<\/div>\n

$\"Asp.NET$ <\/a>Merhaba,
\n
\nBu i\u00e7eri\u011fimizde, Asp.NET Core mimarisinde kullan\u0131c\u0131ya ait kimlik do\u011frulama oturumunu (authentication ticket) sunucu taraf\u0131nda saklamam\u0131z\u0131 sa\u011flayan ITicketStore<\/code> aray\u00fcz\u00fcn\u00fc ele al\u0131yor olaca\u011f\u0131z.<\/p>\n

`ITicketStore Nedir?<\/h4>\nAsp.NET Core mimarisinde, \u00f6zellikle Cookie Authentication kullan\u0131rken, kullan\u0131c\u0131n\u0131n t\u00fcm kimlik bilgilerinin ve claim’lerinin taray\u0131c\u0131ya g\u00f6nderilen cookie i\u00e7erisinde ta\u015f\u0131maktansa, bu bilgileri Redis, veritaban\u0131 yahut ba\u015fka bir harici depoda tutmak isteyebiliriz.<\/p>\n`
`ITicketStore<\/code>, do\u011frudan kullan\u0131c\u0131lar\u0131 veya parolalar\u0131 saklamamakta, kullan\u0131c\u0131n\u0131n oturumunu temsil eden AuthenticationTicket<\/code> nesnesini saklamaktad\u0131r. Asp.NET Core ise bu mekanizmay\u0131 CookieAuthenticationOptions.SessionStore<\/code> \u00fczerinden kullanmaktad\u0131r.<\/em><\/p><\/blockquote>\n`
Normal Cookie Authentication ak\u0131\u015f\u0131n\u0131 d\u00fc\u015f\u00fcn\u00fcrsek e\u011fer; kullan\u0131c\u0131 giri\u015f yapar, AuthenticationTicket<\/code>(\u015fifrelenmi\u015f ve imzalanm\u0131\u015f kimlik bilgileri, claim’ler ve oturum \u00f6zellikleri) cookie’ye yaz\u0131l\u0131r ve taray\u0131c\u0131 her istekte cookie’yi g\u00f6nderir. Bu y\u00f6ntem \u00e7o\u011fu uygulama i\u00e7in gayet yeterli olsa da esas\u0131nda kullan\u0131c\u0131ya ait \u00e7ok say\u0131da claim, rol, yetki vs. bilgileri cookie’nin yersiz \u015fekilde b\u00fcy\u00fcmesine neden olabilmektedir. Bu da taray\u0131c\u0131lar\u0131n, proxy’lerin ve sunucular\u0131n header boyut s\u0131n\u0131rlar\u0131 y\u00fcz\u00fcnden request s\u00fcre\u00e7lerinde sorun olarak kar\u015f\u0131m\u0131za \u00e7\u0131kabilmektedir.<\/p>\n
`\u0130\u015fte b\u00f6yle bir durumda ITicketStore<\/code> devreye girer ve ak\u0131\u015f de\u011fi\u015fir…<\/p>\n`
ITicketStore<\/code> ile s\u00fcre\u00e7 \u015f\u00f6yle cereyan eder… Kullan\u0131c\u0131 giri\u015f yapar, AuthenticationTicket<\/code> sunucu taraf\u0131ndan Redis’e aktar\u0131l\u0131r ve taray\u0131c\u0131ya cookie g\u00f6nderilir. Tabi burada cookie, kullan\u0131c\u0131n t\u00fcm bilgilerini de\u011fil session key’ini ta\u015f\u0131yacakt\u0131r. B\u00f6ylece sunucu kullan\u0131c\u0131n\u0131n kim oldu\u011funu hat\u0131rl\u0131yor olsa da, taray\u0131c\u0131 sadece onu hat\u0131rlayacak key’i tutacakt\u0131r. Nihai olarak kullan\u0131c\u0131dan gelen her istek cebinde session key e\u015fli\u011finde ticket bar\u0131nd\u0131r\u0131yor olacakt\u0131r. Asp.NET Core mimarisi ise bu session key’i al\u0131p ticket’\u0131 Redis’ten bulacak ve kullan\u0131c\u0131y\u0131 do\u011frulayacakt\u0131r.<\/p>\n
