.Net Core Web Api_筆記32_採用cookie的身分驗證與授權

認證方式基本上

可以分為

Basic 認證

也就是將帳號:密碼進行Base64 編碼

Digest認證

也就是MD5

Bearer認證

->JWT採用

這裡新建好一個api專案後

目前這個資源請求是可被存取的回傳200 OK

這邊可以嘗試在此模板的Controller上加上這個修飾[Authorize]

主要代表針對當前這個控制器下所有Action預設都是被套用權限授權控管的

都需要登入後判定有無權限才可存取

範例程式碼

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

namespace CookieAuth.Controllers
{
    [ApiController]
    [Route("[controller]")]
    [Authorize]
    public class WeatherForecastController : ControllerBase
    {
        private static readonly string[] Summaries = new[]
        {
        "Freezing", "Bracing", "Chilly", "Cool", "Mild", "Warm", "Balmy", "Hot", "Sweltering", "Scorching"
    };

        private readonly ILogger<WeatherForecastController> _logger;

        public WeatherForecastController(ILogger<WeatherForecastController> logger)
        {
            _logger = logger;
        }

        [HttpGet(Name = "GetWeatherForecast")]
        public IEnumerable<WeatherForecast> Get()
        {
            return Enumerable.Range(1, 5).Select(index => new WeatherForecast
            {
                Date = DateTime.Now.AddDays(index),
                TemperatureC = Random.Shared.Next(-20, 55),
                Summary = Summaries[Random.Shared.Next(Summaries.Length)]
            })
            .ToArray();
        }
    }
}

再次運行時候會達到500的錯誤

System.InvalidOperationException: No authenticationScheme was specified, and there was no DefaultChallengeScheme found. The default schemes can be set using either AddAuthentication(string defaultScheme) or AddAuthentication(Action<AuthenticationOptions> configureOptions).
   at Microsoft.AspNetCore.Authentication.AuthenticationService.ChallengeAsync(HttpContext context, String scheme, AuthenticationProperties properties)
   at Microsoft.AspNetCore.Authorization.Policy.AuthorizationMiddlewareResultHandler.HandleAsync(RequestDelegate next, HttpContext context, AuthorizationPolicy policy, PolicyAuthorizationResult authorizeResult)
   at Microsoft.AspNetCore.Authorization.AuthorizationMiddleware.Invoke(HttpContext context)
   at Swashbuckle.AspNetCore.SwaggerUI.SwaggerUIMiddleware.Invoke(HttpContext httpContext)
   at Swashbuckle.AspNetCore.Swagger.SwaggerMiddleware.Invoke(HttpContext httpContext, ISwaggerProvider swaggerProvider)
   at Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware.Invoke(HttpContext context)

HEADERS
=======
Accept: text/plain
Connection: keep-alive
Host: localhost:5018
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.69
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-TW,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6
Referer: http://localhost:5018/swagger/index.html
sec-ch-ua: "Not_A Brand";v="99", "Microsoft Edge";v="109", "Chromium";v="109"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty

No authenticationScheme was specified, and there was no DefaultChallengeScheme found. The default schemes can be set using either AddAuthentication(string defaultScheme) or AddAuthentication(Action<AuthenticationOptions> configureOptions)

這裡可到github稍微去查找參考範例

到微軟的github

https://github.com/dotnet

搜尋DefaultChallengeScheme

https://github.com/dotnet/AspNetCore.Docs/blob/860ce848ef8a340af2256f403312d82caa3ae962/aspnetcore/security/authentication/claims/sample6/WebRPmapClaims/Program.cs

