.net core 结合JWT认证对用户进行API授权,原理及实现参考asp.net core 集成JWT（二）token的强制失效，基于策略模式细化api权限，但是作者给出的代码在.net core 2.2下调试成功，在3及以上版本中调试失败，提示对象为空，错误代码为varhttpContext = (context.Resourceas Microsoft.AspNetCore.Mvc.Filters.AuthorizationFilterContext).HttpContext;

修改新代码如下

using System;

using System.Linq;

using System.Security.Claims;

using System.Threading.Tasks;

using Microsoft.AspNetCore.Authorization;

namespace haochaping.AuthManagement

{    public class PolicyHandler :AuthorizationHandler<PolicyRequirement>

{

        protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, PolicyRequirement requirement)

{

            var userPermissions = requirement.rolePermissions;

            //从AuthorizationHandlerContext转成HttpContext，以便取出表求信息

//  var httpContext = (context.Resource as Microsoft.AspNetCore.Mvc.Filters.AuthorizationFilterContext).HttpContext;

//请求Url

            var questUrl = (context.Resource as Microsoft.AspNetCore.Routing.RouteEndpoint).RoutePattern.RawText.ToString();

            //是否经过验证

            var isAuthenticated = context.User.Identity.IsAuthenticated;

            if (isAuthenticated)

{

                //用户名

                var userName = context.User.Claims.SingleOrDefault(s =>s.Type == ClaimTypes.NameIdentifier).Value;

                if (userPermissions.Any(w =>w.RoleName == userName && w.Url == questUrl.ToString()))

{

                    context.Succeed(requirement);

}

                else

                {

                    //无权限跳转到拒绝页面

                    context.Fail();

}

}

            return Task.CompletedTask;

}

}

}