Asp.Net Core AuthorizeAttribute 和AuthorizeFilter 跟进及源码解读

一、前言

IdentityServer4 已经分享了一些应用实战的文章，从架构到授权中心的落地应用，也伴随着对 IdentityServer4 掌握了一些使用规则，但是很多原理性东西还是一知半解，故我这里持续性来带大家一起来解读它的相关源代码，本文先来看看为什么 Controller 或者 Action 中添加 Authorize 或者全局中添加 AuthorizeFilter 过滤器就可以实现该资源受到保护，需要通过 access_token 才能通过相关的授权呢？今天我带大家来了解 AuthorizeAttribute 和 AuthorizeFilter 的关系及代码解读。

二、代码解读

解读之前我们先来看看下面两种标注授权方式的代码：

标注方式

 [Authorize]
 [HttpGet]
 public async Task<object> Get()
      var userId = User.UserId();
      return new
         name = User.Name(),
         userId = userId,
         displayName = User.DisplayName(),
         merchantId = User.MerchantId(),

代码中通过 [Authorize] 标注来限制该api资源的访问

全局方式

public void ConfigureServices(IServiceCollection services)
     //全局添加AuthorizeFilter 过滤器方式
     services.AddControllers(options=>options.Filters.Add(new AuthorizeFilter()));
     services.AddAuthorization();
     services.AddAuthentication("Bearer")
         .AddIdentityServerAuthentication(options =>
             options.Authority = "http://localhost:5000";    //配置Identityserver的授权地址
             options.RequireHttpsMetadata = false;           //不需要https
             options.ApiName = OAuthConfig.UserApi.ApiName;  //api的name，需要和config的名称相同

全局通过添加 AuthorizeFilter 过滤器方式进行全局api资源的限制

AuthorizeAttribute

先来看看 AuthorizeAttribute 源代码：

[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = true, Inherited = true)]
public class AuthorizeAttribute : Attribute, IAuthorizeData
    /// <summary>
    /// Initializes a new instance of the <see cref="AuthorizeAttribute"/> class.
    /// </summary>
    public AuthorizeAttribute() { }
    /// <summary>
    /// Initializes a new instance of the <see cref="AuthorizeAttribute"/> class with the specified policy.
    /// </summary>
    /// <param name="policy">The name of the policy to require for authorization.</param>
    public AuthorizeAttribute(string policy)
       Policy = policy;
    /// <summary>
    /// 收取策略
    /// </summary>
    public string Policy { get; set; }
    /// <summary>
    /// 授权角色
    /// </summary>
    public string Roles { get; set; }
    /// <summary>
    /// 授权Schemes
    /// </summary>
    public string AuthenticationSchemes { get; set; }

代码中可以看到 AuthorizeAttribute 继承了 IAuthorizeData 抽象接口，该接口主要是授权数据的约束定义，定义了三个数据属性

• Prolicy ：授权策略
• Roles : 授权角色
• AuthenticationSchemes ：授权Schemes 的支持 Asp.Net Core 中的http中间件会根据 IAuthorizeData 这个来获取有哪些授权过滤器，来实现过滤器的拦截并执行相关代码。我们看看 AuthorizeAttribute 代码如下：

public interface IAuthorizeData
        /// <summary>
        /// Gets or sets the policy name that determines access to the resource.
        /// </summary>
        string Policy { get; set; }
        /// <summary>
        /// Gets or sets a comma delimited list of roles that are allowed to access the resource.
        /// </summary>
        string Roles { get; set; }
        /// <summary>
        /// Gets or sets a comma delimited list of schemes from which user information is constructed.
        /// </summary>
        string AuthenticationSchemes { get; set; }

我们再来看看 授权中间件 （ UseAuthorization ）的核心代码：

public static IApplicationBuilder UseAuthorization(this IApplicationBuilder app)
    if (app == null)
        throw new ArgumentNullException(nameof(app));
    VerifyServicesRegistered(app);
    return app.UseMiddleware<AuthorizationMiddleware>();