找到官方.net6版本的範例

#define FIRST // FIRST SECOND NAME NS 
#if NEVER
#elif FIRST
#region snippet1
using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Authentication.OpenIdConnect;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddRazorPages();

builder.Services.AddAuthentication(options =>
{
    options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
})
   .AddCookie()
   .AddOpenIdConnect(options =>
   {
       options.SignInScheme = "Cookies";
       options.Authority = "-your-identity-provider-";
       options.RequireHttpsMetadata = true;
       options.ClientId = "-your-clientid-";
       options.ClientSecret = "-your-client-secret-from-user-secrets-or-keyvault";
       options.ResponseType = "code";
       options.UsePkce = true;
       options.Scope.Add("profile");
       options.SaveTokens = true;
   });

var app = builder.Build();

if (!app.Environment.IsDevelopment())
{
    app.UseExceptionHandler("/Error");
    app.UseHsts();
}

app.UseHttpsRedirection();
app.UseStaticFiles();

app.UseAuthentication();
app.UseAuthorization();

app.MapRazorPages();

app.Run();
#endregion
#elif SECOND
#region snippet2
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Authentication.OpenIdConnect;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddRazorPages();

builder.Services.AddAuthentication(options =>
{
    options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
})
   .AddCookie()
   .AddOpenIdConnect(options =>
   {
       options.SignInScheme = "Cookies";
       options.Authority = "-your-identity-provider-";
       options.RequireHttpsMetadata = true;
       options.ClientId = "-your-clientid-";
       options.ClientSecret = "-client-secret-from-user-secrets-or-keyvault";
       options.ResponseType = "code";
       options.UsePkce = true;
       options.Scope.Add("profile");
       options.SaveTokens = true;
       options.GetClaimsFromUserInfoEndpoint = true;
       options.ClaimActions.MapUniqueJsonKey("preferred_username",
                                             "preferred_username");
       options.ClaimActions.MapUniqueJsonKey("gender", "gender");
   });

var app = builder.Build();

// Code removed for brevity.
#endregion

if (!app.Environment.IsDevelopment())
{
    app.UseExceptionHandler("/Error");
    app.UseHsts();
}

app.UseHttpsRedirection();
app.UseStaticFiles();

app.UseAuthentication();
app.UseAuthorization();

app.MapRazorPages();

app.Run();
#elif NAME
using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Authentication.OpenIdConnect;
using Microsoft.IdentityModel.Tokens;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddRazorPages();

#region snippet_name
builder.Services.AddAuthentication(options =>
{
    options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
})
  .AddCookie()
  .AddOpenIdConnect(options =>
  {
       // Other options...
       options.TokenValidationParameters = new TokenValidationParameters
       {
          NameClaimType = "email"
          //, RoleClaimType = "role"
       };
  });
#endregion
var app = builder.Build();

// Code removed for brevity.


if (!app.Environment.IsDevelopment())
{
    app.UseExceptionHandler("/Error");
    app.UseHsts();
}

app.UseHttpsRedirection();
app.UseStaticFiles();

app.UseAuthentication();
app.UseAuthorization();

app.MapRazorPages();

app.Run();
#elif NS
using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Authentication.OpenIdConnect;
using System.IdentityModel.Tokens.Jwt;
#region snippet_NS
var builder = WebApplication.CreateBuilder(args);

builder.Services.AddRazorPages();

JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();

builder.Services.AddAuthentication(options =>
{
    options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
})
   .AddCookie()
   .AddOpenIdConnect(options =>
   {
       options.SignInScheme = "Cookies";
       options.Authority = "-your-identity-provider-";
       options.RequireHttpsMetadata = true;
       options.ClientId = "-your-clientid-";
       options.ClientSecret = "-your-client-secret-from-user-secrets-or-keyvault";
       options.ResponseType = "code";
       options.UsePkce = true;
       options.Scope.Add("profile");
       options.SaveTokens = true;
   });

var app = builder.Build();

// Code removed for brevity.
#endregion

if (!app.Environment.IsDevelopment())
{
    app.UseExceptionHandler("/Error");
    app.UseHsts();
}

app.UseHttpsRedirection();
app.UseStaticFiles();

app.UseAuthentication();
app.UseAuthorization();

app.MapRazorPages();

app.Run();
#endif

在github預覽推薦安裝chrome插件(Octotree - GitHub code tree)增加左側樹狀倒覽

https://chrome.google.com/webstore/detail/octotree-github-code-tree/bkhaagjahfmjljalopjnoealnfndnagc/related

