基于 Ocelot 与 Nacos 的 WebAPI 网关鉴权实现

2. ocelot.json

{
  "Routes": [
    {
      "DownstreamPathTemplate": "/api/{catchAll}",
      "UpstreamPathTemplate": "/api/{catchAll}",
      "UpstreamHttpMethod": ["GET", "POST", "PUT", "DELETE"],
      "DownstreamScheme": "http",
      "UseServiceDiscovery": true,
      "ServiceName": "GuangDongData",
      "NacosNamespace": "public",
      "NacosGroupName": "DEFAULT_GROUP",
      "GroupName": "DEFAULT_GROUP",
      "AuthenticationOptions": {
        "AuthenticationProviderKey": "CustomGuidToken",
        "AllowedScopes": []
      },
      "LoadBalancerOptions": {
        "Type": "RoundRobin",
        "Key": "GuangDongData",
        "Expiry": 30000
      }
    }
  ],
  "GlobalConfiguration": {
    "ServiceDiscoveryProvider": {
      "Type": "Nacos"
    }
  }
}

3. Program.cs

using Auth.StaticVar;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.OpenApi;
using Nacos.V2;
using Ocelot.DependencyInjection;
using Ocelot.Middleware;
using Ocelot.Provider.Nacos;

var builder = WebApplication.CreateBuilder(args);

// 1. 加载 Ocelot 配置
builder.Configuration.AddJsonFile("ocelot.json", optional: false, reloadOnChange: true);

// 2. 加载 Nacos 配置
builder.Services.AddOcelot().AddNacosDiscovery();

// 3. 自定义鉴权
builder.Services.AddAuthentication("CustomGuidToken")
    .AddScheme<AuthenticationSchemeOptions, CustomGuidTokenHandler>("CustomGuidToken", options => { });

builder.Services.AddControllers();

builder.Services.AddSwaggerGen(options => {
    options.SwaggerDoc("v1", new() {
        Title = "API",
        Version = "v1",
        Description = "文档示例"
    });
});

var app = builder.Build();
PubliVar.IsDevelopment = app.Environment.IsDevelopment();

if (app.Environment.IsDevelopment()) {
    app.UseSwagger();
    app.UseSwaggerUI(options => {
        options.SwaggerEndpoint("/swagger/v1/swagger.json", "API v1");
        options.RoutePrefix = string.Empty;
    });
}

// 4. 认证
app.UseAuthentication();
app.UseAuthorization();

// 5. 启用 Ocelot 网关
await app.UseOcelot();
app.MapControllers();
app.Run();

三、鉴权认证代码

说明：示例中 Token 暂写死，实际应接入 Redis 读取。

1. 基础代码

using Microsoft.AspNetCore.Authentication;
using Microsoft.Extensions.Options;
using Nacos;
using System.Security.Claims;
using System.Text.Encodings.Web;
using System.Text.Json;

/// <summary>
/// 自定义认证处理器：校验请求头中的 token 是否等于写死的 GUID
/// </summary>
public class CustomGuidTokenHandler : AuthenticationHandler<AuthenticationSchemeOptions>
{
    // 写死的 GUID Token
    private const string FixedGuidToken = "f0e92635-5141-4ce2-9690-563ca18fdd3d";

    public CustomGuidTokenHandler(
        IOptionsMonitor<AuthenticationSchemeOptions> options,
        ILoggerFactory logger,
        UrlEncoder encoder,
        ISystemClock clock) : base(options, logger, encoder, clock) { }

    /// <summary>
    /// 核心认证逻辑：校验 token
    /// </summary>
    protected async override Task<AuthenticateResult> HandleAuthenticateAsync()
    {
        try
        {
            // 1. 从请求头获取 token
            var authHeader = Request.Headers["Authorization"].FirstOrDefault();

            // 无 token，认证失败
            if (string.IsNullOrEmpty(authHeader))
            {
                Response.StatusCode = StatusCodes.Status401Unauthorized;
                Response.ContentType = "application/json";
                var error = JsonSerializer.Serialize(new { code = 401, message = "认证失败：未提供有效 Token" });
                await Response.WriteAsync(error);
                return AuthenticateResult.Fail("未提供 Token");
            }

            // 2. 解析 token（兼容两种格式：带 Bearer 前缀/不带）
            string token = authHeader.StartsWith("Bearer ") ? authHeader.Substring("Bearer ".Length).Trim() : authHeader.Trim();

            // 3. 校验 token 是否等于写死的 GUID
            if (token != FixedGuidToken)
            {
                Response.StatusCode = StatusCodes.Status401Unauthorized;
                Response.ContentType = "application/json";
                var error = JsonSerializer.Serialize(new { code = 401, message = "认证失败：提供了无效的 Token" });
                await Response.WriteAsync(error);
                return AuthenticateResult.Fail("无效 Token");
            }

            // 4. 认证通过，构建用户身份
            var claims = new List<Claim>
            {
                new Claim(ClaimTypes.Name, "ValidUser"),
                new Claim(ClaimTypes.Role, "ApiAccess")
            };
            var identity = new ClaimsIdentity(claims, Scheme.Name);
            var principal = new ClaimsPrincipal(identity);
            var ticket = new AuthenticationTicket(principal, Scheme.Name);

            Context.Request.Headers["X-Custom-UserName"] = "ValidUser";
            Context.Request.Headers["X-Custom-UserRole"] = "ApiAccess";

            return await Task.FromResult(AuthenticateResult.Success(ticket));
        }
        catch (Exception ex)
        {
            return await Task.FromResult(AuthenticateResult.Fail($"认证异常：{ex.Message}"));
        }
    }
}

2. 简单登录演示

提示：生产环境建议将鉴权服务独立注册至 Nacos，此处仅为演示。

// 如果只是鉴权的，直接返回给客户端
if (Request.Path.ToString().StartsWith("/api/Auth"))
{
    Response.StatusCode = StatusCodes.Status200OK;
    Response.ContentType = "application/json";
    var success = JsonConvert.SerializeObject(new { code = 200, message = "Token 验证通过，登录成功！", isValid = true });
    await Response.WriteAsync(success);
    return AuthenticateResult.Success(new AuthenticationTicket(new ClaimsPrincipal(), Scheme.Name));
}

四、后端获取用户相关信息

说明：后端可直接读取请求头获取用户信息。