授权在 ASP.net 核心网站 API 中不起作用

Question

我正在尝试使用 jwt 令牌在 asp.ne 核心 webapi 网络应用程序中实施授权。但是当我发送带有承载授权的请求并生成 jwt 令牌时，响应始终是 401 unauthorized

我使用的是.Net 5.0版本

我做错了什么？

这是我的 startup.cs 文件 public Startup(IConfiguration配置) { 配置=配置； }

    public IConfiguration Configuration { get; }
    public void ConfigureServices(IServiceCollection services)
    {
        services.Configure<JwtSettings>(Configuration.GetSection("Jwt"));
        var jwtSettings = Configuration.GetSection("Jwt").Get<JwtSettings>();
        services.AddControllers();

        var dataAssemblyName = typeof(CRMContext).Assembly.GetName().Name;
        services.AddDbContext<CRMContext>(options => options.UseSqlServer(Configuration.GetConnectionString("Default"), x => x.MigrationsAssembly(dataAssemblyName)));

        services.AddIdentity<User, Role>(options =>
        {
            options.Password.RequiredLength = 8;
            options.Password.RequireNonAlphanumeric = false;
            options.Password.RequireUppercase = true;
            options.Lockout.DefaultLockoutTimeSpan = TimeSpan.FromMinutes(1d);
            options.Lockout.MaxFailedAccessAttempts = 5;
        })
            .AddEntityFrameworkStores<CRMContext>()
            .AddDefaultTokenProviders();
 services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme).AddJwtBearer(options =>
        {
            options.TokenValidationParameters = new TokenValidationParameters
            {
                ValidateIssuer = true,
                ValidateAudience = true,
                ValidateLifetime = true,
                ValidateIssuerSigningKey = true,
                ValidIssuer = Configuration["JwtAuthentication:JwtIssuer"],
                ValidAudience = Configuration["JwtAuthentication:JwtIssuer"],
                IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration["JwtAuthentication:JwtKey"])),
            };

        });

        services.AddScoped<IUnitOfWork, UnitOfWork>();
        services.AddTransient<IAccountService, AccountService>();
        services.AddTransient<IApplicationUserService, ApplicationUserService>();
        services.AddMvc().AddControllersAsServices();
        services.AddCors(o => o.AddPolicy("MyPolicy", builder =>
        {
            builder.AllowAnyOrigin()
                   .AllowAnyMethod()
                   .AllowAnyHeader();
        }));

        services.AddSwaggerGen(options =>
        {
            options.SwaggerDoc("v1", new OpenApiInfo { Title = "Cloud 9", Version = "v1" });
            options.AddSecurityDefinition("Bearer", new OpenApiSecurityScheme
            {
                Description = "JWT containing userid claim",
                Name = "Authorization",
                In = ParameterLocation.Header,
                Type = SecuritySchemeType.ApiKey,
            });

            var security =
                new OpenApiSecurityRequirement
                {
                    {
                        new OpenApiSecurityScheme
                        {
                            Reference = new OpenApiReference
                            {
                                Id = "Bearer",
                                Type = ReferenceType.SecurityScheme
                            },
                            UnresolvedReference = true
                        },
                        new List<string>()
                    }
                };
            options.AddSecurityRequirement(security);
        });
        services.AddAutoMapper(typeof(Startup));
        services.AddControllersWithViews()
                .AddNewtonsoftJson(options =>
                options.SerializerSettings.ReferenceLoopHandling = Newtonsoft.Json.ReferenceLoopHandling.Ignore
         );

        var mappingConfig = new MapperConfiguration(mc =>
        {
            mc.AddProfile(new MappingProfile());
        });
        IMapper mapper = mappingConfig.CreateMapper();
        services.AddSingleton(mapper);

        services.AddAuth(jwtSettings);

    }

    // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {

        MyServiceProvider.ServiceProvider = app.ApplicationServices;
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }
        app.UseHttpsRedirection();
        app.UseRouting();
        //  app.UseSwagger();
        //    app.UseSwaggerUI(c => c.SwaggerEndpoint("/swagger/v1/swagger.json", "Ids.Crm.Api v1"));

        app.UseAuthorization();
        app.UseAuth();
        app.UseCors("MyPolicy");

        app.UseEndpoints(endpoints =>
        {
            endpoints.MapControllers();
        });
        app.UseSwagger()
            .UseSwaggerUI(c =>
            {
                c.SwaggerEndpoint("/swagger/v1/swagger.json", "test v1");
                c.ConfigObject.AdditionalItems.Add("syntaxHighlight", false); 
                c.ConfigObject.AdditionalItems.Add("theme", "agate"); 
            });
    }

Answer 1

您的请求管道缺少身份验证中间件。因此，您不可能进行身份验证或授权。只需在Configure方法

中授权中间件前添加中间件即可

app.UseAuthentication();
app.UseAuthorization();

更新：好像是app.UseAuth()；是您的身份验证中间件。如果是，则将其放在授权中间件之上。

app.UseAuth();
app.UseAuthorization();

Answer 2

我找到了解决方案....我在生成令牌时声明的密钥与我在 appsetting.json

中声明的密钥不同

因此，当 TokenValidationParameters 使用错误的密钥时，它会阻止授权

授权在 ASP.net 核心网站 API 中不起作用

The authorization is not working in ASP.net core web API

authorization

jwt

asp.net-web-api

bearer-token

asp.net-core