使用 C# 验证 PS256 编码的 JWT

Question

我的任务是验证使用 PS256 算法编码的 JWT 令牌，在过去的两天里我一直遇到问题。我缺乏这方面的知识，我一直在尝试不同的解决方案慢慢解决这个问题。

// Encoded
eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImtpZDEyMzQifQ.eyJpc3MiOiJmb28uYmFyLnRlc3Rpc3N1ZXIiLCJleHAiOjE1NTEyMDEwNjgsImF0X2hhc2giOiJqaFl3c1pyTnZ0dFNYQnR6QVMtWlNnIn0.yJePyxdJWyydG4HM97oQag6ulGKa5Afw-LHYYEXz7lVy8v0IJD0mSO9WtowlWJIeD2Vvthuj71XUfHsgz0LD9rK0VBucJbd_OiIXpbwPUqBcdj82DNLFXDJfCJnUC-Rv8QP7OUVBvLjvBQ6WYMrx1Qnq8xP6qeL_ohKwRmo6EDhZRkYBz9gFhfha1ZlKcnyR73nXdShwy7OmmyiRvVWPBf_GgSsfz8FNNoKySW1MA4tRa7cl3zPlyCnWyLaZ3kcQsmTqarHG--YXSDF5ozZ_Sx6TkunCxrOYzOFNcPyeIWqI84cemM6TgMBw9jhzMCk7Y4Fzxe5KEYJH4GlGA4s4zg

// Header
{
    "alg": "PS256",
    "typ": "JWT",
    "kid": "kid1234"
}

// Payload
{
    "iss": "foo.bar.testissuer",
    "exp": 1551201068,
    "at_hash": "jhYwsZrNvttSXBtzAS-ZSg"
}

我有一个 RS256 编码 JWT 的工作实现，它使用 Microsoft.IdentityModel.Tokens 和 中提供的 JWTSecurityTokenHandler =]System.IdentityModel.Tokens.Jwt。对于 RS256 实现，我有一个 IssuerSigningKeyResolver，它正在为孩子进行自定义检查并提供 public 密钥

var tokenValidationParameters = new TokenValidationParameters
{
    ValidIssuer = issuer,
    ValidateLifetime = true,
    RequireSignedTokens = true,
    RequireExpirationTime = true,
    ValidateAudience = false,
    ValidateIssuer = true,
    IssuerSigningKeyResolver = (string token, SecurityToken securityToken, string kid, TokenValidationParameters validationParameters) =>
    {
        // Custom kid checks

        var rsa = RSA.Create();
        rsa.ImportParameters(new RSAParameters
        {
            Exponent = Base64UrlEncoder.DecodeBytes(matchingKid.E),
            Modulus = Base64UrlEncoder.DecodeBytes(matchingKid.N),
        });
        latestSecurityKeys.Add(matchingKid.Kid, new RsaSecurityKey(rsa));

        var securityKeys = new SecurityKey[1]
        {
            new RsaSecurityKey(rsa)
        };

        return securityKeys;
    }
};

var tokenHandler = new JwtSecurityTokenHandler();
try
{
    var principal = tokenHandler.ValidateToken(token, tokenValidationParameters, out SecurityToken validatedToken);
    return true;
}
catch (SecurityTokenException ex)
{
    // Do something with ex
    return false;
}

此实现不适用于 PS256 编码的 JWT。我在 System.IdentityModel.Tokens.Jwt 中调试了 JwtSecurityTokenHandler，但似乎 PS256 在受支持的范围内算法列出验证失败。

我必须再次声明，我在这方面的知识有限。据我了解，RSA256 和 PS256 属于同一系列算法吗？我是否最好使用另一个库（如 jose-jwt?

创建 PS256 JWT 的自定义验证

Answer 1

在向 Microsoft 提出问题后，现在 [=26 似乎不支持此类验证=] 和 System.IdentityModel.Tokens.Jwt 。可以在这里找到详细信息 - https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/1117

最后我使用 jose-jwt 和一些自定义检查验证了我的令牌。

private bool IsValid(string token, string issuer, string configId)
{
    var jwtSecurityTokenHandler = new JwtSecurityTokenHandler();
    var jwtSecurityToken = jwtSecurityTokenHandler.ReadToken(token) as JwtSecurityToken;

    // Extract the kid from token header
    var kidHeader = jwtSecurityToken.Header.Where(k => k.Key.ToLower() == "kid")?.FirstOrDefault();
    if (kidHeader?.Value == null) ThrowInvalidOperation($"Failed to find matching kid for Issuer: {issuer.ToLower() }");

    var kid = kidHeader?.Value as string;

    // Extract the expiration time from token payload
    var expirationTime = jwtSecurityToken.Payload?.Exp;
    if (expirationTime == null) ThrowInvalidOperation($"Failed to find matching expiration time for Issuer: {issuer.ToLower() }");

    // Decode to verify signature
    var verifiedToken = JWT.Decode(token, GetPublicKey(kid, issuer, providerId));

    if (verifiedToken != null)
    {
        var json = JsonConvert.DeserializeObject<dynamic>(verifiedToken);
        return IsValidIssuer(json, issuer) && IsValidExpirationTime(json, expirationTime);
    }
    else
    {
        return false;
    }

    void ThrowInvalidOperation(string msg) => throw new InvalidOperationException(msg);
}

private bool IsValidIssuer(dynamic json, string issuer)
{
    if (json != null && issuer != null)
    {
        if (json["iss"] == issuer)
        {
            return true;
        }
        else
        {
            return false;
        }
    }
    return false;
}

private bool IsValidExpirationTime(dynamic json, int? expTime)
{
    if (json != null && expTime != null)
    {
        if (json["exp"] == expTime)
        {
            return true;
        }
        else
        {
            return false;
        }
    }
    return false;
}

private RSA GetPublicKey(string kid, string validIssuer, string configId)
{
    var openIdConfig = openIdConfigurationProvider.GetOpenIdConfiguration(configId);
    var matchingKid = openIdConfig?.JsonWebKeySet?.Keys?.FirstOrDefault(x => x.Kid == kid);
    if (matchingKid == null)
    {
        throw new InvalidOperationException($"kid is null");
    }

    var rsa = RSA.Create();
    rsa.ImportParameters(new RSAParameters
    {
        Exponent = Base64UrlEncoder.DecodeBytes(matchingKid.E),
        Modulus = Base64UrlEncoder.DecodeBytes(matchingKid.N),
    });

    return rsa;
}

使用 C# 验证 PS256 编码的 JWT

Validation of PS256 encoded JWT using C#

.net

c#

rsa

jwt

jose