代码中注册了 AuthorizationMiddleware 这个中间件， AuthorizationMiddleware 中间件源代码如下：

 public class AuthorizationMiddleware
        // Property key is used by Endpoint routing to determine if Authorization has run
        private const string AuthorizationMiddlewareInvokedWithEndpointKey = "__AuthorizationMiddlewareWithEndpointInvoked";
        private static readonly object AuthorizationMiddlewareWithEndpointInvokedValue = new object();
        private readonly RequestDelegate _next;
        private readonly IAuthorizationPolicyProvider _policyProvider;
        public AuthorizationMiddleware(RequestDelegate next, IAuthorizationPolicyProvider policyProvider)
            _next = next ?? throw new ArgumentNullException(nameof(next));
            _policyProvider = policyProvider ?? throw new ArgumentNullException(nameof(policyProvider));
        public async Task Invoke(HttpContext context)
            if (context == null)
                throw new ArgumentNullException(nameof(context));
            var endpoint = context.GetEndpoint();
            if (endpoint != null)
                // EndpointRoutingMiddleware uses this flag to check if the Authorization middleware processed auth metadata on the endpoint.
                // The Authorization middleware can only make this claim if it observes an actual endpoint.
                context.Items[AuthorizationMiddlewareInvokedWithEndpointKey] = AuthorizationMiddlewareWithEndpointInvokedValue;
            // 通过终结点路由元素IAuthorizeData来获得对于的AuthorizeAttribute并关联到AuthorizeFilter中
            var authorizeData = endpoint?.Metadata.GetOrderedMetadata<IAuthorizeData>() ?? Array.Empty<IAuthorizeData>();
            var policy = await AuthorizationPolicy.CombineAsync(_policyProvider, authorizeData);
            if (policy == null)
                await _next(context);
                return;
            // Policy evaluator has transient lifetime so it fetched from request services instead of injecting in constructor
            var policyEvaluator = context.RequestServices.GetRequiredService<IPolicyEvaluator>();
            var authenticateResult = await policyEvaluator.AuthenticateAsync(policy, context);
            // Allow Anonymous skips all authorization
            if (endpoint?.Metadata.GetMetadata<IAllowAnonymous>() != null)
                await _next(context);
                return;
            // Note that the resource will be null if there is no matched endpoint
            var authorizeResult = await policyEvaluator.AuthorizeAsync(policy, authenticateResult, context, resource: endpoint);
            if (authorizeResult.Challenged)
                if (policy.AuthenticationSchemes.Any())
                    foreach (var scheme in policy.AuthenticationSchemes)
                        await context.ChallengeAsync(scheme);
                    await context.ChallengeAsync();
                return;
            else if (authorizeResult.Forbidden)
                if (policy.AuthenticationSchemes.Any())
                    foreach (var scheme in policy.AuthenticationSchemes)
                        await context.ForbidAsync(scheme);
                    await context.ForbidAsync();
                return;
            await _next(context);

代码中核心拦截并获得 AuthorizeFilter 过滤器的代码

var authorizeData = endpoint?.Metadata.GetOrderedMetadata<IAuthorizeData>() ?? Array.Empty<IAuthorizeData>();

前面我分享过一篇关于 Asp.Net Core EndPoint 终结点路由工作原理解读 的文章里面讲解到通过 EndPoint 终结点路由来获取 Controller 和 Action 中的 Attribute 特性标注，这里也是通过该方法来拦截获取对于的 AuthorizeAttribute 的. 而获取到相关 authorizeData 授权数据后，下面的一系列代码都是通过判断来进行 AuthorizeAsync 授权执行的方法,这里就不详细分享它的授权认证的过程了。细心的同学应该已经发现上面的代码有一个比较特殊的代码：

if (endpoint?.Metadata.GetMetadata<IAllowAnonymous>() != null)
      await _next(context);
      return;

代码中通过 endpoint 终结点路由来获取是否标注有 AllowAnonymous 的特性，如果有则直接执行下一个中间件，不进行下面的 AuthorizeAsync 授权认证方法， 这也是为什么 Controller 和 Action 上标注 AllowAnonymous 可以跳过 授权认证 的原因了。

