Core 2.0 API 使用 JWT returns 未经授权的身份验证

Question

我正在尝试将使用 JWT 的令牌身份验证添加到我的 .Net Core 2.0 应用程序。我有一个简单的控制器，其中 returns 用于测试的用户列表。

[Authorize]
[Route("api/[controller]")]
public class UsersController : Controller
{
    ...

    [HttpGet]
    [Route("api/Users/GetUsers")]
    public IEnumerable<ApplicationUser> GetUsers()
    {
        return _userManager.Users;
    }


}

我有一个 API 令牌安全控制器。它有一个登录方法，该方法 returns 一个令牌字符串结果。

    [HttpPost(nameof(Login))]
    public async Task<IActionResult> Login([FromBody] LoginResource resource)
    {
        if (resource == null)
            return BadRequest("Login resource must be asssigned");

        var user = await _userManager.FindByEmailAsync(resource.Email);

        if (user == null || (!(await _signInManager.PasswordSignInAsync(user, resource.Password, false, false)).Succeeded))
            return BadRequest("Invalid credentials");

        string result = GenerateToken(user.UserName, resource.Email);

        // Token is created, we can sign out
        await _signInManager.SignOutAsync();

        return Ok(result);
    }

    private string GenerateToken(string username, string email)
    {
        var claims = new Claim[]
        {
            new Claim(ClaimTypes.Name, username),
            new Claim(ClaimTypes.Email, email),
            new Claim(JwtRegisteredClaimNames.Nbf, new DateTimeOffset(DateTime.Now).ToUnixTimeSeconds().ToString()),
            new Claim(JwtRegisteredClaimNames.Exp, new DateTimeOffset(DateTime.Now.AddDays(1)).ToUnixTimeSeconds().ToString()),
        };

        var token = new JwtSecurityToken(
            new JwtHeader(new SigningCredentials(
                new SymmetricSecurityKey(Encoding.UTF8.GetBytes("the secret that needs to be at least 16 characeters long for HmacSha256")),
                                         SecurityAlgorithms.HmacSha256)),
            new JwtPayload(claims));

        return new JwtSecurityTokenHandler().WriteToken(token);
    }

我有一个小型控制台应用程序，仅用于测试 API。当我尝试使用 jwt 获取用户时。我立即收到 "unauthorized"。如果我从用户控制器中删除“[Authorize]”...成功。看来我的 header 授权未被识别，但不确定原因。

    private static async Task<String> GetUsers(String jwt)
    {
        var url = "https://localhost:44300/";
        var apiUrl = $"/api/Users/";

        using (var client = new HttpClient() { BaseAddress = new Uri(url) })
        {
            client.BaseAddress = new Uri(url);
            client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
            client.DefaultRequestHeaders.Add("Authorization", $"Bearer {jwt}");

            using (var response = await client.GetAsync(apiUrl))
            {
                if (response.StatusCode == System.Net.HttpStatusCode.OK)
                    return await response.Content.ReadAsStringAsync();

                else return null;
            }
        }
    }

我的尝试基于文章 here ...其中一些可能已经过时了。

更新 - Startup.cs

的摘录

        services.AddAuthentication(options =>
        {
            options.DefaultAuthenticateScheme = "Jwt";
            options.DefaultChallengeScheme = "Jwt";
        }).AddJwtBearer("Jwt", options =>
        {
            options.TokenValidationParameters = new TokenValidationParameters
            {
                ValidateAudience = false,
                //ValidAudience = "the audience you want to validate",
                ValidateIssuer = false,
                //ValidIssuer = "the isser you want to validate",

                ValidateIssuerSigningKey = true,
                IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("the secret that needs to be at least 16 characeters long for HmacSha256")),

                ValidateLifetime = true, //validate the expiration and not before values in the token

                ClockSkew = TimeSpan.FromMinutes(5) //5 minute tolerance for the expiration date
            };
        });

配置...

