Asp.net core MVC + HMAC 实现API请求认证，用户认证与授权，Web Token认证

// Startup.cs
public void ConfigureServices(IServiceCollection services)
{
    services.AddControllers();

    // Add HMAC authentication
    services.AddAuthentication(options =>
    {
        options.DefaultAuthenticateScheme = "HMAC";
        options.DefaultChallengeScheme = "HMAC";
    })
    .AddHMACAuthentication(options =>
    {
        options.SecretKey = "your_secret_key";
    });

    // Add JWT token authentication
    services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
        .AddJwtBearer(options =>
        {
            options.TokenValidationParameters = new TokenValidationParameters
            {
                ValidateIssuer = true,
                ValidateAudience = true,
                ValidateLifetime = true,
                ValidateIssuerSigningKey = true,
                ValidIssuer = "http://example.com",
                ValidAudience = "http://example.com",
                IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("your_jwt_secret_key"))
            };
        });

    // Add authorization
    services.AddAuthorization(options =>
    {
        options.AddPolicy("AdminOnly", policy => policy.RequireRole("Admin"));
    });
}

// Controllers/AccountController.cs
[Route("api/[controller]")]
[ApiController]
public class AccountController : ControllerBase
{
    [HttpPost("login")]
    public IActionResult Login(LoginModel model)
    {
        // Authenticate user and generate JWT token
        var token = GenerateJwtToken(model.Username, model.Password);
        return Ok(new { token });
    }

    private string GenerateJwtToken(string username, string password)
    {
        // Implement user authentication logic here
        // and generate a JWT token
        var claims = new[]
        {
            new Claim(ClaimTypes.Name, username),
            new Claim(ClaimTypes.Role, "Admin")
        };

        var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("your_jwt_secret_key"));
        var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);

        var token = new JwtSecurityToken(
            issuer: "http://example.com",
            audience: "http://example.com",
            claims: claims,
            expires: DateTime.Now.AddMinutes(30),
            signingCredentials: creds);

        return new JwtSecurityTokenHandler().WriteToken(token);
    }
}

// Controllers/PingController.cs
[Route("api/[controller]")]
[ApiController]
public class PingController : ControllerBase
{
    [HttpGet]
    [Authorize]
    public IActionResult Get()
    {
        return Ok("Pong!");
    }

    [HttpGet("admin")]
    [Authorize(Policy = "AdminOnly")]
    public IActionResult GetAdmin()
    {
        return Ok("Admin Pong!");
    }
}

这个示例演示了如何在 ASP.NET Core MVC 应用程序中实现以下安全功能:

1. HMAC 认证: 客户端使用 HMAC 签名的 API 请求,服务端验证签名。
2. JWT 认证: 用户登录后,服务端生成 JWT token 并返回给客户端,客户端在后续请求中携带 token。
3. 基于角色的授权: 使用 Authorize 和 AuthorizePolicy 特性控制对特定操作的访问权限。

客户端在登录时获取 JWT token,并在后续的 API 请求中携带 token。对于需要管理员权限的操作,客户端需要在请求头中包含有效的 HMAC 签名。

该示例涵盖了 API 安全的核心要素,可以作为一个良好的起点,根据具体需求进行进一步扩展和定制。

// login.component.ts
import { Component } from '@angular/core';
import { HttpClient } from '@angular/common/http';
import { Router } from '@angular/router';

@Component({
  selector: 'app-login',
  template: `
    <form (ngSubmit)="onSubmit()">
      <label>
        Username:
        <input type="text" [(ngModel)]="username" name="username">
      </label>
      <label>
        Password:
        <input type="password" [(ngModel)]="password" name="password">
      </label>
      <button type="submit">Login</button>
    </form>
  `
})
export class LoginComponent {
  username: string;
  password: string;

  constructor(private http: HttpClient, private router: Router) {}

  onSubmit() {
    this.http.post('/api/account/login', { username: this.username, password: this.password })
      .subscribe((response: any) => {
        localStorage.setItem('token', response.token);
        this.router.navigate(['/']);
      });
  }
}

// app.component.ts
import { Component } from '@angular/core';
import { HttpClient, HttpHeaders } from '@angular/common/http';

@Component({
  selector: 'app-root',
  template: `
    <button (click)="pingPublic()">Ping Public</button>
    <button (click)="pingAdmin()">Ping Admin</button>
  `
})
export class AppComponent {
  constructor(private http: HttpClient) {}

  pingPublic() {
    this.http.get('/api/ping').subscribe(
      (response) => console.log(response),
      (error) => console.error(error)
    );
  }

  pingAdmin() {
    const token = localStorage.getItem('token');
    const headers = new HttpHeaders().set('Authorization', `Bearer ${token}`);

    this.http.get('/api/ping/admin', { headers }).subscribe(
      (response) => console.log(response),
      (error) => console.error(error)
    );
  }
}

这个示例包含了前端的两个组件:

1. LoginComponent: 显示登录表单,当用户提交表单时,向后端的 /api/account/login 端点发送 POST 请求,并将返回的 JWT token 保存到 localStorage。
2. AppComponent: 显示两个按钮,分别调用公开的 /api/ping 端点和需要管理员权限的 /api/ping/admin 端点。对于需要认证的请求,会从 localStorage 中读取 JWT token,并将其添加到请求头中。

这个前端示例与之前的后端示例相呼应,演示了如何在 Angular 应用程序中实现 HMAC 认证和 JWT 认证,以及基于角色的授权。

客户端首先通过登录获取 JWT token,然后在后续的 API 请求中携带该 token。对于需要管理员权限的操作,客户端需要在请求头中包含有效的 HMAC 签名。