AuthorizeFilter 源码

有的人会问 AuthorizeAttirbute 和 AuthorizeFilter 有什么关系呢？它们是一个东西吗？我们再来看看 AuthorizeFilter 源代码，代码如下：

public class AuthorizeFilter : IAsyncAuthorizationFilter, IFilterFactory
        /// <summary>
        /// Initializes a new <see cref="AuthorizeFilter"/> instance.
        /// </summary>
        public AuthorizeFilter()
            : this(authorizeData: new[] { new AuthorizeAttribute() })
        /// <summary>
        /// Initialize a new <see cref="AuthorizeFilter"/> instance.
        /// </summary>
        /// <param name="policy">Authorization policy to be used.</param>
        public AuthorizeFilter(AuthorizationPolicy policy)
            if (policy == null)
                throw new ArgumentNullException(nameof(policy));
            Policy = policy;
        /// <summary>
        /// Initialize a new <see cref="AuthorizeFilter"/> instance.
        /// </summary>
        /// <param name="policyProvider">The <see cref="IAuthorizationPolicyProvider"/> to use to resolve policy names.</param>
        /// <param name="authorizeData">The <see cref="IAuthorizeData"/> to combine into an <see cref="IAuthorizeData"/>.</param>
        public AuthorizeFilter(IAuthorizationPolicyProvider policyProvider, IEnumerable<IAuthorizeData> authorizeData)
            : this(authorizeData)
            if (policyProvider == null)
                throw new ArgumentNullException(nameof(policyProvider));
            PolicyProvider = policyProvider;
        /// <summary>
        /// Initializes a new instance of <see cref="AuthorizeFilter"/>.
        /// </summary>
        /// <param name="authorizeData">The <see cref="IAuthorizeData"/> to combine into an <see cref="IAuthorizeData"/>.</param>
        public AuthorizeFilter(IEnumerable<IAuthorizeData> authorizeData)
            if (authorizeData == null)
                throw new ArgumentNullException(nameof(authorizeData));
            AuthorizeData = authorizeData;
        /// <summary>
        /// Initializes a new instance of <see cref="AuthorizeFilter"/>.
        /// </summary>
        /// <param name="policy">The name of the policy to require for authorization.</param>
        public AuthorizeFilter(string policy)
            : this(new[] { new AuthorizeAttribute(policy) })
        /// <summary>
        /// The <see cref="IAuthorizationPolicyProvider"/> to use to resolve policy names.
        /// </summary>
        public IAuthorizationPolicyProvider PolicyProvider { get; }
        /// <summary>
        /// The <see cref="IAuthorizeData"/> to combine into an <see cref="IAuthorizeData"/>.
        /// </summary>
        public IEnumerable<IAuthorizeData> AuthorizeData { get; }
        /// <summary>
        /// Gets the authorization policy to be used.
        /// </summary>
        /// <remarks>
        /// If<c>null</c>, the policy will be constructed using
        /// <see cref="AuthorizationPolicy.CombineAsync(IAuthorizationPolicyProvider, IEnumerable{IAuthorizeData})"/>.
        /// </remarks>
        public AuthorizationPolicy Policy { get; }
        bool IFilterFactory.IsReusable => true;
        // Computes the actual policy for this filter using either Policy or PolicyProvider + AuthorizeData
        private Task<AuthorizationPolicy> ComputePolicyAsync()
            if (Policy != null)
                return Task.FromResult(Policy);
            if (PolicyProvider == null)
                throw new InvalidOperationException(
                    Resources.FormatAuthorizeFilter_AuthorizationPolicyCannotBeCreated(
                        nameof(AuthorizationPolicy),
                        nameof(IAuthorizationPolicyProvider)));
            return AuthorizationPolicy.CombineAsync(PolicyProvider, AuthorizeData);
        internal async Task<AuthorizationPolicy> GetEffectivePolicyAsync(AuthorizationFilterContext context)
            // Combine all authorize filters into single effective policy that's only run on the closest filter
            var builder = new AuthorizationPolicyBuilder(await ComputePolicyAsync());
            for (var i = 0; i < context.Filters.Count; i++)
                if (ReferenceEquals(this, context.Filters[i]))