    public void Configure(IApplicationBuilder app, IHostingEnvironment env)
    {
        if (env.IsDevelopment())
        {
            app.UseBrowserLink();
            app.UseDeveloperExceptionPage();
            app.UseDatabaseErrorPage();
        }
        else
        {
            app.UseExceptionHandler("/Home/Error");
        }

        app.UseStaticFiles();

        app.UseAuthentication();

        app.UseMvc(routes =>
        {
            routes.MapRoute(
                name: "default",
                template: "{controller=Home}/{action=Index}/{id?}");
        });

        //app.UseJwtBearerAuthentication(
        //    new Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerOptions
        //    );


    }

解法：

此行正在转义令牌，因此导致它在下一个请求中传递时无效：

var result = await response.Content.ReadAsStringAsync();

替换为：

var result = await response.Content.ReadAsAsync<string>();

注意：要使用此分机方法，我必须 "install-package Microsoft.AspNet.WebApi.Client"

Answer 1

我在我的一个项目中使用了 JWT 身份验证。我想展示我的实现，也许这会对你有所帮助。但是你可能忘记在启动 class.

的配置方法中添加 UseAuthentication();

startup.cs

    public void Configure(IApplicationBuilder app)
    {
        app.UseAuthentication();
        app.UseMvc();
    }

    public void ConfigureServices(IServiceCollection services)
    {
        var appSettings = Configuration.GetSection("AppSettings");

        services.AddAuthentication(options =>
                                   {
                                       options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                                       options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
                                   }
                                  )
                .AddJwtBearer(options =>
                {
                    options.TokenValidationParameters = new TokenValidationParameters
                    {
                        ValidateAudience = true,
                        ValidAudience = appSettings["JwtAudience"],
                        ValidateIssuer = true,
                        ValidIssuer = appSettings["JwtIssuer"],
                        ValidateLifetime = true,
                        ValidateIssuerSigningKey = true,
                        IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(appSettings["JwtSigningKey"]))
                    };
                });
    }

generateToken 方法

    private string GenerateToken(string email)
    {
        SecurityKey securityKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_appSettings.Value.JwtSigningKey));

        var token = new JwtSecurityToken(
                                         issuer: _appSettings.Value.JwtIssuer,
                                         audience: _appSettings.Value.JwtAudience,
                                         claims: new[]
                                         {
                                             new Claim(JwtRegisteredClaimNames.UniqueName, email),
                                             new Claim(JwtRegisteredClaimNames.Email, email),
                                             new Claim(JwtRegisteredClaimNames.NameId, Guid.NewGuid().ToString())
                                         },
                                         expires: DateTime.Now.AddMinutes(_appSettings.Value.JwtExpireMinute),
                                         signingCredentials: new SigningCredentials(securityKey, SecurityAlgorithms.HmacSha256)
                                        );

        return new JwtSecurityTokenHandler().WriteToken(token);
    }

Answer 2

我最近创建了一个 nuget 包 NetCore.Jwt 来简化这个过程。当你可以简单地使用函数 SignInAsync 处理 cookie 时，我发现每次你需要 Jwt 时都编写所有代码是不值得的。但是，如果您更喜欢手动方式，Celal 的回答是此过程的清晰直接指南。

或者，您可以安装 NetCore.Jwt 并在启动时使用以下内容：

services.AddAuthentication(NetCoreJwtDefaults.SchemeName)
    .AddNetCoreJwt(options => 
        {
            // configure your token options such as secret, expiry, and issuer here
        });

在你的Login函数中，你可以使用HttpContext

的扩展函数

string token = HttpContext.GenerateBearerToken( new Claim[]
    {
        new Claim(ClaimTypes.Name, username),
        new Claim(ClaimTypes.Email, email),
        new Claim(JwtRegisteredClaimNames.Nbf, new DateTimeOffset(DateTime.Now).ToUnixTimeSeconds().ToString()),
        new Claim(JwtRegisteredClaimNames.Exp, new DateTimeOffset(DateTime.Now.AddDays(1)).ToUnixTimeSeconds().ToString()),
    });

Answer 3

在您的 program.cs 中不要忘记使用此代码（并按顺序）：

app.UseAuthentication();
app.UseAuthorization();

Core 2.0 API 使用 JWT returns 未经授权的身份验证

Core 2.0 API Auth with JWT returns unauthorized

asp.net-apicontroller

.net-core