`Bu yakla\u015f\u0131mdaki en b\u00fcy\u00fck avantaj, kullan\u0131c\u0131n\u0131n oturumunu sunucudan silebilme imkan\u0131n\u0131n s\u00f6z konusu olmas\u0131d\u0131r. Session key Redis’ten silinirse, o oturumla gelen sonraki istekler do\u011frulanmayacakt\u0131r…<\/em><\/p><\/blockquote>\n`
Hangi Durumlarda Kullan\u0131l\u0131r?<\/h4>\nITicketStore<\/code>, \u00f6zellikle kullan\u0131c\u0131 oturumlar\u0131n\u0131n sunucu taraf\u0131nda y\u00f6netilmesini istedi\u011fimiz t\u00fcm durumlarda tercih edilebilir.<\/p>\n \u00d6ncelikle, kullan\u0131c\u0131ya ait kimlik bilgileri ve claim’ler cookie i\u00e7erisinde ta\u015f\u0131nmak yerine Redis yahut veritaban\u0131 gibi bir depoda sakland\u0131\u011f\u0131 i\u00e7in cookie boyutunun k\u00fc\u00e7\u00fclmesini sa\u011flayacakt\u0131r<\/p>\n Bunun yan\u0131nda, kullan\u0131c\u0131 oturumlar\u0131n\u0131n sunucu \u00fczerinden kontrol edilmesine ve gerekti\u011finde ge\u00e7ersiz k\u0131l\u0131nmas\u0131na imkan tan\u0131yacakt\u0131r. \u00d6rne\u011fin, bir kullan\u0131c\u0131n\u0131n oturumunu Redis’ten silerek sonraki isteklerinde kimlik do\u011frulamas\u0131n\u0131n ba\u015far\u0131s\u0131z olmas\u0131n\u0131 sa\u011flayabiliriz.<\/p>\n Ayr\u0131ca birden fazla uygulama sunucusunun (instance) \u00e7al\u0131\u015ft\u0131\u011f\u0131 distributed mimarilerde, ortak bir Redis veya veritaban\u0131 kullanarak oturumlar\u0131n t\u00fcm sunucular taraf\u0131ndan eri\u015filebilir olmas\u0131n\u0131 da sa\u011flayacakt\u0131r.<\/p>\nT\u00fcm bunlar\u0131n aksine ITicketStore<\/code>‘un, kullan\u0131c\u0131 ad\u0131 ve parola gibi kimlik bilgilerini y\u00f6neten bir kullan\u0131c\u0131 veritaban\u0131 olmad\u0131\u011f\u0131n\u0131 ve JET Bearer token do\u011frulama mekanizmas\u0131n\u0131n da yerine ge\u00e7meyece\u011fini s\u00f6ylemekte fayda g\u00f6rmekteyim. Bu yap\u0131, yaln\u0131zca Asp.NET Core’un Cookie Authentication<\/a> mekanizmas\u0131yla birlikte \u00e7al\u0131\u015fmaktad\u0131r.<\/p>\n Nas\u0131l Kullan\u0131l\u0131r?<\/h4>\nITicketStore<\/code>‘un mant\u0131\u011f\u0131n\u0131 anlayabilmek i\u00e7in basit bir \u00e7al\u0131\u015fma \u00fczerinden incelemede bulunmam\u0131z yeterli olacakt\u0131r.<\/p>\n Bunun i\u00e7in \u00f6ncelikle ITicketStore<\/code> implementasyonunun a\u015fa\u011f\u0131daki gibi ger\u00e7ekle\u015ftirilmesi gerekir:<\/p>\n\n\r\n public class RedisTicketStore : ITicketStore\r\n {\r\n \/\/ Redis ba\u011flant\u0131s\u0131 i\u00e7in IDatabase instance'\u0131n\u0131 tutar.\r\n private readonly IDatabase _database;\r\n \/\/ Ticket'\u0131n default ge\u00e7erlilik s\u00fcresi 8 saat olarak ayarlanm\u0131\u015ft\u0131r. E\u011fer ticket'\u0131n Properties.ExpiresUtc de\u011feri null ise, bu default s\u00fcre kullan\u0131l\u0131r.\r\n private readonly TimeSpan _defaultExpiration = TimeSpan.FromHours(8);\r\n\r\n public RedisTicketStore(IConnectionMultiplexer connectionMultiplexer)\r\n => _database = connectionMultiplexer.GetDatabase();\r\n\r\n \/\/ Verilen key'e ait ticket'\u0131 Redis'ten siler.