                    continue;
                if (context.Filters[i] is AuthorizeFilter authorizeFilter)
                    // Combine using the explicit policy, or the dynamic policy provider
                    builder.Combine(await authorizeFilter.ComputePolicyAsync());
            var endpoint = context.HttpContext.GetEndpoint();
            if (endpoint != null)
                // When doing endpoint routing, MVC does not create filters for any authorization specific metadata i.e [Authorize] does not
                // get translated into AuthorizeFilter. Consequently, there are some rough edges when an application uses a mix of AuthorizeFilter
                // explicilty configured by the user (e.g. global auth filter), and uses endpoint metadata.
                // To keep the behavior of AuthFilter identical to pre-endpoint routing, we will gather auth data from endpoint metadata
                // and produce a policy using this. This would mean we would have effectively run some auth twice, but it maintains compat.
                var policyProvider = PolicyProvider ?? context.HttpContext.RequestServices.GetRequiredService<IAuthorizationPolicyProvider>();
                var endpointAuthorizeData = endpoint.Metadata.GetOrderedMetadata<IAuthorizeData>() ?? Array.Empty<IAuthorizeData>();
                var endpointPolicy = await AuthorizationPolicy.CombineAsync(policyProvider, endpointAuthorizeData);
                if (endpointPolicy != null)
                    builder.Combine(endpointPolicy);
            return builder.Build();
        /// <inheritdoc />
        public virtual async Task OnAuthorizationAsync(AuthorizationFilterContext context)
            if (context == null)
                throw new ArgumentNullException(nameof(context));
            if (!context.IsEffectivePolicy(this))
                return;
            // IMPORTANT: Changes to authorization logic should be mirrored in security's AuthorizationMiddleware
            var effectivePolicy = await GetEffectivePolicyAsync(context);
            if (effectivePolicy == null)
                return;
            var policyEvaluator = context.HttpContext.RequestServices.GetRequiredService<IPolicyEvaluator>();
            var authenticateResult = await policyEvaluator.AuthenticateAsync(effectivePolicy, context.HttpContext);
            // Allow Anonymous skips all authorization
            if (HasAllowAnonymous(context))
                return;
            var authorizeResult = await policyEvaluator.AuthorizeAsync(effectivePolicy, authenticateResult, context.HttpContext, context);
            if (authorizeResult.Challenged)
                context.Result = new ChallengeResult(effectivePolicy.AuthenticationSchemes.ToArray());
            else if (authorizeResult.Forbidden)
                context.Result = new ForbidResult(effectivePolicy.AuthenticationSchemes.ToArray());
        IFilterMetadata IFilterFactory.CreateInstance(IServiceProvider serviceProvider)
            if (Policy != null || PolicyProvider != null)
                // The filter is fully constructed. Use the current instance to authorize.
                return this;
            Debug.Assert(AuthorizeData != null);
            var policyProvider = serviceProvider.GetRequiredService<IAuthorizationPolicyProvider>();
            return AuthorizationApplicationModelProvider.GetFilter(policyProvider, AuthorizeData);
        private static bool HasAllowAnonymous(AuthorizationFilterContext context)
            var filters = context.Filters;
            for (var i = 0; i < filters.Count; i++)
                if (filters[i] is IAllowAnonymousFilter)
                    return true;
            // When doing endpoint routing, MVC does not add AllowAnonymousFilters for AllowAnonymousAttributes that
            // were discovered on controllers and actions. To maintain compat with 2.x,
            // we'll check for the presence of IAllowAnonymous in endpoint metadata.
            var endpoint = context.HttpContext.GetEndpoint();
            if (endpoint?.Metadata?.GetMetadata<IAllowAnonymous>() != null)
                return true;
            return false;