這邊我們切換到cookie的範例

官方.net6 cookie認證範例

我們可以看到需要到

Program.cs去補上這段配置

引入Microsoft.AspNetCore.Authentication.Cookies

並且服務註冊補上AddAuthentication以及AddCookie

builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)

.AddCookie();

配置認證的Middleware

app.UseAuthentication();

#define FIRST // FIRST SECOND CC
#if NEVER
#elif FIRST
#region snippet1
using Microsoft.AspNetCore.Authentication.Cookies;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddRazorPages();
builder.Services.AddControllersWithViews();

builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddCookie();

builder.Services.AddHttpContextAccessor();

var app = builder.Build();

if (!app.Environment.IsDevelopment())
{
    app.UseExceptionHandler("/Error");
    app.UseHsts();
}

app.UseHttpsRedirection();
app.UseStaticFiles();

app.UseAuthentication();
app.UseAuthorization();

app.MapRazorPages();
app.MapDefaultControllerRoute();

app.Run();
#endregion
#elif SECOND
#region snippet2
using Microsoft.AspNetCore.Authentication.Cookies;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddRazorPages();
builder.Services.AddControllersWithViews();

builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddCookie(options =>
    {
        options.ExpireTimeSpan = TimeSpan.FromMinutes(20);
        options.SlidingExpiration = true;
        options.AccessDeniedPath = "/Forbidden/";
    });

builder.Services.AddSingleton<IHttpContextAccessor, HttpContextAccessor>();

var app = builder.Build();

if (!app.Environment.IsDevelopment())
{
    app.UseExceptionHandler("/Error");
    app.UseHsts();
}

app.UseHttpsRedirection();
app.UseStaticFiles();

app.UseAuthentication();
app.UseAuthorization();

app.MapRazorPages();
app.MapDefaultControllerRoute();

app.Run();
#endregion
#elif CC
#region snippet_cc
using Microsoft.AspNetCore.Authentication.Cookies;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddRazorPages();
builder.Services.AddControllersWithViews();

builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddCookie(options =>
    {
        options.EventsType = typeof(CustomCookieAuthenticationEvents);
    });

builder.Services.AddScoped<CustomCookieAuthenticationEvents>();

var app = builder.Build();

if (!app.Environment.IsDevelopment())
{
    app.UseExceptionHandler("/Error");
    app.UseHsts();
}

app.UseHttpsRedirection();
app.UseStaticFiles();

app.UseAuthentication();
app.UseAuthorization();

app.MapRazorPages();
app.MapDefaultControllerRoute();

app.Run();
#endregion
#endif

當補完程式後再次訪問出現404

這個時候若想要得知更仔細的問題點

可以cmd開啟用curl來運行請求

可以到curl for Windows來補安裝這個CLI

https://curl.se/windows/

這裡可以用

curl -I webapi路由

curl -I http://localhost:5018/WeatherForecast

(-i 代表header + body ，只要 header使用大寫的 I 。)

那就可以更明確得知問題點

在回到github切到別支程式檔案來看

在aspnetcore/security/authentication/cookie/samples/6.x/CookieSample/Pages/Account/Login.cshtml.cs

當中我們主要需用到的程式碼就是

post提交登入表單的函數

if (ModelState.IsValid) 裡面整段block當中部分程式碼

都是我們有需要的

該有的namespace引入記得

using Microsoft.AspNetCore.Authentication;

using Microsoft.AspNetCore.Authentication.Cookies;

using System.Security.Claims;

 #region snippet1
        public async Task<IActionResult> OnPostAsync(string returnUrl = null)
        {
            ReturnUrl = returnUrl;

            if (ModelState.IsValid)
            {
                // Use Input.Email and Input.Password to authenticate the user
                // with your custom authentication logic.
                //
                // For demonstration purposes, the sample validates the user
                // on the email address maria.rodriguez@contoso.com with 
                // any password that passes model validation.

