ASP.Net Core SignalR 身份验证始终响应 403 - 禁止

Question

概括

我正在尝试向我的 SignalR 集线器添加安全/身份验证，但无论我尝试什么，客户端请求都会不断收到 403 - 禁止响应（尽管请求已成功通过身份验证）。

设置

我的项目基于 Microsoft 的 SignalRChat 示例：

https://learn.microsoft.com/en-us/aspnet/core/tutorials/signalr?view=aspnetcore-3.1&tabs=visual-studio

基本上我有一个带有 Razor Pages 的 ASP.Net Core Web 应用程序。该项目的目标是.Net Core 3.1。

使用的客户端库是 Microsoft 的 JavaScript 客户端库 v3.1.0。

我还参考了他们的安全方面的认证和授权文档：

https://learn.microsoft.com/en-us/aspnet/core/signalr/authn-and-authz?view=aspnetcore-3.1

关键区别在于，我没有使用 JWT Bearer 中间件，而是制作了自己的自定义令牌身份验证处理程序。

代码

聊天.js：

"use strict";

var connection = new signalR.HubConnectionBuilder()
  .withUrl("/chatHub", { accessTokenFactory: () => 'mytoken' })
  .configureLogging(signalR.LogLevel.Debug)
  .build();

//Disable send button until connection is established
document.getElementById("sendButton").disabled = true;

connection.on("ReceiveMessage", function (user, message) {
  var msg = message.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
  var encodedMsg = user + " says " + msg;
  var li = document.createElement("li");
  li.textContent = encodedMsg;
  document.getElementById("messagesList").appendChild(li);
});

connection.start().then(function () {
  document.getElementById("sendButton").disabled = false;
}).catch(function (err) {
  return console.error(err.toString());
});

document.getElementById("sendButton").addEventListener("click", function (event) {
  var user = document.getElementById("userInput").value;
  var message = document.getElementById("messageInput").value;
  connection.invoke("SendMessage", user, message).catch(function (err) {
    return console.error(err.toString());
  });
  event.preventDefault();
});

启动.cs

using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Hosting;
using SignalRChat.Hubs;
using SignalRChat.Security;

namespace SignalRChat
{
  public class Startup
  {
    public Startup(IConfiguration configuration)
    {
      Configuration = configuration;
    }

    public IConfiguration Configuration { get; }

    // This method gets called by the runtime. Use this method to add services to the container.
    public void ConfigureServices(IServiceCollection services)
    {
      // Found other cases where CORS caused authentication issues, so
      // making sure that everything is allowed.
      services.AddCors(options =>
      {
        options.AddPolicy("AllowAny", policy =>
        {
          policy
          .WithOrigins("http://localhost:44312/", "https://localhost:44312/")
          .AllowCredentials()
          .AllowAnyHeader()
          .AllowAnyMethod();
        });
      });

      services
        .AddAuthentication()
        .AddHubTokenAuthenticationScheme();

      services.AddAuthorization(options =>
      {
        options.AddHubAuthorizationPolicy();
      });

      services.AddRazorPages();

      services.AddSignalR(options =>
      {
        options.EnableDetailedErrors = true;
      });
    }

    // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
      if (env.IsDevelopment())
      {
        app.UseDeveloperExceptionPage();
      }
      else
      {
        app.UseExceptionHandler("/Error");
        // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
        app.UseHsts();
      }

      app.UseHttpsRedirection();

      app.UseStaticFiles();

      app.UseRouting();

      app.UseAuthentication();

      app.UseAuthorization();

      app.UseEndpoints(endpoints =>
      {
        endpoints.MapRazorPages();
        endpoints.MapHub<ChatHub>("/chatHub");
      });
    }
  }
}

聊天中心.cs

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.SignalR;
using SignalRChat.Security;
using System.Threading.Tasks;

namespace SignalRChat.Hubs
{
  [Authorize(HubRequirementDefaults.PolicyName)]
  public class ChatHub : Hub
  {
    public async Task SendMessage(string user, string message)
    {
      await Clients.All.SendAsync("ReceiveMessage", user, message);
    }
  }
}