代码中继承了 IAsyncAuthorizationFilter , IFilterFactory 两个抽象接口，分别来看看这两个抽象接口的源代码

IAsyncAuthorizationFilter 源代码如下：

/// <summary>
/// A filter that asynchronously confirms request authorization.
/// </summary>
public interface IAsyncAuthorizationFilter : IFilterMetadata
    ///定义了授权的方法
    Task OnAuthorizationAsync(AuthorizationFilterContext context);

IAsyncAuthorizationFilter 代码中继承了 IFilterMetadata 接口，同时定义了 OnAuthorizationAsync 抽象方法,子类需要实现该方法，然而 AuthorizeFilter 中也已经实现了该方法，稍后再来详细讲解该方法，我们再继续看看 IFilterFactory 抽象接口,代码如下：

public interface IFilterFactory : IFilterMetadata
    bool IsReusable { get; }
    //创建IFilterMetadata 对象方法
    IFilterMetadata CreateInstance(IServiceProvider serviceProvider);

我们回到 AuthorizeFilter 源代码中，该源代码中提供了四个构造初始化方法同时包含了 AuthorizeData 、 Policy 属性，我们看看它的默认构造方法代码

public class AuthorizeFilter : IAsyncAuthorizationFilter, IFilterFactory
        public IEnumerable<IAuthorizeData> AuthorizeData { get; }
        //默认构造函数中默认创建了AuthorizeAttribute 对象
        public AuthorizeFilter()
            : this(authorizeData: new[] { new AuthorizeAttribute() })
        //赋值AuthorizeData
        public AuthorizeFilter(IEnumerable<IAuthorizeData> authorizeData)
            if (authorizeData == null)
                throw new ArgumentNullException(nameof(authorizeData));
            AuthorizeData = authorizeData;

上面的代码中默认的构造函数默认给构建了一个 AuthorizeAttribute 对象，并且赋值给了 IEnumerable<IAuthorizeData> 的集合属性; 好了，看到这里 AuthorizeFilter 过滤器也是默认构造了一个 AuthorizeAttribute 的对象，也就是构造了授权所需要的 IAuthorizeData 信息. 同时 AuthorizeFilter 实现的 OnAuthorizationAsync 方法中通过 GetEffectivePolicyAsync 这个方法获得有效的授权策略，并且进行下面的授权 AuthenticateAsync 的执行 AuthorizeFilter 代码中提供了 HasAllowAnonymous 方法来实现是否 Controller 或者 Action 上标注了 AllowAnonymous 特性，用于跳过授权 HasAllowAnonymous 代码如下：

private static bool HasAllowAnonymous(AuthorizationFilterContext context)
     var filters = context.Filters;
     for (var i = 0; i < filters.Count; i++)
        if (filters[i] is IAllowAnonymousFilter)
           return true;
     //同样通过上下文的endpoint 来获取是否标注了AllowAnonymous特性
     var endpoint = context.HttpContext.GetEndpoint();
     if (endpoint?.Metadata?.GetMetadata<IAllowAnonymous>() != null)
        return true;
     return false;

到这里我们再回到全局添加过滤器的方式代码：

 services.AddControllers(options=>options.Filters.Add(new AuthorizeFilter()));

分析到这里 ，我很是好奇，它是怎么全局添加进去的呢？我打开源代码看了下，源代码如下：

public class MvcOptions : IEnumerable<ICompatibilitySwitch>
        public MvcOptions()
            CacheProfiles = new Dictionary<string, CacheProfile>(StringComparer.OrdinalIgnoreCase);
            Conventions = new List<IApplicationModelConvention>();
            Filters = new FilterCollection();
            FormatterMappings = new FormatterMappings();
            InputFormatters = new FormatterCollection<IInputFormatter>();
            OutputFormatters = new FormatterCollection<IOutputFormatter>();
            ModelBinderProviders = new List<IModelBinderProvider>();
            ModelBindingMessageProvider = new DefaultModelBindingMessageProvider();
            ModelMetadataDetailsProviders = new List<IMetadataDetailsProvider>();
            ModelValidatorProviders = new List<IModelValidatorProvider>();
            ValueProviderFactories = new List<IValueProviderFactory>();
        //过滤器集合
        public FilterCollection Filters { get; }

FilterCollection 相关核心代码如下：

public class FilterCollection : Collection<IFilterMetadata>
        public IFilterMetadata Add<TFilterType>() where TFilterType : IFilterMetadata