asp.net 默认授权（不带[Authorize]）

Question

我有一个 asp.netcore .net 5 应用程序。

我已获得使用[Authorize]控制器端点上方属性的授权。

如何使其在不使用[Authorize]属性的情况下使用授权？以下是我设置授权的方法：

我有这个ConfigureServices：

public void ConfigureServices(IServiceCollection services)
{...
        FirebaseApp.Create(new AppOptions()
        {
            Credential = GoogleCredential.FromFile("firebase_admin_sdk.json"),
        });

        services
        .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
        .AddJwtBearer(options =>
        {
            options.Authority = "https://securetoken.google.com/vepo-xxx";
            options.TokenValidationParameters = new TokenValidationParameters
            {
                ValidateIssuer = true,
                ValidIssuer = "https://securetoken.google.com/vepo-xxx",
                ValidateAudience = true,
                ValidAudience = "vepo-xxx",
                ValidateLifetime = true
            };
        });
...}

我有Configure：

public void Configure(IApplicationBuilder app, IWebHostEnvironment env, VepoContext context, ISearchIndexService searchIndexService)
{...
    app.UseAuthentication();
    app.UseAuthorization();
...}

Answer 1

请参阅需要经过身份验证的用户的文档。您可以将 a 添加RequireAuthenticatedUser()到所有控制器：

public void ConfigureServices(IServiceCollection services)
{

    ...

    services.AddControllers(config =>
    {
        // using Microsoft.AspNetCore.Mvc.Authorization;
        // using Microsoft.AspNetCore.Authorization;
        var policy = new AuthorizationPolicyBuilder()
                         .RequireAuthenticatedUser()
                         .Build();
        config.Filters.Add(new AuthorizeFilter(policy));
    });