验证信号集线器连接

Question

****我使用.Net框架，而不是Core****

我有一个连接到服务器并订阅某些集线器功能的网络界面。我正在尝试找到一种方法来限制对服务器的订阅，因此只有具有正确令牌的客户端才能连接和订阅。

这是我的服务器端：Startup.cs：

public class Startup

    {

        public void Configuration(IAppBuilder app)

        {

            app.Map("/signalr", map =>

            {

                map.UseCors(CorsOptions.AllowAll);

                var hubConfiguration = new HubConfiguration

                {

                    EnableDetailedErrors = true

                };

                map.RunSignalR(hubConfiguration);

            });

        }

    }

我的中心课程：

[HubName("CordioHub")]

    public class CordioHub : Hub

    {

        private static IHubContext CordioHubContext

        {

            get

            {

                return GlobalHost.ConnectionManager.GetHubContext<CordioHub>();

            }

        }

        public static void UpdateClient(string message)

        {

            CordioHubContext.Clients.All.UpdateClient(message);

        }

        public override Task OnDisconnected(bool stopCalled)

        {

            return Clients.All.leave(Context.ConnectionId, DateTime.Now.ToString());

        }

        public override Task OnConnected()

        {

            return Clients.All.joined(Context.ConnectionId, DateTime.Now.ToString());

        }

        public override Task OnReconnected()

        {

            return Clients.All.rejoined(Context.ConnectionId, DateTime.Now.ToString());

        }

        //Status page events:

        public static void UpdatePatientCout(int delta)

        {

            CordioHubContext.Clients.All.UpdatePatientCout(delta);

        }

    }

正如我所解释的，当客户端尝试建立第一次连接时，我想在服务器端检查令牌，并在令牌不好的情况下拒绝。多谢！

Answer 1

如果您使用自己的自定义令牌，您可以这样做：客户端（.NET，但我想你会理解的）：var connection = new HubConnection("url", "CustomToken=SomeToken");connection.Start().Wait();服务器：&nbsp; &nbsp; public override Task OnConnected()&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; if(Context.QueryString["CustomToken"] != "CorrectToken")&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ///Forcefully close the connection&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; HttpContext.Current.Response.Close();&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; return base.OnConnected();&nbsp; &nbsp; }

Answer 2

在这种情况下，您可以使用 JWT 令牌。配置非常简单：您Program.cs应该配置 JWT：JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();&nbsp; &nbsp; &nbsp; &nbsp; services&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .AddAuthentication(options =>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; options.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; })&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .AddJwtBearer(cfg =>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cfg.RequireHttpsMetadata = false;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cfg.SaveToken = true;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cfg.TokenValidationParameters = new TokenValidationParameters&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ValidIssuer = configuration["Jwt:Issuer"],&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ValidAudience = configuration["Jwt:Issuer"],&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(configuration["Jwt:Key"])),&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ClockSkew = TimeSpan.Zero&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; };&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cfg.Events = new JwtBearerEvents&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; OnMessageReceived = context =>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if (context.Request.Query.TryGetValue("token", out var token)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; )&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; context.Token = token;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return Task.CompletedTask;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; };&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; });配置文件：&nbsp;"Jwt": {&nbsp; &nbsp; "Key": "someKey",&nbsp; &nbsp; "Issuer": "http://yourdomain.com",&nbsp; &nbsp; "ExpireDays": 0,&nbsp; &nbsp; "ExpireHours": 1,&nbsp; &nbsp; "ExpireMinutes": 0},在 Angular 中，您应该创建拦截器，它将向每个请求添加 Authentications 标头：@Injectable()export class JwtInterceptor implements HttpInterceptor {&nbsp; &nbsp; constructor(private userContext: UserContext) { }intercept(&nbsp; &nbsp; request: HttpRequest<any>,&nbsp; &nbsp; next: HttpHandler): Observable<HttpEvent<any>> {&nbsp; &nbsp; const authToken = this.userContext.getToken();&nbsp; &nbsp; if (!!authToken) {&nbsp; &nbsp; &nbsp; &nbsp; request = request.clone({&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; setHeaders: {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Authorization: `Bearer ${authToken}`&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; });&nbsp; &nbsp; }&nbsp; &nbsp; return next.handle(request);&nbsp; &nbsp; }}