为什么 ASP.NET Core 密码验证规则不起作用？

Question

我正在使用 ASP.NET Core Identity 在使用 Dapper ORM 的自定义数据访问层之上构建一个 ASP.NET Core 5 Web API。从根本上说，事情按预期工作，但我意识到身份框架提供的密码验证规则没有任何效果，我不明白发生了什么。这是我所拥有的：

首先，因为我依赖于自定义数据访问层，所以我提供了 Identity 的 IUserStore 接口的自定义实现。

public class UserStore : IUserStore<AppUser>,
                         IUserPasswordStore<AppUser>,
                         IUserEmailStore<AppUser>
{
  private IRepository<AppUser> _repository;

  public UserStore(IConfiguration configuration)
  {
    _repository = new AppUserRepository(configuration.GetConnectionString("MyConnectionString"));
  }

  // IUserStore implementation
  // IUserPasswordStore implementation
  // IUserEmailStore implementation
}

接下来，有一个绑定模型，用于提交创建新帐户所需的信息。

public class RegisterBindingModel
{
  [Required]
  [Display(Name = "UserName")]
  public string UserName
  {
    get;
    set;
  }

  [Required]
  [DataType(DataType.Password)]
  [Display(Name = "Password")]
  public string Password
  {
    get;
    set;
  }

  [DataType(DataType.Password)]
  [Display(Name = "Confirm password")]
  [Compare(nameof(Password), ErrorMessage = "The password and confirmation password do not match.")]
  public string ConfirmPassword
  {
    get;
    set;
  }

  // remaining required properties
}

接下来，通过AccountController 创建新帐户：

[Authorize]
[ApiController]
[Route("api/Accounts")]
public class AccountController
{
  private readonly UserManager<AppUser>     _userManager;
  private readonly IPasswordHasher<AppUser> _passwordHasher;

  public AccountController(UserManager<AppUser> userManager, IPasswordHasher<AppUser> passwordHasher)
  {
    _userManager    = userManager;
    _passwordHasher = passwordHasher;
  }

  [AllowAnonymous]
  [HttpPost]
  [Route("Register")]
  public async Task<ActionResult> Register([FromBody]RegisterBindingModel model)
  {
    if(model == null)
    {
      return BadRequest();
    }

    if(!ModelState.IsValid)
    {
      return BadRequest(ModelState);
    }

    var user = new AppUser()
    {
      UserName  = model.UserName,
      Firstname = model.Firstname,
      Lastname  = model.Lastname,
      Email     = model.Email,
      Gender    = model.Gender
    };

    user.PasswordHash     = _passwordHasher.HashPassword(user, model.Password);
    IdentityResult result = await _userManager.CreateAsync(user);

    return GetHttpResponse(result);
  }

  [AllowAnonymous]
  [HttpPost]
  [Route("Token")]
  public async Task<IActionResult> Login([FromForm]LoginBindingModel model)
  {
    if(model == null)
    {
      return BadRequest();
    }

    if(!ModelState.IsValid)
    {
      return BadRequest(ModelState);
    }

    AppUser user = await _userManager.FindByNameAsync(model.UserName);

    if(user == null || !await _userManager.CheckPasswordAsync(user, model.Password))
    {
      return Unauthorized();
    }

    DateTime                currentTime     = DateTime.UtcNow;
    JwtSecurityTokenHandler jwtTokenHandler = new();
    SecurityTokenDescriptor tokenDescriptor = new()
    {
      Subject            = new ClaimsIdentity(new[] { new Claim(ClaimTypes.NameIdentifier, user.AppUserId.ToString()) }),
      IssuedAt           = currentTime,
      Expires            = currentTime.AddHours(_accessTokenValidityInHours),
      SigningCredentials = _signingCredentialsProvider.GetSigningCredentials()
    };

    return Ok(jwtTokenHandler.WriteToken(jwtTokenHandler.CreateToken(tokenDescriptor)));
  }

  ...
}

最后，事情是这样连接在一起的：

public class Startup
{
  public Startup(IConfiguration configuration)
  {
    Configuration = configuration;
  }

  public IConfiguration Configuration
  {
    get;
  }

  public void ConfigureServices(IServiceCollection services)
  {
    services.AddIdentityCore<AppUser>(options => Configuration.GetSection(nameof(IdentityOptions)).Bind(options));
    services.AddScoped<IPasswordHasher<AppUser>, Identity.PasswordHasher<AppUser>>();
    services.AddTransient<IUserStore<AppUser>, UserStore>();
    ...
  }
}

对应的设置保存在appsettings.json文件中：

{
  "IdentityOptions": {
    "Password": {
      "RequiredLength": 6,
      "RequiredUniqueChars": 6,
      "RequireNonAlphanumeric": true,
      "RequireUppercase": true,
      "RequireLowercase": true,
      "RequireDigit": true
    },
    "Lockout": {
      "AllowedForNewUsers": true,
      "MaxFailedAccessAttempts ": 5,
      "DefaultLockoutTimeSpan ": "00:05:00"
    }
  },
  ...
}

如果我发送带有必要帐户数据的 HTTP POST 请求，那么密码是什么实际上并不重要。即使我只是将1 作为明显违反密码规则的密码，调用也会成功。 if(!ModelState.IsValid) 的声明很高兴地告诉我，该模型一切正常。

据我所知，ASP.NET Core Identity 提供了一个PasswordValidator，显然应该根据提供的设置来验证密码。从我得到的结果来看，该验证器没有在我的设置中运行。

我不清楚事情是否应该按原样工作，或者我是否需要实施一些我不知道的事情。有没有人有更多的见解，可以告诉我我在这里缺少什么？

编辑：

我刚刚意识到默认的UserManager 公开了IPasswordValidator 对象的列表。我是否使用该列表来验证AccountController 的Register 方法中的密码？

Answer 1

您的if(!ModelState.IsValid) 没有发现任何错误的原因在于您的模型Password 参数中的RegisterBindingModel 不包含与您的appsettings.json 上的选项相同的验证，您只需验证它是必需的（所以一个字符就可以了）。

如果您想要进行相同的验证，您需要在Password 参数上添加更多属性。我建议你看看这个https://docs.microsoft.com/en-us/aspnet/core/mvc/models/validation?view=aspnetcore-5.0

Answer 2

我最终修改了Register 方法如下：

[AllowAnonymous]
[HttpPost]
[Route("Register")]
public async Task<ActionResult> Register([FromBody]RegisterBindingModel model)
{
  if(model == null)
  {
    return BadRequest();
  }

  if(!ModelState.IsValid)
  {
    return BadRequest(ModelState);
  }

  AppUser user = new()
  {
    UserName  = model.UserName,
    Firstname = model.Firstname,
    Lastname  = model.Lastname,
    Email     = model.Email,
    Gender    = model.Gender
  };

  IdentityResult result;

  foreach(IPasswordValidator<AppUser> passwordValidator in _userManager.PasswordValidators)
  {
    result = await passwordValidator.ValidateAsync(_userManager, user, model.Password);

    if(!result.Succeeded)
    {
      return BadRequest(result.Errors);
    }
  }

  user.PasswordHash = _userManager.PasswordHasher.HashPassword(user, model.Password);
  result            = await _userManager.CreateAsync(user);

  return GetHttpResponse(result);
}

默认的UserManager 包含PasswordValidators 属性，它允许我访问所有PasswordValidators。我只是遍历它们并在用户提交的密码上调用ValidateAsync方法。