Asp.Net Core AuthorizeAttribute 和AuthorizeFilter 跟进及源码解读

一、前言

IdentityServer4

已经分享了一些应用实战的文章，从架构到授权中心的落地应用，也伴随着对

IdentityServer4

掌握了一些使用规则，但是很多原理性东西还是一知半解，故我这里持续性来带大家一起来解读它的相关源代码，本文先来看看为什么

Controller

或者

Action

中添加

Authorize

或者全局中添加

AuthorizeFilter

过滤器就可以实现该资源受到保护，需要通过

access_token

才能通过相关的授权呢？今天我带大家来了解

AuthorizeAttribute

和

AuthorizeFilter

的关系及代码解读。

二、代码解读

解读之前我们先来看看下面两种标注授权方式的代码：

标注方式

[Authorize]
[HttpGet]
public async Task<object> Get()
{
var userId = User.UserId();
return new
{
name = User.Name(),
userId = userId,
displayName = User.DisplayName(),
merchantId = User.MerchantId(),
};
}

代码中通过

[Authorize]

标注来限制该api资源的访问

全局方式

public void ConfigureServices(IServiceCollection services)
{
//全局添加AuthorizeFilter 过滤器方式
services.AddControllers(options=>options.Filters.Add(new AuthorizeFilter()));

services.AddAuthorization();
services.AddAuthentication("Bearer")
.AddIdentityServerAuthentication(options =>
{
options.Authority = "http://localhost:5000";    //配置Identityserver的授权地址
options.RequireHttpsMetadata = false;           //不需要https
options.ApiName = OAuthConfig.UserApi.ApiName;  //api的name，需要和config的名称相同
});
}

全局通过添加

AuthorizeFilter

过滤器方式进行全局api资源的限制

AuthorizeAttribute

先来看看

AuthorizeAttribute

源代码：

[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = true, Inherited = true)]
public class AuthorizeAttribute : Attribute, IAuthorizeData
{
/// <summary>
/// Initializes a new instance of the <see cref="AuthorizeAttribute"/> class.
/// </summary>
public AuthorizeAttribute() { }

/// <summary>
/// Initializes a new instance of the <see cref="AuthorizeAttribute"/> class with the specified policy.
/// </summary>
/// <param name="policy">The name of the policy to require for authorization.</param>
public AuthorizeAttribute(string policy)
{
Policy = policy;
}

/// <summary>
/// 收取策略
/// </summary>
public string Policy { get; set; }

/// <summary>
/// 授权角色
/// </summary>
public string Roles { get; set; }

/// <summary>
/// 授权Schemes
/// </summary>
public string AuthenticationSchemes { get; set; }
}

代码中可以看到

AuthorizeAttribute

继承了

IAuthorizeData

抽象接口，该接口主要是授权数据的约束定义，定义了三个数据属性

• Prolicy ：授权策略
• Roles : 授权角色
• AuthenticationSchemes ：授权Schemes 的支持
  Asp.Net Core 中的http中间件会根据

  IAuthorizeData

  这个来获取有哪些授权过滤器，来实现过滤器的拦截并执行相关代码。
  我们看看

  AuthorizeAttribute

  代码如下：

public interface IAuthorizeData
{
/// <summary>
/// Gets or sets the policy name that determines access to the resource.
/// </summary>
string Policy { get; set; }

/// <summary>
/// Gets or sets a comma delimited list of roles that are allowed to access the resource.
/// </summary>
string Roles { get; set; }

/// <summary>
/// Gets or sets a comma delimited list of schemes from which user information is constructed.
/// </summary>
string AuthenticationSchemes { get; set; }
}

我们再来看看

授权中间件

（

UseAuthorization

）的核心代码：

public static IApplicationBuilder UseAuthorization(this IApplicationBuilder app)
{
if (app == null)
{
throw new ArgumentNullException(nameof(app));
}

