication) and ServiceStack's sessions (write AuthUserId ih this session and authentication flag).

So, when user trying connect to the hub -- hub must to check authentication...

(yes, i can request Cookies from Hub (method OnConnected, for example), but SignalR check authentication in Authorize Attribute - and i must do it in this class (not in hub)

(http://www.asp.net/signalr/overview/signalr-20/security/hub-authorization)

So, i create class

[AttributeUsage(AttributeTargets.Class, Inherited = false, AllowMultiple = false)]
public class AuthorizeMyAttribute : AuthorizeAttribute
{
   protected override bool UserAuthorized(System.Security.Principal.IPrincipal user)
   {
     //... how can i request Cookies? / or may be can access for ServiceStack session...
     //    and return true or false
   }
}

What can i do for it? Thanks!

解决方案

AuthorizeAttribute has two more virtual methods:

• AuthorizeHubConnection(HubDescriptor hubDescriptor, IRequest request)
• AuthorizeHubMethodInvocation(IHubIncomingInvokerContext hubIncomingInvokerContext, bool appliesToMethod)

http://msdn.microsoft.com/en-us/library/microsoft.aspnet.signalr.authorizeattribute(v=vs.118).aspx

The default implementations of both methods call UserAuthorized with the request's IPrincipal.

AuthorizeHubConnection is passed an IRequest directly.

In AuthorizeHubMethodInvocation, you can access the IRequest object from the IHubIncomingInvokerContext like so: hubIncomingInvokerContext.Hub.Context.Request.

这篇关于在SignalR属性中检查授权的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！