Authorization的几种方式

- Policy
- Middleware
- Custom Attribute

源码来源：https://github.com/iamvoxer/jianshu_sample/tree/master
# Policy

1. 定义

```java
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Mvc.Controllers;
using Microsoft.AspNetCore.Mvc.Filters;
using Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Reflection;
using System.Threading.Tasks;

namespace PolicySample
{
	// 1. 定义一个IAuthorizationRequirement类来定义策略的要求
    public class AdultPolicyRequirement : IAuthorizationRequirement
    {
        public int Age { get; }
        public AdultPolicyRequirement(int age)
        {
            //年龄限制
            this.Age = age;
        }
    }
	// 2. 定义策略要求的Handler，当提供的Controller被请求时先根据请求的Http报文来决定是否可以通过验证
    public class AdultAuthorizationHandler : AuthorizationHandler<AdultPolicyRequirement>
    {
        protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, AdultPolicyRequirement requirement)
        {
            //获取当前http请求的context对象
            var mvcContext = context.Resource as AuthorizationFilterContext;
            //以下代码都不是必须的，只是展示一些使用方法，你可以选择使用

//设置httpcontext的一些key和value，用于在整个http请求过程中分享数据
            mvcContext.HttpContext.Items.Add("aaa", "bbb");

//判断当前http请求的controller对象是否是某个特定对象的子类
            var descriptor = mvcContext?.ActionDescriptor as ControllerActionDescriptor;
            if (descriptor != null)
            {
                TypeInfo typeinfo = descriptor.ControllerTypeInfo;
                bool issub = typeinfo.IsSubclassOf(typeof(Controller));
                var actionName = descriptor.ActionName;
                var ctrlName = descriptor.ControllerName;
            }

//token类型是bearer类型
            if (mvcContext.HttpContext.Request.Headers.ContainsKey("Authorization"))
            {
                var header = mvcContext.HttpContext.Request.Headers as FrameRequestHeaders;

var value = header.HeaderAuthorization.First<string>(v => v.ToLower().StartsWith("bearer "));

if (value == null)
                {
                    //dosomething
                }
                string _token = value.ToString().Substring(7);
            }
            //获取cookie
            var cookie = mvcContext.HttpContext.Request.Cookies["BAIDUD"];
            if (cookie == null)
            {
                //dosomething
            }

//从http的url参数获取一个值
            var value1 = mvcContext.HttpContext.Request.Query.FirstOrDefault(u => u.Key == "accesstoken");
            if (value1.Value.Count <= 0)
            {
                //dosomething
            }

//
            var age = mvcContext.HttpContext.Request.Query.FirstOrDefault(u => u.Key == "age");
            if (age.Value.Count <= 0|| Convert.ToInt16(age.Value[0]) < requirement.Age)
            { 
                context.Fail();
            }
            else
            {
                //通过验证，这句代码必须要有
                context.Succeed(requirement);
            }

return Task.CompletedTask;
        }
    }
}

```

2. 添加

```java
//添加二种认证策略，一种以12岁为界限，一种是18岁
services.AddAuthorization(options =>
{
    options.AddPolicy("Adult1", policy =>
        policy.Requirements.Add(new AdultPolicyRequirement(12)));
    options.AddPolicy("Adult2", policy =>
        policy.Requirements.Add(new AdultPolicyRequirement(18)));
});
//添加策略验证handler
services.AddSingleton<IAuthorizationHandler, AdultAuthorizationHandler>();
```

# 使用
```java
using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Authorization;

namespace PolicySample.Controllers
{
    [Route("api/[controller]")]
    public class ValuesController : Controller
    {
        // GET api/values
        [HttpGet]
        [Authorize("Adult1")]
        public IEnumerable<string> Get()
        {
            return new string[] { this.HttpContext.Items["aaa"].ToString(), "value2" };
        }

[Authorize("Adult2")]
        // GET api/values/5
        [HttpGet("{id}")]
        public string Get(int id)
        {
            return "value";
        }

// POST api/values
        [HttpPost]
        public void Post([FromBody]string value)
        {
        }

// PUT api/values/5
        [HttpPut("{id}")]
        public void Put(int id, [FromBody]string value)
        {
        }

// DELETE api/values/5
        [HttpDelete("{id}")]
        public void Delete(int id)
        {
        }
    }
}

```