VerifyServicesRegistered(app);

return app.UseMiddleware<AuthorizationMiddleware>();
}

代码中注册了

AuthorizationMiddleware

这个中间件，

AuthorizationMiddleware

中间件源代码如下：

public class AuthorizationMiddleware
{
// Property key is used by Endpoint routing to determine if Authorization has run
private const string AuthorizationMiddlewareInvokedWithEndpointKey = "__AuthorizationMiddlewareWithEndpointInvoked";
private static readonly object AuthorizationMiddlewareWithEndpointInvokedValue = new object();

private readonly RequestDelegate _next;
private readonly IAuthorizationPolicyProvider _policyProvider;

public AuthorizationMiddleware(RequestDelegate next, IAuthorizationPolicyProvider policyProvider)
{
_next = next ?? throw new ArgumentNullException(nameof(next));
_policyProvider = policyProvider ?? throw new ArgumentNullException(nameof(policyProvider));
}

public async Task Invoke(HttpContext context)
{
if (context == null)
{
throw new ArgumentNullException(nameof(context));
}

var endpoint = context.GetEndpoint();

if (endpoint != null)
{
// EndpointRoutingMiddleware uses this flag to check if the Authorization middleware processed auth metadata on the endpoint.
// The Authorization middleware can only make this claim if it observes an actual endpoint.
context.Items[AuthorizationMiddlewareInvokedWithEndpointKey] = AuthorizationMiddlewareWithEndpointInvokedValue;
}

// 通过终结点路由元素IAuthorizeData来获得对于的AuthorizeAttribute并关联到AuthorizeFilter中
var authorizeData = endpoint?.Metadata.GetOrderedMetadata<IAuthorizeData>() ?? Array.Empty<IAuthorizeData>();
var policy = await AuthorizationPolicy.CombineAsync(_policyProvider, authorizeData);
if (policy == null)
{
await _next(context);
return;
}

// Policy evaluator has transient lifetime so it fetched from request services instead of injecting in constructor
var policyEvaluator = context.RequestServices.GetRequiredService<IPolicyEvaluator>();

var authenticateResult = await policyEvaluator.AuthenticateAsync(policy, context);

// Allow Anonymous skips all authorization
if (endpoint?.Metadata.GetMetadata<IAllowAnonymous>() != null)
{
await _next(context);
return;
}

// Note that the resource will be null if there is no matched endpoint
var authorizeResult = await policyEvaluator.AuthorizeAsync(policy, authenticateResult, context, resource: endpoint);

if (authorizeResult.Challenged)
{
if (policy.AuthenticationSchemes.Any())
{
foreach (var scheme in policy.AuthenticationSchemes)
{
await context.ChallengeAsync(scheme);
}
}
else
{
await context.ChallengeAsync();
}

return;
}
else if (authorizeResult.Forbidden)
{
if (policy.AuthenticationSchemes.Any())
{
foreach (var scheme in policy.AuthenticationSchemes)
{
await context.ForbidAsync(scheme);
}
}
else
{
await context.ForbidAsync();
}

return;
}

await _next(context);
}
}

代码中核心拦截并获得

AuthorizeFilter

过滤器的代码

var authorizeData = endpoint?.Metadata.GetOrderedMetadata<IAuthorizeData>() ?? Array.Empty<IAuthorizeData>();

前面我分享过一篇关于 Asp.Net Core EndPoint 终结点路由工作原理解读 的文章里面讲解到通过

EndPoint

终结点路由来获取

Controller

和

Action

中的

Attribute

特性标注，这里也是通过该方法来拦截获取对于的

AuthorizeAttribute

的.
而获取到相关

authorizeData

授权数据后，下面的一系列代码都是通过判断来进行

AuthorizeAsync

授权执行的方法,这里就不详细分享它的授权认证的过程了。
细心的同学应该已经发现上面的代码有一个比较特殊的代码：

if (endpoint?.Metadata.GetMetadata<IAllowAnonymous>() != null)
{
await _next(context);
return;
}

代码中通过

endpoint

终结点路由来获取是否标注有

AllowAnonymous

的特性，如果有则直接执行下一个中间件，不进行下面的

AuthorizeAsync

授权认证方法，
这也是为什么

Controller

和

Action

上标注

AllowAnonymous

可以跳过

授权认证

的原因了。

AuthorizeFilter 源码

有的人会问

AuthorizeAttirbute

和

AuthorizeFilter

有什么关系呢？它们是一个东西吗？
我们再来看看

AuthorizeFilter

源代码，代码如下：

public class AuthorizeFilter : IAsyncAuthorizationFilter, IFilterFactory
{
/// <summary>
/// Initializes a new <see cref="AuthorizeFilter"/> instance.
/// </summary>
public AuthorizeFilter()
: this(authorizeData: new[] { new AuthorizeAttribute() })
{
}

