C# webapi 实现header验证代码

以下是一个 C# WebAPI 中实现 Header 验证的示例代码：

public class HeaderAuthenticationFilter : IAuthenticationFilter
{
    private readonly string apiKey = "your_api_key_here";

    public bool AllowMultiple => false;

    public async Task AuthenticateAsync(HttpAuthenticationContext context, CancellationToken cancellationToken)
    {
        // 获取请求头的 Authorization 字段
        var authHeader = context.Request.Headers.Authorization;

        // 如果 Authorization 字段不存在或不是 Bearer 形式的 Token，则返回未授权的错误
        if (authHeader == null || !authHeader.Scheme.Equals("Bearer", StringComparison.OrdinalIgnoreCase))
        {
            context.ErrorResult = new AuthenticationFailureResult("Unauthorized", context.Request);
            return;
        }

        // 获取 Token
        var token = authHeader.Parameter;

        // 验证 Token 是否正确
        if (string.IsNullOrWhiteSpace(token) || !token.Equals(apiKey))
        {
            context.ErrorResult = new AuthenticationFailureResult("Unauthorized", context.Request);
            return;
        }

        // 设置用户身份验证信息
        var identity = new GenericIdentity("user");
        context.Principal = new GenericPrincipal(identity, new string[] { });
    }

    public Task ChallengeAsync(HttpAuthenticationChallengeContext context, CancellationToken cancellationToken)
    {
        return Task.FromResult(0);
    }
}

public class AuthenticationFailureResult : IHttpActionResult
{
    public string ReasonPhrase { get; private set; }
    public HttpRequestMessage Request { get; private set; }

    public AuthenticationFailureResult(string reasonPhrase, HttpRequestMessage request)
    {
        ReasonPhrase = reasonPhrase;
        Request = request;
    }

    public Task<HttpResponseMessage> ExecuteAsync(CancellationToken cancellationToken)
    {
        var response = new HttpResponseMessage(HttpStatusCode.Unauthorized);
        response.RequestMessage = Request;
        response.ReasonPhrase = ReasonPhrase;
        return Task.FromResult(response);
    }
}

在上述代码中，我们创建了一个名为 `HeaderAuthenticationFilter` 的类，该类实现了 `IAuthenticationFilter` 接口，用于在 WebAPI 的管道中进行身份验证。我们在 `AuthenticateAsync` 方法中进行身份验证，如果验证失败，则设置 `ErrorResult` 属性返回未授权的错误。如果验证成功，则设置 `Principal` 属性为一个包含用户信息的 `IPrincipal` 对象。最后，我们创建了一个名为 `AuthenticationFailureResult` 的类，该类实现了 `IHttpActionResult` 接口，用于返回错误响应。