HubTokenAuthenticationHandler.cs

using Microsoft.AspNetCore.Authentication;
using Microsoft.Extensions.Logging;
using Microsoft.Extensions.Options;
using System;
using System.Security.Claims;
using System.Text.Encodings.Web;
using System.Threading.Tasks;

namespace SignalRChat.Security
{
  public class HubTokenAuthenticationHandler : AuthenticationHandler<HubTokenAuthenticationOptions>
  {
    public IServiceProvider ServiceProvider { get; set; }

    public HubTokenAuthenticationHandler(
      IOptionsMonitor<HubTokenAuthenticationOptions> options,
      ILoggerFactory logger,
      UrlEncoder encoder,
      ISystemClock clock,
      IServiceProvider serviceProvider)
      : base(options, logger, encoder, clock)
    {
      ServiceProvider = serviceProvider;
    }

    protected override Task<AuthenticateResult> HandleAuthenticateAsync()
    {
      bool isValid = TryAuthenticate(out AuthenticationTicket ticket, out string message);

      if (isValid) return Task.FromResult(AuthenticateResult.Success(ticket));

      return Task.FromResult(AuthenticateResult.Fail(message));
    }

    private bool TryAuthenticate(out AuthenticationTicket ticket, out string message)
    {
      message = null;
      ticket = null;

      var token = GetToken();

      if (string.IsNullOrEmpty(token))
      {
        message = "Token is missing";
        return false;
      }

      bool tokenIsValid = token.Equals("mytoken");

      if (!tokenIsValid)
      {
        message = $"Token is invalid: token={token}";
        return false;
      }

      var claims = new[] { new Claim("token", token) };
      var identity = new ClaimsIdentity(claims, nameof(HubTokenAuthenticationHandler));
      ticket = new AuthenticationTicket(new ClaimsPrincipal(identity), Scheme.Name);

      return true;
    }

    #region Get Token

    private string GetToken()
    {
      string token = Request.Query["access_token"];

      if (string.IsNullOrEmpty(token))
      {
        token = GetTokenFromHeader();
      }

      return token;
    }

    private string GetTokenFromHeader()
    {
      string token = Request.Headers["Authorization"];

      if (string.IsNullOrEmpty(token)) return null;

      // The Authorization header value should be in the format "Bearer [token_value]"
      string[] authorizationParts = token.Split(new char[] { ' ' });

      if (authorizationParts == null || authorizationParts.Length < 2) return token;

      return authorizationParts[1];
    }

    #endregion
  }
}

HubTokenAuthenticationOptions.cs

using Microsoft.AspNetCore.Authentication;

namespace SignalRChat.Security
{
  public class HubTokenAuthenticationOptions : AuthenticationSchemeOptions { }
}

HubTokenAuthenticationDefaults.cs

using Microsoft.AspNetCore.Authentication;
using System;

namespace SignalRChat.Security
{
  public static class HubTokenAuthenticationDefaults
  {
    public const string AuthenticationScheme = "HubTokenAuthentication";

    public static AuthenticationBuilder AddHubTokenAuthenticationScheme(this AuthenticationBuilder builder)
    {
      return AddHubTokenAuthenticationScheme(builder, (options) => { });
    }

    public static AuthenticationBuilder AddHubTokenAuthenticationScheme(this AuthenticationBuilder builder, Action<HubTokenAuthenticationOptions> configureOptions)
    {
      return builder.AddScheme<HubTokenAuthenticationOptions, HubTokenAuthenticationHandler>(AuthenticationScheme, configureOptions);
    }
  }
}

HubRequirement.cs

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.SignalR;
using System.Threading.Tasks;

namespace SignalRChat.Security
{
  public class HubRequirement : AuthorizationHandler<HubRequirement, HubInvocationContext>, IAuthorizationRequirement
  {
    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, HubRequirement requirement, HubInvocationContext resource)
    {
      // Authorization logic goes here.  Just calling it a success for demo purposes.
      context.Succeed(requirement);
      return Task.CompletedTask;
    }
  }
}

