如何從Web Api .Net中的AuthorizeAttribute檢索POST參數？

Question

我上的身份驗證方法使用的工作對我來說是令牌網絡API .NET項目，所以我重寫這樣一些方法：

public class Authorizetest: System.Web.Http.AuthorizeAttribute 
{ 
     public override void OnAuthorization(HttpActionContext actionContext) 
    { 
      if(Authorize(actionContext)) 
     { 
      return; 
     } 
     HandleUnauthorizedRequest(actionContext); 
    } 

    protected override void HandleUnauthorizedRequest(HttpActionContext actionContext) 
    { 
     base.HandleUnauthorizedRequest(actionContext); 
    } 

    private bool Authorize(HttpActionContext actionContext) 
    {   
     try 
     {       
      var context = new HttpContextWrapper(HttpContext.Current); 
      HttpRequestBase request = context.Request;    
      string token = request.Params["Token"]; 
      return true; 
     } 
     catch (Exception) 
     { 
      return false; 
     } 
    } 
} 

我使用的裝飾[Authorizetest]在這條路上：

[Authorizetest] 
    public class DoActionController : ApiController 
     { 
      [HttpPost] 
      public Display DoSomething(Parameter param) 
      { 
       //do something 
       return display; 
      } 
    } 

但是request.Params返回null但是在DoSomething方法我從Parameter得到的值。

我也試過類似：（基於this page）

HttpRequestBase request = actionContext.RequestContext.HttpContext.Request; 
    string token = request.Params["Token"]; 

，但它無法獲取通過POST方法發送的任何值。

我使用jQuery發送數據

$.ajax({ 
       type: 'POST', 
       url: '/DoSomething', 
       data: JSON.stringify({ "Token": "xxxxxxxxx"}), 
       contentType: 'application/json; charset=utf-8', 
       success: function (data) { 
       }, 
       fail:function (XMLHttpRequest, textStatus, errorThrown) { 
        alert(errorThrown); 
       } 
      }); 

我怎樣才能檢索到的Authorizetest class發送到DoSomething數據？

Answer 1

驗證令牌應該在請求的頭部發送，然後由Authorize Attribute提取，如果意圖是使用它進行授權的話。在模型聯編程序有機會填充模型之前讀取請求主體可能會產生負面影響。

var token = "xxxxxxxxx"; 
$.ajax({  
    type: 'POST', 
    url: '/DoSomething', 
    data: JSON.stringify({ "SomeProperty": "SomeValue"}), 
    contentType: 'application/json; charset=utf-8', 
    beforeSend: function (xhr) { 
     /* Authorization header */ 
     xhr.setRequestHeader("Authorization", "Token " + token);   
    }, 
    success: function (data) { 
    }, 
    fail:function (XMLHttpRequest, textStatus, errorThrown) { 
     alert(errorThrown); 
    } 
}); 

然後訪問該服務器

public class Authorizetest : System.Web.Http.AuthorizeAttribute { 
    public override void OnAuthorization(HttpActionContext actionContext) { 
     if (Authorize(actionContext)) { 
      return; 
     } 
     HandleUnauthorizedRequest(actionContext); 
    } 

    protected override void HandleUnauthorizedRequest(HttpActionContext actionContext) { 
     base.HandleUnauthorizedRequest(actionContext); 
    } 

    private bool Authorize(HttpActionContext actionContext) { 
     try { 
      var auth = actionContext.Request.Headers.Authorization; 
      if (auth != null) { 
       var scheme = auth.Scheme; //Should be Token, otherwise fail 
       var token = auth.Parameter; 
       //Validate your token and set your principal 
       IPrincipal user = GetUser(token); 
       if (user != null) { 
        SetPrincipal(user); 
        return true; 
       } 
      } 
      return false; 
     } catch (Exception) { 
      return false; 
     } 
    } 

    private IPrincipal GetUser(string token) { 
     throw new NotImplementedException(); //Put your implementation here 
    } 

    private void SetPrincipal(System.Security.Principal.IPrincipal principal) { 
     if (principal != null) { 
      System.Threading.Thread.CurrentPrincipal = principal; 
      if (System.Web.HttpContext.Current != null) { 
       System.Web.HttpContext.Current.User = principal; 
      } 
     } 
    } 
}