\r\n public async Task RemoveAsync(string key)\r\n => await _database.KeyDeleteAsync(key);\r\n\r\n \/\/ Ticket'\u0131 g\u00fcnceller\/yeniler ve ticket'\u0131n biti\u015f zaman\u0131n\u0131 hesaplar, kalan s\u00fcreyi bulur. S\u00fcre dolmu\u015fsa kayd\u0131 siler; dolmam\u0131\u015fsa bileti kalan s\u00fcre kadar bir TTL (ya\u015fam s\u00fcresi) ile Redis'e yazar.\r\n public async Task RenewAsync(string key, AuthenticationTicket ticket)\r\n {\r\n var serializedTicket = TicketSerializer.Default.Serialize(ticket);\r\n var expiration = ticket.Properties.ExpiresUtc ?? DateTimeOffset.UtcNow.Add(_defaultExpiration);\r\n var remainingTime = expiration - DateTimeOffset.UtcNow;\r\n\r\n if (remainingTime <= TimeSpan.Zero)\r\n {\r\n await _database.KeyDeleteAsync(key);\r\n return;\r\n }\r\n\r\n await _database.StringSetAsync(key, serializedTicket, remainingTime);\r\n }\r\n \/\/ Verilen key ile Redis'ten ticket'\u0131 okur, bo\u015fsa null d\u00f6ner, varsa deserialize edip AuthenticationTicket olarak geri verir.\r\n public async Task<AuthenticationTicket?> RetrieveAsync(string key)\r\n {\r\n var value = await _database.StringGetAsync(key);\r\n\r\n if (value.IsNullOrEmpty)\r\n return null;\r\n\r\n return TicketSerializer.Default.Deserialize(value!);\r\n }\r\n\r\n \/\/ RandomNumberGenerator ile kriptografik olarak g\u00fcvenli, rastgele 32 byte'l\u0131k bir key \u00fcretip, bu key e\u015fli\u011finde AuthenticationTicket'\u0131 Redis'e kaydeder ve key'i d\u00f6nd\u00fcr\u00fcr.\r\n public async Task<string> StoreAsync(AuthenticationTicket ticket)\r\n {\r\n var key = Convert.ToHexString(RandomNumberGenerator.GetBytes(32));\r\n\r\n await RenewAsync(key, ticket);\r\n\r\n return key;\r\n }\r\n }\r\n<\/pre>\n<\/div>\nBuradaki yap\u0131lan \u00e7al\u0131\u015fmada \u00f6nemli bir ayr\u0131nt\u0131 mevcuttur. 38.<\/em> sat\u0131rda oldu\u011fu gibi AuthenticationTicket<\/code> nensesini JSON ile serialize etmek yerine Asp.NET Core’un kendi TicketSerializer<\/code> s\u0131n\u0131f\u0131 kullan\u0131lmaktad\u0131r. B\u00f6ylece ticket i\u00e7erisindeki authentication properties, claims ve identity bilgileri uygun bi\u00e7imde saklanabilmektedir.<\/p>\n \u015eimdi ITicketStore<\/code> aray\u00fcz\u00fcn\u00fc implement etti\u011fimiz RedisTicketStore<\/code> s\u0131n\u0131f\u0131n\u0131 cookie authentication ile ili\u015fkilendirelim. Bunun i\u00e7in Program.cs<\/em> dosyas\u0131na gelelim ve a\u015fa\u011f\u0131daki yap\u0131land\u0131rmalar\u0131 ger\u00e7ekle\u015ftirelim:<\/p>\n\n\r\n#region Redis Connection\r\nvar redisConnectionString = builder.Configuration.GetConnectionString("Redis") ?? "localhost:6379";\r\nbuilder.Services.AddSingleton<IConnectionMultiplexer>(serviceProvider => ConnectionMultiplexer.Connect(redisConnectionString));\r\n#endregion\r\n\r\nbuilder.Services.AddSingleton<ITicketStore, RedisTicketStore>();\r\nbuilder.Services.AddSingleton<IPostConfigureOptions<CookieAuthenticationOptions>, ConfigureCookieAuthenticationOptions>();\r\n\r\nbuilder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)\r\n .AddCookie(options =>\r\n {\r\n options.LoginPath = "\/Account\/Login";\r\n options.LogoutPath = "\/Account\/Logout";\r\n\r\n options.ExpireTimeSpan = TimeSpan.FromHours(8);\r\n options.SlidingExpiration = true;\r\n });\r\n\r\nbuilder.Services.AddAuthorization();\r\n<\/pre>\n<\/div>\nBurada g\u00f6r\u00fcld\u00fc\u011f\u00fc \u00fczere Redis ile birlikte temel cookie yap\u0131land\u0131rmalar\u0131 ger\u00e7ekle\u015ftirilmektedir. Ancak 7.<\/em> sat\u0131ra g\u00f6z atarsan\u0131z e\u011fer CookieAuthenticationOptions<\/code> nesnesi yap\u0131land\u0131r\u0131l\u0131rken, bir yandan da ConfigureCookieAuthenticationOptions<\/code> s\u0131n\u0131f\u0131m\u0131z\u0131 son ayar (yani past-configure) ad\u0131m\u0131 olarak \u00e7al\u0131\u015ft\u0131rmas\u0131n\u0131 istemekteyiz. B\u00f6ylece AddCookie(options => ...)<\/code> i\u00e7indeki ayarlar\u0131n (veyahut ba\u015fka herhangi bir Configure ad\u0131m\u0131n\u0131n) SessionStore<\/em>‘u ezme ihtimali kalmayacakt\u0131r. Yani PostConfigure<\/em> en son \u00e7al\u0131\u015faca\u011f\u0131 i\u00e7in son s\u00f6z\u00fc s\u00f6yleyecektir.<\/p>\n ConfigureCookieAuthenticationOptions<\/code> i\u00e7eri\u011fine gelirsek e\u011fer;<\/p>\n\n\r\n public class ConfigureCookieAuthenticationOptions(ITicketStore ticketStore) : IPostConfigureOptions<CookieAuthenticationOptions>\r\n {\r\n public void PostConfigure(string? name, CookieAuthenticationOptions options)\r\n => options.SessionStore = ticketStore;\r\n }\r\n<\/pre>\n<\/div>\nBu s\u0131n\u0131f RedisTicketStore<\/code>‘u (ITicketStore<\/code>), cookie authentication’\u0131n SessionStore<\/em> \u00f6zelli\u011fine ba\u011flamaktad\u0131r. B\u00f6ylece kimlik ticket’lar\u0131 taray\u0131c\u0131 cookie’sinde de\u011fil, Redis sunucusunda saklanacak, cookie sadece session key’i ta\u015f\u0131yacakt\u0131r.<\/p>\n Art\u0131k bu vaziyette yap\u0131land\u0131r\u0131lm\u0131\u015f bir projede a\u015fa\u011f\u0131daki gibi SignInAsync<\/code> \u00e7a\u011fr\u0131s\u0131, SessionStore<\/em> olarak yap\u0131land\u0131rd\u0131\u011f\u0131m\u0131z RedisTicketStore<\/code> \u00fczerinden StoreAsync<\/code> metodunu tetikleyecektir.<\/p>\n\n\r\nawait HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, principal, authProperties);\r\n<\/pre>\n<\/div>\nVe a\u015fa\u011f\u0131daki gibi Authorize<\/code> attribute’unun kullan\u0131ld\u0131\u011f\u0131 action’lara her eri\u015fim s\u00fcre\u00e7lerinde ise yine RedisTicketStore<\/code>‘un RetrieveAsync<\/code> metodunu \u00e7a\u011f\u0131racakt\u0131r.