基于 Ocelot+Nacos+WebAPI 的网关鉴权实现

ocelot.json

路由配置中启用了服务发现，并指定了负载均衡策略。这里的关键是 AuthenticationOptions 需要与自定义认证处理器名称一致。

{
  "Routes": [
    {
      "DownstreamPathTemplate": "/api/{catchAll}",
      "UpstreamPathTemplate": "/api/{catchAll}",
      "UpstreamHttpMethod": ["GET", "POST", "PUT", "DELETE"],
      "DownstreamScheme": "http",
      "UseServiceDiscovery": true,
      "ServiceName": "GuangDongData",
      "NacosNamespace": "public",
      "NacosGroupName": "DEFAULT_GROUP",
      "GroupName": "DEFAULT_GROUP",
      "AuthenticationOptions": {
        "AuthenticationProviderKey": "CustomGuidToken",
        "AllowedScopes": []
      },
      "LoadBalancerOptions": {
        "Type": "RoundRobin",
        "Key": "GuangDongData",
        "Expiry": 30000
      }
    }
  ],
  "GlobalConfiguration": {
    "ServiceDiscoveryProvider": {
      "Type": "Nacos"
    }
  }
}

Program.cs 启动配置

在 Program.cs 中，核心步骤是注册 Ocelot、绑定 Nacos 服务发现以及定义自定义认证 Scheme。Swagger 仅在开发环境下启用，避免生产环境泄露信息。

using Auth.StaticVar;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.OpenApi;
using Nacos.V2;
using Ocelot.DependencyInjection;
using Ocelot.Middleware;
using Ocelot.Provider.Nacos;

var builder = WebApplication.CreateBuilder(args);

// 加载 Ocelot 配置
builder.Configuration.AddJsonFile("ocelot.json", optional: false, reloadOnChange: true);

// 注册 Ocelot 及 Nacos 服务发现
builder.Services.AddOcelot().AddNacosDiscovery();

// 注册自定义认证处理器
builder.Services.AddAuthentication("CustomGuidToken")
    .AddScheme<AuthenticationSchemeOptions, CustomGuidTokenHandler>("CustomGuidToken", options => { });

builder.Services.AddControllers();

builder.Services.AddSwaggerGen(options => {
    options.SwaggerDoc("v1", new() {
        Title = "API",
        Version = "v1",
        Description = "文档示例"
    });
});

var app = builder.Build();
PubliVar.IsDevelopment = app.Environment.IsDevelopment();

if (app.Environment.IsDevelopment()) {
    app.UseSwagger();
    app.UseSwaggerUI(options => {
        options.SwaggerEndpoint("/swagger/v1/swagger.json", "你的 API v1");
        options.RoutePrefix = string.Empty;
    });
}

// 中间件顺序：认证 -> 授权 -> Ocelot
app.UseAuthentication();
app.UseAuthorization();
await app.UseOcelot();
app.MapControllers();
app.Run();

自定义鉴权逻辑

认证处理器实现

这里的核心是继承 AuthenticationHandler。为了演示方便，示例中采用硬编码 Token，实际生产环境建议对接 Redis 存储进行校验。处理流程包括获取请求头、解析 Bearer 前缀、比对 Token 值以及构建 ClaimsPrincipal。

using Microsoft.AspNetCore.Authentication;
using Microsoft.Extensions.Options;
using Nacos;
using System.Security.Claims;
using System.Text.Encodings.Web;
using System.Text.Json;

/// <summary>
/// 自定义认证处理器：校验请求头中的 token 是否等于写死的 GUID
/// </summary>
public class CustomGuidTokenHandler : AuthenticationHandler<AuthenticationSchemeOptions>
{
    // 写死的 GUID Token
    private const string FixedGuidToken = "f0e92635-5141-4ce2-9690-563ca18fdd3d";

    public CustomGuidTokenHandler(
        IOptionsMonitor<AuthenticationSchemeOptions> options,
        ILoggerFactory logger,
        UrlEncoder encoder,
        ISystemClock clock) : base(options, logger, encoder, clock)
    {
    }

    protected async override Task<AuthenticateResult> HandleAuthenticateAsync()
    {
        try
        {
            // 1. 从请求头获取 Authorization
            var authHeader = Request.Headers["Authorization"].FirstOrDefault();

            // 无 Token，直接返回 401
            if (string.IsNullOrEmpty(authHeader))
            {
                Response.StatusCode = StatusCodes.Status401Unauthorized;
                Response.ContentType = "application/json";
                var error = JsonSerializer.Serialize(new { code = 401, message = "认证失败：未提供有效 Token" });
                await Response.WriteAsync(error);
                return AuthenticateResult.Fail("未提供 Token");
            }

            // 2. 解析 Token（兼容带 Bearer 前缀的情况）
            string token = authHeader.StartsWith("Bearer ") ? authHeader.Substring("Bearer ".Length).Trim() : authHeader.Trim();

            // 3. 校验 Token 有效性
            if (token != FixedGuidToken)
            {
                Response.StatusCode = StatusCodes.Status401Unauthorized;
                Response.ContentType = "application/json";
                var error = JsonSerializer.Serialize(new { code = 401, message = "认证失败：提供了无效的 Token" });
                await Response.WriteAsync(error);
                return AuthenticateResult.Fail("无效 Token");
            }

            // 4. 认证通过，构建用户身份上下文
            var claims = new List<Claim>
            {
                new Claim(ClaimTypes.Name, "ValidUser"),
                new Claim(ClaimTypes.Role, "ApiAccess")
            };
            var identity = new ClaimsIdentity(claims, Scheme.Name);
            var principal = new ClaimsPrincipal(identity);
            var ticket = new AuthenticationTicket(principal, Scheme.Name);

            // 将用户信息写入请求头，供下游服务读取
            Context.Request.Headers["X-Custom-UserName"] = "ValidUser";
            Context.Request.Headers["X-Custom-UserRole"] = "ApiAccess";

            return await Task.FromResult(AuthenticateResult.Success(ticket));
        }
        catch (Exception ex)
        {
            return await Task.FromResult(AuthenticateResult.Fail($"认证异常：{ex.Message}"));
        }
    }
}

登录接口演示

架构上建议将鉴权逻辑独立部署（如注册到 Nacos），此处仅为演示网关层拦截效果。如果路径匹配 /api/Auth，则直接返回成功响应并终止后续流程。

// 简单登录演示
if (Request.Path.ToString().StartsWith("/api/Auth"))
{
    Response.StatusCode = StatusCodes.Status200OK;
    Response.ContentType = "application/json";
    var success = JsonConvert.SerializeObject(new { code = 200, message = "Token 验证通过，登录成功！", isValid = true });
    await Response.WriteAsync(success);
    return AuthenticateResult.Success(new AuthenticationTicket(new ClaimsPrincipal(), Scheme.Name));
}

后端获取用户信息

鉴权通过后，网关会将用户身份信息注入到请求头中。后端服务无需重复校验，直接读取 X-Custom-UserName 等头部字段即可获取当前用户上下文。