如何从Web Api .Net中的AuthorizeAttribute检索POST参数？

Question

我上的身份验证方法使用的工作对我来说是令牌网络API .NET项目，所以我重写这样一些方法：

public class Authorizetest: System.Web.Http.AuthorizeAttribute 
{ 
     public override void OnAuthorization(HttpActionContext actionContext) 
    { 
      if(Authorize(actionContext)) 
     { 
      return; 
     } 
     HandleUnauthorizedRequest(actionContext); 
    } 

    protected override void HandleUnauthorizedRequest(HttpActionContext actionContext) 
    { 
     base.HandleUnauthorizedRequest(actionContext); 
    } 

    private bool Authorize(HttpActionContext actionContext) 
    {   
     try 
     {       
      var context = new HttpContextWrapper(HttpContext.Current); 
      HttpRequestBase request = context.Request;    
      string token = request.Params["Token"]; 
      return true; 
     } 
     catch (Exception) 
     { 
      return false; 
     } 
    } 
} 

我使用的装饰[Authorizetest]在这条路上：

[Authorizetest] 
    public class DoActionController : ApiController 
     { 
      [HttpPost] 
      public Display DoSomething(Parameter param) 
      { 
       //do something 
       return display; 
      } 
    } 

但是request.Params返回null但是在DoSomething方法我从Parameter得到的值。

我也试过类似：（基于this page）

HttpRequestBase request = actionContext.RequestContext.HttpContext.Request; 
    string token = request.Params["Token"]; 

，但它无法获取通过POST方法发送的任何值。

我使用jQuery发送数据

$.ajax({ 
       type: 'POST', 
       url: '/DoSomething', 
       data: JSON.stringify({ "Token": "xxxxxxxxx"}), 
       contentType: 'application/json; charset=utf-8', 
       success: function (data) { 
       }, 
       fail:function (XMLHttpRequest, textStatus, errorThrown) { 
        alert(errorThrown); 
       } 
      }); 

我怎样才能检索到的Authorizetest class发送到DoSomething数据？

Answer 1

验证令牌应该在请求的头部发送，然后由Authorize Attribute提取，如果意图是使用它进行授权的话。在模型联编程序有机会填充模型之前读取请求主体可能会产生负面影响。

var token = "xxxxxxxxx"; 
$.ajax({  
    type: 'POST', 
    url: '/DoSomething', 
    data: JSON.stringify({ "SomeProperty": "SomeValue"}), 
    contentType: 'application/json; charset=utf-8', 
    beforeSend: function (xhr) { 
     /* Authorization header */ 
     xhr.setRequestHeader("Authorization", "Token " + token);   
    }, 
    success: function (data) { 
    }, 
    fail:function (XMLHttpRequest, textStatus, errorThrown) { 
     alert(errorThrown); 
    } 
}); 

然后访问该服务器

public class Authorizetest : System.Web.Http.AuthorizeAttribute { 
    public override void OnAuthorization(HttpActionContext actionContext) { 
     if (Authorize(actionContext)) { 
      return; 
     } 
     HandleUnauthorizedRequest(actionContext); 
    } 

    protected override void HandleUnauthorizedRequest(HttpActionContext actionContext) { 
     base.HandleUnauthorizedRequest(actionContext); 
    } 

    private bool Authorize(HttpActionContext actionContext) { 
     try { 
      var auth = actionContext.Request.Headers.Authorization; 
      if (auth != null) { 
       var scheme = auth.Scheme; //Should be Token, otherwise fail 
       var token = auth.Parameter; 
       //Validate your token and set your principal 
       IPrincipal user = GetUser(token); 
       if (user != null) { 
        SetPrincipal(user); 
        return true; 
       } 
      } 
      return false; 
     } catch (Exception) { 
      return false; 
     } 
    } 

    private IPrincipal GetUser(string token) { 
     throw new NotImplementedException(); //Put your implementation here 
    } 

    private void SetPrincipal(System.Security.Principal.IPrincipal principal) { 
     if (principal != null) { 
      System.Threading.Thread.CurrentPrincipal = principal; 
      if (System.Web.HttpContext.Current != null) { 
       System.Web.HttpContext.Current.User = principal; 
      } 
     } 
    } 
}