<\/p>\n \n\r\n [Authorize]\r\n public IActionResult Privacy()\r\n {\r\n return View();\r\n }\r\n<\/pre>\n<\/div>\n\u0130\u015fte bu kadar…<\/p>\n Nihai olarak,<\/p>\n ITicketStore<\/code>, Cookie Authentication mekanizmas\u0131n\u0131 sunucu tarafl\u0131 bir oturum y\u00f6netimine d\u00f6n\u00fc\u015ft\u00fcrerek, hem cookie boyutunu k\u00fc\u00e7\u00fcltmekte hem de oturumlar \u00fczerinde tam kontrol sa\u011flamaktad\u0131r. Haliyle do\u011fru kullan\u0131ld\u0131\u011f\u0131 taktirde \u00f6l\u00e7eklenebilir ve g\u00fcvenli kimlik do\u011frulama mimarilerinin vazge\u00e7ilmez par\u00e7alar\u0131ndan biri olmaktad\u0131r diyebiliriz.<\/p>\n \u0130lgilenenlerin faydalanmas\u0131 dile\u011fiyle… \nSonraki yaz\u0131lar\u0131m\u0131zda g\u00f6r\u00fc\u015fmek \u00fczere… \n\u0130yi \u00e7al\u0131\u015fmalar…<\/p>\n \n\n \n\u00d6rnek \u00e7al\u0131\u015fmaya a\u015fa\u011f\u0131daki GitHub reposundan eri\u015febilirsiniz.<\/div>\nhttps:\/\/github.com\/gncyyldz\/ITicketStoreImplementation<\/div>\n<\/p><\/div>\n<\/p><\/div>\n\n Bu repository, ilgili konuya dair \u00f6rnek \u00e7al\u0131\u015fman\u0131n kaynak kodlar\u0131n\u0131 ve mimari yap\u0131s\u0131n\u0131 i\u00e7ermektedir. Detaylar i\u00e7in GitHub \u00fczerinden incelemede bulunabilirsiniz.\n <\/div>\n \n GitHub\u2019da G\u00f6r\u00fcnt\u00fcle \u2192 \n <\/a><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":" Merhaba, Bu i\u00e7eri\u011fimizde, Asp.NET Core mimarisinde kullan\u0131c\u0131ya ait kimlik do\u011frulama oturumunu (authentication ticket) sunucu taraf\u0131nda saklamam\u0131z\u0131 sa\u011flayan ITicketStore aray\u00fcz\u00fcn\u00fc ele al\u0131yor olaca\u011f\u0131z. ITicketStore Nedir? Asp.NET Core mimarisinde, \u00f6zellikle Cookie Authentication kullan\u0131rken, kullan\u0131c\u0131n\u0131n t\u00fcm kimlik...<\/p>\n","protected":false},"author":1,"featured_media":28977,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5206,3102],"tags":[5773,5772],"class_list":["post-28964","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-net","category-asp-net-core","tag-cookie-authentication","tag-iticketstore"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/28964","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/comments?post=28964"}],"version-history":[{"count":9,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/28964\/revisions"}],"predecessor-version":[{"id":28979,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/posts\/28964\/revisions\/28979"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/media\/28977"}],"wp:attachment":[{"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/media?parent=28964"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/categories?post=28964"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gencayyildiz.com\/blog\/wp-json\/wp\/v2\/tags?post=28964"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}