Asp.netWebAPiRestful的实现和跨域

现在实际开发中用webapi来实现Restful接口开发很多&＃xff0c;我们项目组前一段时间也在用这东西&＃xff0c;发现大家用的还是不那么顺畅&＃xff0c;所以这里写一个Demo给大家讲解一下&＃xff0c;我的出发点不是如何实现&＃xff0c;而是为什么&＃xff1f;

首先我们来看看我么的code吧&＃xff1a;

control:

HTML:

WebAPI的配置&＃xff1a;

首先说明一下&＃xff0c;配置中的httpProtocol和control中的Options都是在跨域的时候才需要的。

问题1.

Get,Post,Put,Delete,Options 这几个方法 &＃xff0c;服务器端是怎么来定位的&＃xff0c; 或者说服务器是如何确定是调用哪个Action&＃xff1f;

其实我以前的文章 Asp.net web Api源码分析-HttpActionDescriptor的创建 中有提到&＃xff0c;这里简单回忆一下&＃xff1a;

首先我们客户端的请求Url中都是 http://localhost:6221/api/values/ 打头&＃xff0c;这里的values就是我们的Control&＃xff0c;这样我们就可以很容易找到这个control下面的方法。主要的类是ApiControllerActionSelector&＃xff0c;在它里面有一个子类ActionSelectorCacheItem&＃xff0c; 其构造函数就负责初始化control里面的ReflectedHttpActionDescriptor&＃xff0c;

MethodInfo[] allMethods &＃61; _controllerDescriptor.ControllerType.GetMethods(BindingFlags.Instance | BindingFlags.Public);
MethodInfo[] validMethods &＃61; Array.FindAll(allMethods, IsValidActionMethod);

_actionDescriptors &＃61; new ReflectedHttpActionDescriptor[validMethods.Length];
for (int i &＃61; 0; i {
MethodInfo method &＃61; validMethods[i];
ReflectedHttpActionDescriptor actionDescriptor &＃61; new ReflectedHttpActionDescriptor(_controllerDescriptor, method);
_actionDescriptors[i] &＃61; actionDescriptor;
HttpActionBinding actionBinding &＃61; actionDescriptor.ActionBinding;

// Building an action parameter name mapping to compare against the URI parameters coming from the request. Here we only take into account required parameters that are simple types and come from URI.
_actionParameterNames.Add(
actionDescriptor,
actionBinding.ParameterBindings
.Where(binding &＃61;> !binding.Descriptor.IsOptional && TypeHelper.IsSimpleUnderlyingType(binding.Descriptor.ParameterType) && binding.WillReadUri())
.Select(binding &＃61;> binding.Descriptor.Prefix ?? binding.Descriptor.ParameterName).ToArray());
}

_actionNameMapping &＃61; _actionDescriptors.ToLookup(actionDesc &＃61;> actionDesc.ActionName, StringComparer.OrdinalIgnoreCase);

int len &＃61; _cacheListVerbKinds.Length;
_cacheListVerbs &＃61; new ReflectedHttpActionDescriptor[len][];
for (int i &＃61; 0; i {
_cacheListVerbs[i] &＃61; FindActionsForVerbWorker(_cacheListVerbKinds[i]);
}

这里的validMethods 就是我们定义6个方法&＃xff08;2个Get,Post,Put,Delete,Options&＃xff09;&＃xff0c;在ReflectedHttpActionDescriptor里面的InitializeProperties 的实现如下&＃xff1a;

private void InitializeProperties(MethodInfo methodInfo)
{
_methodInfo &＃61; methodInfo;
_returnType &＃61; GetReturnType(methodInfo);
_actionExecutor &＃61; new Lazy(() &＃61;> InitializeActionExecutor(_methodInfo));
_attrCached &＃61; _methodInfo.GetCustomAttributes(inherit: true);
CacheAttrsIActionMethodSelector &＃61; _attrCached.OfType().ToArray();
_actionName &＃61; GetActionName(_methodInfo, _attrCached);
_supportedHttpMethods &＃61; GetSupportedHttpMethods(_methodInfo, _attrCached);
}