/// <summary>
/// Initialize a new <see cref="AuthorizeFilter"/> instance.
/// </summary>
/// <param name="policy">Authorization policy to be used.</param>
public AuthorizeFilter(AuthorizationPolicy policy)
{
if (policy == null)
{
throw new ArgumentNullException(nameof(policy));
}

Policy = policy;
}

/// <summary>
/// Initialize a new <see cref="AuthorizeFilter"/> instance.
/// </summary>
/// <param name="policyProvider">The <see cref="IAuthorizationPolicyProvider"/> to use to resolve policy names.</param>
/// <param name="authorizeData">The <see cref="IAuthorizeData"/> to combine into an <see cref="IAuthorizeData"/>.</param>
public AuthorizeFilter(IAuthorizationPolicyProvider policyProvider, IEnumerable<IAuthorizeData> authorizeData)
: this(authorizeData)
{
if (policyProvider == null)
{
throw new ArgumentNullException(nameof(policyProvider));
}

PolicyProvider = policyProvider;
}

/// <summary>
/// Initializes a new instance of <see cref="AuthorizeFilter"/>.
/// </summary>
/// <param name="authorizeData">The <see cref="IAuthorizeData"/> to combine into an <see cref="IAuthorizeData"/>.</param>
public AuthorizeFilter(IEnumerable<IAuthorizeData> authorizeData)
{
if (authorizeData == null)
{
throw new ArgumentNullException(nameof(authorizeData));
}

AuthorizeData = authorizeData;
}

/// <summary>
/// Initializes a new instance of <see cref="AuthorizeFilter"/>.
/// </summary>
/// <param name="policy">The name of the policy to require for authorization.</param>
public AuthorizeFilter(string policy)
: this(new[] { new AuthorizeAttribute(policy) })
{
}

/// <summary>
/// The <see cref="IAuthorizationPolicyProvider"/> to use to resolve policy names.
/// </summary>
public IAuthorizationPolicyProvider PolicyProvider { get; }

/// <summary>
/// The <see cref="IAuthorizeData"/> to combine into an <see cref="IAuthorizeData"/>.
/// </summary>
public IEnumerable<IAuthorizeData> AuthorizeData { get; }

/// <summary>
/// Gets the authorization policy to be used.
/// </summary>
/// <remarks>
/// If<c>null</c>, the policy will be constructed using
/// <see cref="AuthorizationPolicy.CombineAsync(IAuthorizationPolicyProvider, IEnumerable{IAuthorizeData})"/>.
/// </remarks>
public AuthorizationPolicy Policy { get; }

bool IFilterFactory.IsReusable => true;

// Computes the actual policy for this filter using either Policy or PolicyProvider + AuthorizeData
private Task<AuthorizationPolicy> ComputePolicyAsync()
{
if (Policy != null)
{
return Task.FromResult(Policy);
}

if (PolicyProvider == null)
{
throw new InvalidOperationException(
Resources.FormatAuthorizeFilter_AuthorizationPolicyCannotBeCreated(
nameof(AuthorizationPolicy),
nameof(IAuthorizationPolicyProvider)));
}

return AuthorizationPolicy.CombineAsync(PolicyProvider, AuthorizeData);
}

internal async Task<AuthorizationPolicy> GetEffectivePolicyAsync(AuthorizationFilterContext context)
{
// Combine all authorize filters into single effective policy that's only run on the closest filter
var builder = new AuthorizationPolicyBuilder(await ComputePolicyAsync());
for (var i = 0; i < context.Filters.Count; i++)
{
if (ReferenceEquals(this, context.Filters[i]))
{
continue;
}

if (context.Filters[i] is AuthorizeFilter authorizeFilter)
{
// Combine using the explicit policy, or the dynamic policy provider
builder.Combine(await authorizeFilter.ComputePolicyAsync());
}
}

