如何从自定义属性返回未经授权的结果？答案

【问题标题】：How can I return an unauthorized result from a custom attribute?如何从自定义属性返回未经授权的结果？
【发布时间】：2022-03-28 05:09:54
【问题描述】：

我正在尝试使用 HotChocolate 实现自定义授权属性。

我目前拥有的是这个

namespace GraphQL.Attributes
{
    public class AuthorizeAttribute : ObjectFieldDescriptorAttribute
    {
        public override void OnConfigure(IDescriptorContext context, IObjectFieldDescriptor descriptor, MemberInfo member)
        {
            var httpContextAccessor = context.Services.GetService(typeof(IHttpContextAccessor)) as IHttpContextAccessor;

            var authorizationHeader = httpContextAccessor.HttpContext.Request.Headers["Authorization"].ToString();

            var jwtService = context.Services.GetService(typeof(JwtService)) as JwtService;

            var isValidToken = jwtService.ValidateSessionToken(authorizationHeader);

            if (isValidToken == false)
            {
                // Here I want to return an Unauthorized message to the client and abort any further execution
            }

            // Everything OK
            return;
        }
    }
}

在 ASP.NET 5 中我可以这样做

public class AuthorizeAttribute : Attribute, IAuthorizationFilter
{
    public void OnAuthorization(AuthorizationFilterContext context)
    {
            var httpContextAccessor = context.Services.GetService(typeof(IHttpContextAccessor)) as IHttpContextAccessor;

            var authorizationHeader = httpContextAccessor.HttpContext.Request.Headers["Authorization"].ToString();

            var jwtService = context.Services.GetService(typeof(JwtService)) as JwtService;

            var isValidToken = jwtService.ValidateSessionToken(authorizationHeader);

            if (isValidToken == false)
            {
                context.Result = new UnauthorizedObjectResult(new
                {
                    Code = 1,
                    Message = "Invalid token"
                });

                return;
            }

            // Everything OK
            return;
    }
}

如您所见，在 ASP.NET 中，我们可以设置 UnauthorizedObjectResult 作为结果，API 会返回它。

如何从 HotChocolate 中的自定义属性返回未经授权的结果？

我想我应该使用IDescriptorContext、IObjectFieldDescriptor 或MemberInfo 中的任何一个。

有什么建议吗？

【问题讨论】：

可能会抛出 GraphQLException？您可以在其中添加相当多的自定义设置。

标签： hotchocolate

【解决方案1】：

尝试使用这个：

public class MyAuthorizationHandler : HotChocolate.AspNetCore.Authorization.IAuthorizationHandler
{
    public async ValueTask<AuthorizeResult> AuthorizeAsync(IMiddlewareContext context, AuthorizeDirective directive)
    {
        var authorizeResult = AuthorizeResult.NotAllowed;


        var httpContextAccessor = context.Services.GetService(typeof(IHttpContextAccessor)) as IHttpContextAccessor;

        var authorizationHeader = httpContextAccessor.HttpContext.Request.Headers["Authorization"].ToString();

        var jwtService = context.Services.GetService(typeof(JwtService)) as JwtService;

        var isValidToken = jwtService.ValidateSessionToken(authorizationHeader);

        if (isValidToken)
        {
            authorizeResult = AuthorizeResult.Allowed;
        }

        return await Task.FromResult(((Func<AuthorizeResult>)(() =>
        {
            return authorizeResult;

        }))());
    }

        services.AddGraphQLServer()
            .AddAuthorization()
            .AddQueryType<IQueryForms>()
            .AddAuthorization();

        services.AddGraphQLServer().AddSocketSessionInterceptor<AuthenticationSocketInterceptor>();
        services.AddSingleton<HotChocolate.AspNetCore.Authorization.IAuthorizationHandler, MyAuthorizationHandler>();

【讨论】：