private static Collection GetSupportedHttpMethods(MethodInfo methodInfo, object[] actionAttributes){Collection supportedHttpMethods &＃61; new Collection();ICollection httpMethodProviders &＃61; TypeHelper.OfType(actionAttributes);if (httpMethodProviders.Count > 0){// Get HttpMethod from attributesforeach (IActionHttpMethodProvider httpMethodSelector in httpMethodProviders){foreach (HttpMethod httpMethod in httpMethodSelector.HttpMethods){supportedHttpMethods.Add(httpMethod);}}}else{// Get HttpMethod from method name convention for (int i &＃61; 0; i <_supportedHttpMethodsByConvention.Length; i&＃43;&＃43;){if (methodInfo.Name.StartsWith(_supportedHttpMethodsByConvention[i].Method, StringComparison.OrdinalIgnoreCase)){supportedHttpMethods.Add(_supportedHttpMethodsByConvention[i]);break;}}}if (supportedHttpMethods.Count &＃61;&＃61; 0){// Use POST as the default HttpMethod
supportedHttpMethods.Add(HttpMethod.Post);}return supportedHttpMethods;}private static readonly HttpMethod[] _supportedHttpMethodsByConvention &＃61; { HttpMethod.Get, HttpMethod.Post, HttpMethod.Put, HttpMethod.Delete, HttpMethod.Head, HttpMethod.Options, new HttpMethod("PATCH") };

View Code

GetSupportedHttpMethods判断当前action支持的请求类型&＃xff0c;首先读取HttpMethod attributes&＃xff0c;如果没有我们就读取action的name&＃xff08;Get,Post,Put,Delete,Options&＃xff09;&＃xff0c;所以put 方法支持put httpmethod。实在没有httpmethod就添加默认的post。

现在我们来看看_cacheListVerbs里面放的是什么东西&＃xff1f; 

private readonly HttpMethod[] _cacheListVerbKinds &＃61; new HttpMethod[] { HttpMethod.Get, HttpMethod.Put, HttpMethod.Post };

private ReflectedHttpActionDescriptor[] FindActionsForVerbWorker(HttpMethod verb)
{
List listMethods &＃61; new List();

foreach (ReflectedHttpActionDescriptor descriptor in _actionDescriptors)
{
if (descriptor.SupportedHttpMethods.Contains(verb))
{
listMethods.Add(descriptor);
}
}

return listMethods.ToArray();
}

到这里么知道_cacheListVerbs里面放的就是Get&＃xff0c;Put&＃xff0c;Post对应的action&＃xff0c;方便后面通过http request type来查找action。

现在action list已经准备好了&＃xff0c;然后确定该调用哪个了&＃xff1f;在ActionSelectorCacheItem类里面有SelectAction。主要逻辑如下&＃xff1a;

string actionName;
bool useActionName &＃61; controllerContext.RouteData.Values.TryGetValue(ActionRouteKey, out actionName);

ReflectedHttpActionDescriptor[] actionsFoundByHttpMethods;

HttpMethod incomingMethod &＃61; controllerContext.Request.Method;

// First get an initial candidate list.
if (useActionName)
{
.......................................
}
else
{
// No {action} parameter, infer it from the verb.
actionsFoundByHttpMethods &＃61; FindActionsForVerb(incomingMethod);
}

// Throws HttpResponseException with MethodNotAllowed status because no action matches the Http Method
if (actionsFoundByHttpMethods.Length &＃61;&＃61; 0)
{
throw new HttpResponseException(controllerContext.Request.CreateErrorResponse(
HttpStatusCode.MethodNotAllowed,
Error.Format(SRResources.ApiControllerActionSelector_HttpMethodNotSupported, incomingMethod)));
}

// Make sure the action parameter matches the route and query parameters. Overload resolution logic is applied when needed.
IEnumerable actionsFoundByParams &＃61; FindActionUsingRouteAndQueryParameters(controllerContext, actionsFoundByHttpMethods, useActionName);

首先从路由里面获取actionname&＃xff0c;restful请求地址都不含有actionname&＃xff0c; 那么就从请求type里面获取action了&＃xff0c;即这里的FindActionsForVerb方法&＃xff0c;该方法首先从_cacheListVerbs里面找&＃xff0c;如果没有找到再在当前control的所有action里面找&＃xff0c;比如Delete,Options在_cacheListVerbs是没有的。 如果通过FindActionsForVerb找到的action是多个&＃xff0c;那么久需要通过FindActionUsingRouteAndQueryParameters方法来过滤了&＃xff0c;该方法首先读取route和query参数&＃xff0c;查看是否满足action需要的参数。