HubRequirementDefaults.cs

using Microsoft.AspNetCore.Authentication;
using System;

namespace SignalRChat.Security
{
  public static class HubTokenAuthenticationDefaults
  {
    public const string AuthenticationScheme = "HubTokenAuthentication";

    public static AuthenticationBuilder AddHubTokenAuthenticationScheme(this AuthenticationBuilder builder)
    {
      return AddHubTokenAuthenticationScheme(builder, (options) => { });
    }

    public static AuthenticationBuilder AddHubTokenAuthenticationScheme(this AuthenticationBuilder builder, Action<HubTokenAuthenticationOptions> configureOptions)
    {
      return builder.AddScheme<HubTokenAuthenticationOptions, HubTokenAuthenticationHandler>(AuthenticationScheme, configureOptions);
    }
  }
}

结果

在客户端，我在浏览器的开发者控制台中看到以下错误：

• 发布https://localhost:44312/chatHub/negotiate?negotiateVersion=1 403
• 错误：无法完成与服务器的协商：错误
• 错误：无法启动连接：错误

在服务器端，我看到的是：

• SignalRChat.Security.HubTokenAuthenticationHandler：调试：AuthenticationScheme：HubTokenAuthentication 已成功通过身份验证。
• SignalRChat.Security.HubTokenAuthenticationHandler：信息：AuthenticationScheme：HubTokenAuthentication 被禁止。

下一步

我确实看到其他人遇到了 CORS 问题，导致他们无法安全工作，但我相信它通常在客户端错误中明确指出。尽管如此，我还是在 Startup.cs 中添加了 CORS 策略，我认为应该可以规避这一点。

我还尝试了更改启动中服务配置的顺序，但似乎没有任何帮助。

如果我删除授权属性（即有一个未经身份验证的集线器），一切都会正常。

最后，我发现服务器端消息非常有趣，因为身份验证成功，但请求仍然被禁止。

我不太确定从这里该去哪里。任何见解将不胜感激。

更新

我已经能够对此进行一些调试。

通过加载系统符号并向上移动调用堆栈，我找到了 Microsoft.AspNetCore.Authorization.Policy.PolicyEvaluator 的方法：

可以看到，认证成功了，但是授权显然没有成功。查看要求，有两个：DenyAnonymousAuthorizationRequirement 和我的 HubRequirement（自动成功）。

由于调试器从未命中 HubRequirement 类中的断点，因此我只能假设 DenyAnonymousAuthorizationRequirement 是失败的原因。有趣的是，因为根据github上的代码清单（https://github.com/dotnet/aspnetcore/blob/master/src/Security/Authorization/Core/src/DenyAnonymousAuthorizationRequirement.cs）我应该满足所有要求：

在上下文中定义了一个用户，该用户有一个身份，并且不存在未经身份验证的身份。

我一定错过了一些东西，因为这没有加起来。

Answer 1

事实证明，失败实际上发生在我的 HubRequirement 类中，而不是 DenyAnonymousAuthorizationRequirement 中。

虽然我的 HubRequirement 类实现了 HandleRequirementAsync()，但它没有实现 HandleAsync()，而这正是所调用的。

如果我将 HubRequirement 类更新为以下内容，一切都会按预期进行：

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.SignalR;
using System.Threading.Tasks;

namespace SignalRChat.Security
{
  public class HubRequirement : AuthorizationHandler<HubRequirement, HubInvocationContext>, IAuthorizationRequirement
  {
    public override Task HandleAsync(AuthorizationHandlerContext context)
    {
      foreach (var requirement in context.PendingRequirements)
      {
        // TODO: Validate each requirement
      }

      // Authorization logic goes here.  Just calling it a success for demo purposes.
      context.Succeed(this);
      return Task.CompletedTask;
    }

    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, HubRequirement requirement, HubInvocationContext resource)
    {
      // Authorization logic goes here.  Just calling it a success for demo purposes.
      context.Succeed(requirement);
      return Task.CompletedTask;
    }
  }
}