                var user = await AuthenticateUser(Input.Email, Input.Password);

                if (user == null)
                {
                    ModelState.AddModelError(string.Empty, "Invalid login attempt.");
                    return Page();
                }

                var claims = new List<Claim>
                {
                    new Claim(ClaimTypes.Name, user.Email),
                    new Claim("FullName", user.FullName),
                    new Claim(ClaimTypes.Role, "Administrator"),
                };

                var claimsIdentity = new ClaimsIdentity(
                    claims, CookieAuthenticationDefaults.AuthenticationScheme);

                var authProperties = new AuthenticationProperties
                {
                    //AllowRefresh = <bool>,
                    // Refreshing the authentication session should be allowed.

                    //ExpiresUtc = DateTimeOffset.UtcNow.AddMinutes(10),
                    // The time at which the authentication ticket expires. A 
                    // value set here overrides the ExpireTimeSpan option of 
                    // CookieAuthenticationOptions set with AddCookie.

                    //IsPersistent = true,
                    // Whether the authentication session is persisted across 
                    // multiple requests. When used with cookies, controls
                    // whether the cookie's lifetime is absolute (matching the
                    // lifetime of the authentication ticket) or session-based.

                    //IssuedUtc = <DateTimeOffset>,
                    // The time at which the authentication ticket was issued.

                    //RedirectUri = <string>
                    // The full path or absolute URI to be used as an http 
                    // redirect response value.
                };

                await HttpContext.SignInAsync(
                    CookieAuthenticationDefaults.AuthenticationScheme, 
                    new ClaimsPrincipal(claimsIdentity), 
                    authProperties);

                _logger.LogInformation("User {Email} logged in at {Time}.", 
                    user.Email, DateTime.UtcNow);

                return LocalRedirect(Url.GetLocalUrl(returnUrl));
            }

            // Something failed. Redisplay the form.
            return Page();
        }
        #endregion

在來還有登出的功能

https://github.com/dotnet/AspNetCore.Docs/blob/860ce848ef/aspnetcore/security/authentication/cookie/samples/6.x/CookieSample/Pages/Account/SignedOut.cshtml.cs

可看到對應試跑至Index路由

這時就要回到Account 控制器當中搜尋

https://github.com/dotnet/AspNetCore.Docs/blob/860ce848ef/aspnetcore/security/authentication/cookie/samples/6.x/CookieSample/Controllers/AccountController.cs

這邊我們回到Program.cs去補上這段配置(加入登入登出功能)

using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authentication.Cookies;
using System.Security.Claims;

var builder = WebApplication.CreateBuilder(args);

// Add services to the container.

builder.Services.AddControllers();
builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddCookie();

// Learn more about configuring Swagger/OpenAPI at https://aka.ms/aspnetcore/swashbuckle
builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen();

var app = builder.Build();

// Configure the HTTP request pipeline.
if (app.Environment.IsDevelopment())
{
    app.UseSwagger();
    app.UseSwaggerUI();
}
app.UseAuthentication();
app.UseAuthorization();

app.MapControllers();

app.MapGet("/login",async context =>
{
    var claims = new List<Claim>
                {
                    new Claim(ClaimTypes.Name, "test@gmail.com"),
                    new Claim("FullName", "Kevin"),
                    new Claim(ClaimTypes.Role, "Administrator"),
                };

    var claimsIdentity = new ClaimsIdentity(
        claims, CookieAuthenticationDefaults.AuthenticationScheme);

    var authProperties = new AuthenticationProperties
    {
        //AllowRefresh = <bool>,
        // Refreshing the authentication session should be allowed.

        //ExpiresUtc = DateTimeOffset.UtcNow.AddMinutes(10),
        // The time at which the authentication ticket expires. A 
        // value set here overrides the ExpireTimeSpan option of 
        // CookieAuthenticationOptions set with AddCookie.