如这里的get action&＃xff0c;如果请求地址是http://localhost:6221/api/values 这个&＃xff0c;那么Get(int id)肯定要被过滤掉&＃xff0c;因为它需要参数id&＃xff0c;但是这里没有参数id&＃xff0c;所以只能返回Get() 了。如果地址http://localhost:6221/api/values/1的话&＃xff0c;那么这里的2个action都满足条件 &＃xff0c;我们就取参数多的那个action。

if (actionsFound.Count() > 1)
{
// select the results that match the most number of required parameters
actionsFound &＃61; actionsFound
.GroupBy(descriptor &＃61;> _actionParameterNames[descriptor].Length)
.OrderByDescending(g &＃61;> g.Key)
.First();
}

到这里大家就应该知道后台是如何获取action的了吧。一句话&＃xff0c;把Request.Method作为actionname。

2.浏览器跨域问题。

其实网上已经有很多说明&＃xff1a;

详解XMLHttpRequest的跨域资源共享

Angular通过CORS实现跨域方案

利用CORS实现跨域请求

在网上找的这张图&＃xff0c;并不是所有的跨域请求 都有Options预请求&＃xff0c;简单跨域是不需要。

一个简单的请求应该满足如下要求&＃xff1a;

1.请求方法为GET&＃xff0c;POST 这里是否包含HEAD我不怎么清楚&＃xff0c;没测试过&＃xff0c;还有HEAD我实际也没有用到
2.请求方法中没有设置请求头(Accept, Accept-Language, Content-Language, Content-Type除外)如果设置了Content-Type头&＃xff0c;其值为application/x-www-form-urlencoded, multipart/form-data或 text/plain

常用的复杂请求是&＃xff1a;发送PUT、DELETE等HTTP动作&＃xff0c;或者发送Content-Type: application/json的内容&＃xff0c;来看看预请求的请求头和返回头&＃xff1a;

• Access-Control-Allow-Origin&＃xff08;必含&＃xff09;- 不可省略&＃xff0c;否则请求按失败处理。该项控制数据的可见范围&＃xff0c;如果希望数据对任何人都可见&＃xff0c;可以填写“*”。
• Access-Control-Allow-Methods&＃xff08;必含&＃xff09; – 这是对预请求当中Access-Control-Request-Method的回复&＃xff0c;这一回复将是一个以逗号分隔的列表。尽管客户端或许只请求某一方法&＃xff0c;但服务端仍然可以返回所有允许的方法&＃xff0c;以便客户端将其缓存。
• Access-Control-Allow-Headers&＃xff08;当预请求中包含Access-Control-Request-Headers时必须包含&＃xff09; – 这是对预请求当中Access-Control-Request-Headers的回复&＃xff0c;和上面一样是以逗号分隔的列表&＃xff0c;可以返回所有支持的头部。
• Access-Control-Allow-Credentials&＃xff08;可选&＃xff09; – 该项标志着请求当中是否包含COOKIEs信息&＃xff0c;只有一个可选值&＃xff1a;true&＃xff08;必为小写&＃xff09;。如果不包含COOKIEs&＃xff0c;请略去该项&＃xff0c;而不是填写false。这一项与XmlHttpRequest2对象当中的withCredentials属性应保持一致&＃xff0c;即withCredentials为true时该项也为true&＃xff1b;withCredentials为false时&＃xff0c;省略该项不写。反之则导致请求失败。
• Access-Control-Max-Age&＃xff08;可选&＃xff09; – 以秒为单位的缓存时间。预请求的的发送并非免费午餐&＃xff0c;允许时应当尽可能缓存。

一旦预回应如期而至&＃xff0c;所请求的权限也都已满足&＃xff0c;则实际请求开始发送。

Credentials

在跨域请求中&＃xff0c;默认情况下&＃xff0c;HTTP Authentication信息&＃xff0c;COOKIE头以及用户的SSL证书无论在预检请求中或是在实际请求都是不会被发送的。但是&＃xff0c;通过设置XMLHttpRequest的credentials为true&＃xff0c;就会启用认证信息机制。

虽然简单请求还是不需要发送预检请求&＃xff0c;但是此时判断请求是否成功需要额外判断Access-Control-Allow-Credentials&＃xff0c;如果Access-Control-Allow-Credentials为false&＃xff0c;请求失败。

十分需要注意的的一点就是此时Access-Control-Allow-Origin不能为通配符"*"(真是便宜了一帮偷懒的程序员)&＃xff0c;如果Access-Control-Allow-Origin是通配符"*"的话&＃xff0c;仍将认为请求失败

即便是失败的请求&＃xff0c;如果返回头中有Set-COOKIE的头&＃xff0c;浏览器还是会照常设置COOKIE。

有不当之处欢迎拍砖。下载地址 http://download.csdn.net/detail/dz45693/9486586