相关疑难解决方法(0)

将HttpContext实例存储在中间件中是否安全？

例:

public class TestMiddleware
{        
    private readonly RequestDelegate next;    
    private HttpContext context;
    public TestMiddleware(RequestDelegate next)
    {
        this.next = next;
    }

    public async Task Invoke(HttpContext context)        
    {
        try
        {
            this.context = context;

我想在其他私有方法中使用它来处理它,所以我可以将它作为参数传递给那些函数或使用它,如示例中所示.

但它是否安全？

ASP.Net Core noob here ...我正在使用DNX的Net.Net核心WebAPI核心项目.

我需要在我们的服务中实现API Key auth.为此,我创建了中间件,从请求中获取信息并继续进行身份验证.支持转到数据库,获取匹配的密钥,然后返回并进行验证.

这是为了查看上下文并获取APIKey而实现的中间件

的AuthenticationHandler

public class AuthorizationHandler
{
    private readonly RequestDelegate _next;
    private IAuthenticationService _authenticationService;

    public AuthorizationHandler(RequestDelegate next, IAuthenticationService authService)
    {
        _authenticationService = authService;
        _next = next;
    }

    public async Task Invoke(HttpContext context)
    {
        try
        {
            var apiKey = context.Request.Headers["Key"];
            var location = context.Request.Headers["Host"];
            var locationKey = _authenticationService.GetApiKey(location);

            if (apiKey == locationKey)
                await _next(context);


            context.Response.StatusCode = 403;
            context.Response.Headers.Add("WWW-Authenticate",
                new[] { "Basic" });

        }
        catch (Exception ex)
        {
            context.Response.StatusCode = 500;
            context.Response.Headers.Add("WWW-Authenticate",
                new[] { "Basic" …