        //IsPersistent = true,
        // Whether the authentication session is persisted across 
        // multiple requests. When used with cookies, controls
        // whether the cookie's lifetime is absolute (matching the
        // lifetime of the authentication ticket) or session-based.

        //IssuedUtc = <DateTimeOffset>,
        // The time at which the authentication ticket was issued.

        //RedirectUri = <string>
        // The full path or absolute URI to be used as an http 
        // redirect response value.
    };

    await context.SignInAsync(
        CookieAuthenticationDefaults.AuthenticationScheme,
        new ClaimsPrincipal(claimsIdentity),
        authProperties);

    await context.Response.WriteAsync("login is ok");
});


app.MapGet("/logout", async context =>
{
    await context.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
});

app.Run();

在這裡我們可用cmd curl來觸發

先執行 login

curl -v http://localhost:5018/login

(透過 -v 或 –verbose 讓 curl 輸出更詳細的訊息)

可以看到拿到一串set-cookie

此時若回到swag去做api訪問仍舊404回傳

這邊可以複製curl指令並補上 cookie的參數

curl -v http://localhost:5018/WeatherForecast --cookie "Cookie: .AspNetCore.Cookies=CfDJ8OE0_gjsOQpHlb96kRjU9LOl6kd1QFZwwHDubN2gdNe0uhBOu7sTpOUf2b1ygD9shHyfkB1OL6KgXeKK6usnSwKQhWZOqf7w9usGlDDJr-mgWjwUsbx12lqOJFXwrZxAvzn7QL7xYSc3EGdkCjkIAxQNX-RdCdBEWqn_FCSSN6jY8js07vVMg76JnqVD-cfUlRUPvupwKgCWwk5KF1KfjlYgXt_Un-mSYsdVMJgBBR0lvHxvxG8zHCUfw562Hdyd09RiEuatp2E_nrotT3YUHf7ALH6OwmF-prgMX67nsGprcPWYDUqcLkAuBR1E36Qqrv8Zgmljzfx2nHkhgEQnxCNJcn9yjyjzrbghNyq2vX3rQJJ0tq9rrguGrmSFznYdPynGRiC1muQmkihXUnDKGo6r93sDQ1cPhCltOQDA3-FkrBX0zBdcTVlpEQI8SSVAwCENaU21pckF0xVYtN2ZX8o"

Set-之後的到分號結尾

就可以成功存取到資源

那可以再嘗試登出

並重新再次訪問存取資源(帶cookie)會發現還是存取到資源!!!

可換成browser操作

一樣先存取資源 (沒辦法)

做登入 OK後再次存取資源(成功)

做登出 OK後再次存取資源(失敗)

原因在於

.net6 API 登出這段會將browser 的cookie清空

但cmd中curl已經記憶起來因此就算執行登出後再次同樣的cookie附帶後資源訪問仍然可以訪問的到

如何得知cookie認證一些失效時間以及相關資訊

可以擴充一個action於WeatherForecastController

進行測試

using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using System.Text;

namespace CookieAuth.Controllers
{
    [ApiController]
    [Route("[controller]")]
    [Authorize]
    public class WeatherForecastController : ControllerBase
    {
        private static readonly string[] Summaries = new[]
        {
        "Freezing", "Bracing", "Chilly", "Cool", "Mild", "Warm", "Balmy", "Hot", "Sweltering", "Scorching"
    };

        private readonly ILogger<WeatherForecastController> _logger;

        public WeatherForecastController(ILogger<WeatherForecastController> logger)
        {
            _logger = logger;
        }

        [HttpGet(Name = "GetWeatherForecast")]
        public IEnumerable<WeatherForecast> Get()
        {
            return Enumerable.Range(1, 5).Select(index => new WeatherForecast
            {
                Date = DateTime.Now.AddDays(index),
                TemperatureC = Random.Shared.Next(-20, 55),
                Summary = Summaries[Random.Shared.Next(Summaries.Length)]
            })
            .ToArray();
        }

