ASP.NET 核心 - 无法使简单的不记名令牌身份验证工作

Question

我正在使用 ASP.NET 核心 2 构建一个 API，我正在尝试获得一个使用 Bearer 令牌工作的简单身份验证示例。

首先，这是我的启动代码...

public class Startup
{
    public Startup(IConfiguration configuration)
    {
        Configuration = configuration;
    }

    public IConfiguration Configuration { get; }

    public void ConfigureServices(IServiceCollection services)
    {
        services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
            .AddJwtBearer(options =>
            {
                options.TokenValidationParameters = new TokenValidationParameters
                {
                    ValidateIssuer = true,
                    ValidateAudience = true,
                    ValidateLifetime = true,
                    ValidateIssuerSigningKey = true,
                    ValidIssuer = "mydomain.com",
                    ValidAudience = "mydomain.com",
                    IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("THESECRETKEY THESECRETKEY THESECRETKEY THESECRETKEY"))
                };
            });

        // goes last
        services.AddMvc();
    }

    public void Configure(IApplicationBuilder app, IHostingEnvironment env)
    {
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }
        else
        {
            app.UseExceptionHandler();
        }

        app.UseStatusCodePages();

        // goes last
        app.UseMvc();
    }
}

然后我有一个 Auth 控制器，returns 令牌...

[Route("api/[controller]")]
public class AuthController : Controller
{
    [AllowAnonymous]
    [HttpPost("RequestToken")]
    public IActionResult RequestToken([FromBody] TokenRequest request)
    {
        if (request.Username == "theuser" && request.Password == "thepassword")
        {
            var claims = new[]
            {
                new Claim(ClaimTypes.Name, request.Username)
            };

            var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("THESECRETKEY THESECRETKEY THESECRETKEY THESECRETKEY"));
            var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);

            var token = new JwtSecurityToken(
                issuer: "mydomain.com",
                audience: "mydomain.com",
                claims: claims,
                expires: DateTime.Now.AddMinutes(30),
                signingCredentials: creds);

            return Ok(new
            {
                token = new JwtSecurityTokenHandler().WriteToken(token)
            });
        }

        return BadRequest("Could not verify username and password");
    }
}

public class TokenRequest
{
    public string Username { get; set; }
    public string Password { get; set; }
}

所以在 Postman 中你可以看到我得到了一个令牌...

然后我尝试从值控制器获取...

[Route("api/[controller]")]
[Authorize]
public class ValuesController : Controller
{
    [HttpGet("{id}")]
    public string Get(int id)
    {
        return "value";
    }
}

如果我添加 [Anonymous] 属性，它就可以正常工作。但是，当它需要授权时，我得到一个 401...

Answer 1

您没有在 Startup.cs 中引用身份验证中间件您可以通过在 app.UseMvc();

之前添加 app.UseAuthentication(); 来引用它

您的 Startup.cs 的 Configure 方法应该如下所示：

public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
    if (env.IsDevelopment())
    {
        app.UseDeveloperExceptionPage();
    }
    else
    {
        app.UseExceptionHandler();
    }

    app.UseStatusCodePages();


    app.UseAuthentication();
    app.UseMvc();
}

您可以阅读更多关于中间件的内容here and more into authorization with ASP.NET Core here.

您还应该查看 here 以了解有关 ASP.NET Core

的所有其他信息

ASP.NET 核心 - 无法使简单的不记名令牌身份验证工作

ASP.NET Core - can't get simple bearer token auth working

asp.net-core

authorization

bearer-token