C#：Swagger/Swashbuckle用"AND“连接安全方案

Question

我有一个ASP.NET核心Api，它需要在一个操作中使用多个身份验证方案。我试图通过在Swagger中显示所有所需的身份验证方案来记录这些操作。因此，我使用Swashbuckle.AspNetCore (5.1.0)库将OpenApiSecurityRequirement动态添加到IOperationFilter中的OpenApiOperation中

if (authorizeAttributes.Any(x => x.AuthenticationSchemes.Contains(InternalControllerBasicAuthentication.AuthenticationScheme)))
{
       requirements.Add(new OpenApiSecurityRequirement
       {
             {
                   new OpenApiSecurityScheme {
                        Reference = new OpenApiReference {
                            Type = ReferenceType.SecurityScheme,
                            Id = "credentials"
                        }
                   },
                   new [] { "Basic <credentials-value>" }
             }
      });
} 

if (authorizeAttributes.Any(x => x.AuthenticationSchemes.Contains(OneTimePasswordAuthentication.AuthenticationScheme)))
{
      requirements.Add(new OpenApiSecurityRequirement
      {
             {
                   new OpenApiSecurityScheme {
                        Reference = new OpenApiReference {
                            Type = ReferenceType.SecurityScheme,
                            Id = "one-time-password"
                        }
                   },
                   new [] { "Basic <one-time-password-value>" }
             }
      });
}

operation.Security = new List<OpenApiSecurityRequirement>(requirements);

此外，我还使用SwaggerGenOptions注册所有可能的方案：

var oneTimePasswordScheme = new OpenApiSecurityScheme
{
    Name = "one-time-password",
    In = ParameterLocation.Header,
    Scheme = "one-time-password",
    Type = SecuritySchemeType.ApiKey
};

options.AddSecurityDefinition("one-time-password", oneTimePasswordScheme);

var credentialsScheme = new OpenApiSecurityScheme
{
    Name = "credentials",
    In = ParameterLocation.Header,
    Scheme = "credentials",
    Type = SecuritySchemeType.ApiKey
};

options.AddSecurityDefinition("credentials", credentialsScheme);

除了在UI中使用OR连接器的Swagger之外，一切正常：

​

​

有没有一种使用AND连接器配置Swagger的方法？

任何帮助都将不胜感激！

Answer 1

与其为每个OpenApiSecurityScheme添加一个OpenApiSecurityScheme，还需要将所有OpenApiSecurityScheme对象放到一个OpenApiSecurityRequirement中。

将安全要求与或连接起来

var requirements = new List<OpenApiSecurityRequirement>();
requirements.Add(new OpenApiSecurityRequirement
{
    {
        new OpenApiSecurityScheme {
            Reference = new OpenApiReference {
                Type = ReferenceType.SecurityScheme,
                Id = "scheme-1"
            }
        },
        new [] { "scheme-1-value" }
    }
});

requirements.Add(new OpenApiSecurityRequirement
{
    {
        new OpenApiSecurityScheme {
            Reference = new OpenApiReference {
                Type = ReferenceType.SecurityScheme,
                Id = "scheme-2"
            }
        },
        new [] { "scheme-2-value" }
    }
});

operation.Security = new List<OpenApiSecurityRequirement>(requirements);

将安全需求与和连接起来

var requirement = new OpenApiSecurityRequirement();
requirement.Add(new OpenApiSecurityScheme {
        Reference = new OpenApiReference {
            Type = ReferenceType.SecurityScheme,
            Id = "scheme-1"
        }
    },
    new [] { "scheme-1-value" }
);

requirement.Add(new OpenApiSecurityScheme {
        Reference = new OpenApiReference {
            Type = ReferenceType.SecurityScheme,
            Id = "scheme-2"
        }
    },
    new [] { "scheme-2-value" }
);

operation.Security = new List<OpenApiSecurityRequirement> { requirement };