        [HttpGet]
        [Route("get1")]
        public string GetCookieInfo()
        {
            StringBuilder sb = new StringBuilder();
            sb.AppendLine(User.Identity!.Name);
            sb.AppendLine(User.Identity!.AuthenticationType);
            sb.AppendLine(User.Identity!.IsAuthenticated.ToString());
            sb.AppendLine(User.Identity!.ToString());

            var items = Request.HttpContext.AuthenticateAsync().Result;
            foreach (var item in items.Properties!.Items)
            {
                sb.AppendLine(item.Key + "," + item.Value);
            }

            return sb.ToString();
        }



    }
}

一樣先login完再做action訪問

Response body

Download

test@gmail.com

True

System.Security.Claims.ClaimsIdentity

.issued,Fri, 27 Jan 2023 18:32:07 GMT

.expires,Fri, 10 Feb 2023 18:32:07 GMT

可看到1/27 ~ 到有效日2/10 預設是兩周時間(14天有效)

若針對這些配置想要客製化則可以參考到官方範例程式碼

https://github.com/dotnet/AspNetCore.Docs/blob/860ce848ef/aspnetcore/security/authentication/cookie/samples/6.x/CookieSample/Program.cs

Program.cs當中的#region snippet2

builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddCookie(options =>
    {
        options.ExpireTimeSpan = TimeSpan.FromMinutes(20);
        options.SlidingExpiration = true;
        options.AccessDeniedPath = "/Forbidden/";
    });

CookieAuthenticationOptions.ExpireTimeSpan 屬性

控制 cookie 要多少時間才能從其建立點起保持有效。過期資訊位於受保護的 cookie 票券中。因此，即使在瀏覽器應該加以清除之後會傳送至伺服器，會忽略過期的 cookie。

用戶頁面停留太久，登入逾期有效時長。

CookieAuthenticationOptions.SlidingExpiration 屬性

SlidingExpiration 設為 true，以指示中介軟體重新簽發處理時具有新過期時間的 cookie，其比透過過期視窗能省下一半的時間。(換言之，在cookie快到期的時候會重新頒發個cookie。)

資安建議false，白箱弱掃軟體會被要求cookie不能延展效期。

設false變成絕對逾期時間

如果用戶反應明明一直有在使用系統卻容易被自動登出的話，再設為true。

CookieAuthenticationOptions.AccessDeniedPath 屬性

AccessDeniedPath 屬性會通知中介軟體應該將傳出 403 禁止狀態碼變更為 302 重新導向至指定的路徑。

若不是每一個action都想要被受權限控管(換言之存取特定某api action不需先登入)

則可以加上[AllowAnonymous]修飾詞

        [AllowAnonymous]
        [HttpGet(Name = "GetWeatherForecast")]
        public IEnumerable<WeatherForecast> Get()
        {
            return Enumerable.Range(1, 5).Select(index => new WeatherForecast
            {
                Date = DateTime.Now.AddDays(index),
                TemperatureC = Random.Shared.Next(-20, 55),
                Summary = Summaries[Random.Shared.Next(Summaries.Length)]
            })
            .ToArray();
        }

就可直接存取到資源不顯示404 not found

Ref:

https://learn.microsoft.com/zh-tw/dotnet/api/microsoft.aspnetcore.authentication.authenticationhttpcontextextensions.signinasync?view=aspnetcore-7.0

https://learn.microsoft.com/zh-tw/dotnet/api/microsoft.aspnetcore.authentication.authenticationhttpcontextextensions.signoutasync?view=aspnetcore-7.0

https://xenby.com/b/232-%E6%8E%A8%E8%96%A6-%E6%A8%B9%E7%8B%80%E7%B5%90%E6%A7%8B%E9%A1%AF%E7%A4%BAgithub%E5%B0%88%E6%A1%88%E7%B5%90%E6%A7%8B%E7%80%8F%E8%A6%BD%E5%99%A8%E5%B7%A5%E5%85%B7-octotree