var endpoint = context.HttpContext.GetEndpoint();
if (endpoint != null)
{
// When doing endpoint routing, MVC does not create filters for any authorization specific metadata i.e [Authorize] does not
// get translated into AuthorizeFilter. Consequently, there are some rough edges when an application uses a mix of AuthorizeFilter
// explicilty configured by the user (e.g. global auth filter), and uses endpoint metadata.
// To keep the behavior of AuthFilter identical to pre-endpoint routing, we will gather auth data from endpoint metadata
// and produce a policy using this. This would mean we would have effectively run some auth twice, but it maintains compat.
var policyProvider = PolicyProvider ?? context.HttpContext.RequestServices.GetRequiredService<IAuthorizationPolicyProvider>();
var endpointAuthorizeData = endpoint.Metadata.GetOrderedMetadata<IAuthorizeData>() ?? Array.Empty<IAuthorizeData>();

var endpointPolicy = await AuthorizationPolicy.CombineAsync(policyProvider, endpointAuthorizeData);
if (endpointPolicy != null)
{
builder.Combine(endpointPolicy);
}
}

return builder.Build();
}

/// <inheritdoc />
public virtual async Task OnAuthorizationAsync(AuthorizationFilterContext context)
{
if (context == null)
{
throw new ArgumentNullException(nameof(context));
}

if (!context.IsEffectivePolicy(this))
{
return;
}

// IMPORTANT: Changes to authorization logic should be mirrored in security's AuthorizationMiddleware
var effectivePolicy = await GetEffectivePolicyAsync(context);
if (effectivePolicy == null)
{
return;
}

var policyEvaluator = context.HttpContext.RequestServices.GetRequiredService<IPolicyEvaluator>();

var authenticateResult = await policyEvaluator.AuthenticateAsync(effectivePolicy, context.HttpContext);

// Allow Anonymous skips all authorization
if (HasAllowAnonymous(context))
{
return;
}

var authorizeResult = await policyEvaluator.AuthorizeAsync(effectivePolicy, authenticateResult, context.HttpContext, context);

if (authorizeResult.Challenged)
{
context.Result = new ChallengeResult(effectivePolicy.AuthenticationSchemes.ToArray());
}
else if (authorizeResult.Forbidden)
{
context.Result = new ForbidResult(effectivePolicy.AuthenticationSchemes.ToArray());
}
}

IFilterMetadata IFilterFactory.CreateInstance(IServiceProvider serviceProvider)
{
if (Policy != null || PolicyProvider != null)
{
// The filter is fully constructed. Use the current instance to authorize.
return this;
}

Debug.Assert(AuthorizeData != null);
var policyProvider = serviceProvider.GetRequiredService<IAuthorizationPolicyProvider>();
return AuthorizationApplicationModelProvider.GetFilter(policyProvider, AuthorizeData);
}

private static bool HasAllowAnonymous(AuthorizationFilterContext context)
{
var filters = context.Filters;
for (var i = 0; i < filters.Count; i++)
{
if (filters[i] is IAllowAnonymousFilter)
{
return true;
}
}

// When doing endpoint routing, MVC does not add AllowAnonymousFilters for AllowAnonymousAttributes that
// were discovered on controllers and actions. To maintain compat with 2.x,
// we'll check for the presence of IAllowAnonymous in endpoint metadata.
var endpoint = context.HttpContext.GetEndpoint();
if (endpoint?.Metadata?.GetMetadata<IAllowAnonymous>() != null)
{
return true;
}

return false;
}
}

代码中继承了

IAsyncAuthorizationFilter

,

IFilterFactory

两个抽象接口，分别来看看这两个抽象接口的源代码

IAsyncAuthorizationFilter

源代码如下：

/// <summary>
/// A filter that asynchronously confirms request authorization.
/// </summary>
public interface IAsyncAuthorizationFilter : IFilterMetadata
{
///定义了授权的方法
Task OnAuthorizationAsync(AuthorizationFilterContext context);
}

IAsyncAuthorizationFilter

代码中继承了

IFilterMetadata

接口，同时定义了

OnAuthorizationAsync

抽象方法,子类需要实现该方法，然而

AuthorizeFilter

中也已经实现了该方法，稍后再来详细讲解该方法，我们再继续看看

IFilterFactory

抽象接口,代码如下：

public interface IFilterFactory : IFilterMetadata
{

bool IsReusable { get; }

//创建IFilterMetadata 对象方法
IFilterMetadata CreateInstance(IServiceProvider serviceProvider);
}

