.net core 结合JWT认证对用户进行API授权,原理及实现参考asp.net core 集成JWT（二）token的强制失效，基于策略模式细化api权限，但是作者给出的代码在.net core 2.2下调试成功，在3及以上版本中调试失败，提示对象为空，错误代码为varhttpContext = (context.Resourceas Microsoft.AspNetCore.Mvc.Filters.AuthorizationFilterContext).HttpContext;
修改新代码如下
using System;
using System.Linq;
using System.Security.Claims;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Authorization;
namespace haochaping.AuthManagement
{ public class PolicyHandler :AuthorizationHandler<PolicyRequirement>
{
protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, PolicyRequirement requirement)
{
var userPermissions = requirement.rolePermissions;
//从AuthorizationHandlerContext转成HttpContext，以便取出表求信息
// var httpContext = (context.Resource as Microsoft.AspNetCore.Mvc.Filters.AuthorizationFilterContext).HttpContext;
//请求Url
var questUrl = (context.Resource as Microsoft.AspNetCore.Routing.RouteEndpoint).RoutePattern.RawText.ToString();
//是否经过验证
var isAuthenticated = context.User.Identity.IsAuthenticated;
if (isAuthenticated)
{
//用户名
var userName = context.User.Claims.SingleOrDefault(s =>s.Type == ClaimTypes.NameIdentifier).Value;
if (userPermissions.Any(w =>w.RoleName == userName && w.Url == questUrl.ToString()))
{
context.Succeed(requirement);
}
else
{
//无权限跳转到拒绝页面
context.Fail();
}
}
return Task.CompletedTask;
}
}
}