https://dotblogs.com.tw/shadow/2019/01/16/105615

https://charlie-c.me/post/curl/

https://hugh-program-learning-diary-js.medium.com/%E7%B6%B2%E8%B7%AF%E5%9F%BA%E7%A4%8E%E6%A6%82%E8%AB%96-%E5%A5%BD%E7%94%A8%E7%9A%84%E5%B7%A5%E5%85%B7%E8%88%87%E6%8C%87%E4%BB%A4-2f2358ee816f

http://evelynnote.blogspot.com/2011/03/curl.html

https://blog.csdn.net/u010476739/article/details/104474850

https://www.51cto.com/article/698096.html

(2021年度)駕訓學科筆試準備題庫歸納分析_法規是非題

- 8月 18, 2021

若是出現「必須」、「必需」、「...必...」、「應由」、「應先」、「應...」則很高機率是圈是非通常只要是如下字眼「不必」+動詞、「不需」「不須」、「可不」、「可以不」、「可立即」有出現或符合的都選叉 (X)1.違規記點又不登記在駕照上，所以可以不必理會而任意違反交通規則。 (X)2.發生重大交通事故，為迅速恢復交通，清除現場，可不必等待肇事處理機關之指示，即可進行。 (X)3.道路駕駛練習，行車前不必實施車輛安全檢查，因為那是駕駛教練的工作。 (X)4.開車前，不必檢查機件安全，但在行駛中要隨時注意儀錶功能顯示，確保行車安全。 (X)5.煞車油若經常低於"MIN"線，只要添加即可，不必到修理廠檢修。 (X)6.冷卻系統只要副水箱在滿水位，主水箱不必檢查也不會有問題。 (X)7.引擎冷卻水內含有防凍液或防銹劑，可不必更換。 (X)8.儀錶板上的「燃油油量錶」之指針高度，已經降低至「E」點，橘色的「低油料警示燈」點亮時，不必急著加油，到達目的地後再行補充燃油即可。 (X)9.有安全氣囊裝備的汽車，不必繫安全帶。 (X)10.煞車時有異音，是正常的情況，不必檢修。 (X)11.汽車定期檢驗不必檢驗車輛故障標誌，所以隨車不一定要帶車輛故障標誌。 (X)12.開車時不必理會義交之指揮，一切以號誌為主。 (X)13.汽車經過隧道，因隧道內燈光明亮視線良好，為省電可不必開亮頭燈。 (X)14.駕駛人只求技術優良，對遵守交通規則不必太重視。 (X)15.在開車前，不必檢查機件，以免耽誤行車時間。 (X)16.遇幼童專用車、校車、身心障礙者用特製車或教練車，不必禮讓。 (X)17.行車不必攜帶隨車工具。 (X)18.行車起駛前進，不必顯示方向燈。 (X)19.汽車通過鐵路平交道，前後兩車間，不必保持距離。 (X)20.夜間將車輛停放在無燈光設備及照明不清之道路時，亦不必顯示停車燈光或反光標識。 (X)21.在夜間或有霧靄、雨雪、風沙及晝晦時，把車輛停在路旁，不必顯示停車燈光或反光標識。 (X)22.汽車駕駛人，僅需具有優良駕駛技術，不需具備急救的常識和技能。 (X)23.汽車車身、引擎、底盤、電系等重要設備變更或調換時，不需向公路主管機關申請臨時檢驗。

閱讀完整內容

搜尋此網誌

第25個冬天

.Net Core Web Api_筆記32_採用cookie的身分驗證與授權

留言

張貼留言

這個網誌中的熱門文章

何謂淨重(Net Weight)、皮重(Tare Weight)與毛重(Gross Weight)

Architecture(架構) 和 Framework(框架) 有何不同?_軟體設計前的事前規劃的藍圖概念

(2021年度)駕訓學科筆試準備題庫歸納分析_法規是非題