我们回到

AuthorizeFilter

源代码中，该源代码中提供了四个构造初始化方法同时包含了

AuthorizeData

、

Policy

属性，我们看看它的默认构造方法代码

public class AuthorizeFilter : IAsyncAuthorizationFilter, IFilterFactory
{
public IEnumerable<IAuthorizeData> AuthorizeData { get; }

//默认构造函数中默认创建了AuthorizeAttribute 对象
public AuthorizeFilter()
: this(authorizeData: new[] { new AuthorizeAttribute() })
{
}

//赋值AuthorizeData
public AuthorizeFilter(IEnumerable<IAuthorizeData> authorizeData)
{
if (authorizeData == null)
{
throw new ArgumentNullException(nameof(authorizeData));
}

AuthorizeData = authorizeData;
}
}

上面的代码中默认的构造函数默认给构建了一个

AuthorizeAttribute

对象，并且赋值给了

IEnumerable<IAuthorizeData>

的集合属性;
好了，看到这里

AuthorizeFilter

过滤器也是默认构造了一个

AuthorizeAttribute

的对象，也就是构造了授权所需要的

IAuthorizeData

信息.
同时

AuthorizeFilter

实现的

OnAuthorizationAsync

方法中通过

GetEffectivePolicyAsync

这个方法获得有效的授权策略，并且进行下面的授权

AuthenticateAsync

的执行

AuthorizeFilter

代码中提供了

HasAllowAnonymous

方法来实现是否

Controller

或者

Action

上标注了

AllowAnonymous

特性，用于跳过授权

HasAllowAnonymous

代码如下：

private static bool HasAllowAnonymous(AuthorizationFilterContext context)
{
var filters = context.Filters;
for (var i = 0; i < filters.Count; i++)
{
if (filters[i] is IAllowAnonymousFilter)
{
return true;
}
}
//同样通过上下文的endpoint 来获取是否标注了AllowAnonymous特性
var endpoint = context.HttpContext.GetEndpoint();
if (endpoint?.Metadata?.GetMetadata<IAllowAnonymous>() != null)
{
return true;
}

return false;
}

到这里我们再回到全局添加过滤器的方式代码：

services.AddControllers(options=>options.Filters.Add(new AuthorizeFilter()));

分析到这里 ，我很是好奇，它是怎么全局添加进去的呢？我打开源代码看了下，源代码如下：

public class MvcOptions : IEnumerable<ICompatibilitySwitch>
{

public MvcOptions()
{
CacheProfiles = new Dictionary<string, CacheProfile>(StringComparer.OrdinalIgnoreCase);
Conventions = new List<IApplicationModelConvention>();
Filters = new FilterCollection();
FormatterMappings = new FormatterMappings();
InputFormatters = new FormatterCollection<IInputFormatter>();
OutputFormatters = new FormatterCollection<IOutputFormatter>();
ModelBinderProviders = new List<IModelBinderProvider>();
ModelBindingMessageProvider = new DefaultModelBindingMessageProvider();
ModelMetadataDetailsProviders = new List<IMetadataDetailsProvider>();
ModelValidatorProviders = new List<IModelValidatorProvider>();
ValueProviderFactories = new List<IValueProviderFactory>();
}

//过滤器集合
public FilterCollection Filters { get; }
}

FilterCollection

相关核心代码如下：

public class FilterCollection : Collection<IFilterMetadata>
{

public IFilterMetadata Add<TFilterType>() where TFilterType : IFilterMetadata
{
return Add(typeof(TFilterType));
}

//其他核心代码为贴出来
}

代码中提供了

Add

方法，约束了

IFilterMetadata

类型的对象，这也是上面的过滤器中为什么都继承了

IFilterMetadata

的原因。
到这里代码解读和实现原理已经分析完了，如果有分析不到位之处还请多多指教！！！

结论：授权中间件通过获取

IAuthorizeData

来获取

AuthorizeAttribute

对象相关的授权信息，并构造

授权策略

对象进行授权认证的，而

AuthorizeFilter

过滤器也会默认添加

AuthorizeAttribute

的授权相关数据

IAuthorizeData

并实现

OnAuthorizationAsync

方法，同时中间件中通过授权策略提供者

IAuthorizationPolicyProvider

来获得对于的授权策略进行授权认证.