我正在尝试在我的api
应用程序中应用基于JSON Web令牌的auth。问题在于,每次测试我的令牌时,我都会变得无效的令牌签名。此外,我无法在控制器中授权我的请求,我认为这可能与生成后者有关。
我发布了所有相关代码,如果有人可以帮助我,将非常感谢。源代码来自github aspnetcore2jwtauthentication
AppSettings.json
"BearerTokens": {
"Key": "iNivDmHLpUA223sqsfhqGbMRdRj1PVkH",
"Issuer": "http://localhost/",
"Audience": "http://localhost/",
"AccessTokenExpirationMinutes": 2,
"RefreshTokenExpirationMinutes": 60
},
startup.cs /configureservices
services.AddAuthorization(options =>
{
options.AddPolicy(CustomRoles.Admin, policy => policy.RequireRole(CustomRoles.Admin));
options.AddPolicy(CustomRoles.User, policy => policy.RequireRole(CustomRoles.User));
options.AddPolicy(CustomRoles.Editor, policy => policy.RequireRole(CustomRoles.Editor));
});
services.AddAuthentication(options =>
{
options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
options.DefaultSignInScheme = JwtBearerDefaults.AuthenticationScheme;
options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddCookie(cfg =>
{
cfg.SlidingExpiration = true;
})
.AddJwtBearer(cfg =>
{
cfg.RequireHttpsMetadata = false;
cfg.SaveToken = true;
cfg.TokenValidationParameters = new TokenValidationParameters
{
ValidIssuer = Configuration["BearerTokens:Issuer"],
ValidAudience = Configuration["BearerTokens:Audience"],
IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration["BearerTokens:Key"])),
ValidateIssuerSigningKey = true,
ValidateLifetime = true,
ClockSkew = TimeSpan.Zero
};
cfg.Events = new JwtBearerEvents
{
OnAuthenticationFailed = context =>
{
var logger = context.HttpContext.RequestServices.GetRequiredService<ILoggerFactory>().CreateLogger(nameof(JwtBearerEvents));
logger.LogError("Authentication failed.", context.Exception);
return Task.CompletedTask;
},
OnTokenValidated = context =>
{
var tokenValidatorService = context.HttpContext.RequestServices.GetRequiredService<ITokenValidatorService>();
return tokenValidatorService.ValidateAsync(context);
},
OnMessageReceived = context =>
{
return Task.CompletedTask;
},
OnChallenge = context =>
{
var logger = context.HttpContext.RequestServices.GetRequiredService<ILoggerFactory>().CreateLogger(nameof(JwtBearerEvents));
logger.LogError("OnChallenge error", context.Error, context.ErrorDescription);
return Task.CompletedTask;
}
};
});
services.AddCors(options =>
{
options.AddPolicy("CorsPolicy",
builder => builder
.WithOrigins("http://localhost:4200") //Note: The URL must be specified without a trailing slash (/).
.AllowAnyMethod()
.AllowAnyHeader()
.AllowCredentials());
});
services.AddMvc();
**Startup.cs** / Configure
app.UseAuthentication();
app.UseMvc();
tokenstoreservice.cs
public async Task<(string accessToken, string refreshToken)> CreateJwtTokens(ApplicationUser user)
{
var now = DateTimeOffset.UtcNow;
var accessTokenExpiresDateTime = now.AddMinutes(_configuration.Value.AccessTokenExpirationMinutes);
var refreshTokenExpiresDateTime = now.AddMinutes(_configuration.Value.RefreshTokenExpirationMinutes);
var accessToken = await createAccessTokenAsync(user, accessTokenExpiresDateTime.UtcDateTime).ConfigureAwait(false);
var refreshToken = Guid.NewGuid().ToString().Replace("-", "");
await AddUserTokenAsync(user, refreshToken, accessToken, refreshTokenExpiresDateTime, accessTokenExpiresDateTime).ConfigureAwait(false); // this method is only to store the generated token in the database, irrelevent to the issue.
await this.context.SaveChangesAsync();
return (accessToken, refreshToken);
}
private async Task<string> createAccessTokenAsync(ApplicationUser user, DateTime expires)
{
var claims = new List<Claim>
{
// Unique Id for all Jwt tokes
new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString()),
// Issuer
new Claim(JwtRegisteredClaimNames.Iss, _configuration.Value.Issuer),
// Issued at
new Claim(JwtRegisteredClaimNames.Iat, DateTime.UtcNow.ToUnixEpochDate().ToString(), ClaimValueTypes.Integer64),
new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()),
new Claim(ClaimTypes.Name, user.UserName),
new Claim("DisplayName", user.LastName),
// to invalidate the cookie
new Claim(ClaimTypes.SerialNumber, user.SecurityStamp),
// custom data
new Claim(ClaimTypes.UserData, user.Id.ToString())
};
// add roles
var roles = await _rolesService.FindUserRolesAsync(user.Id).ConfigureAwait(false);
foreach (var role in roles)
{
claims.Add(new Claim(ClaimTypes.Role, role.RoleId));
}
var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_configuration.Value.Key));
var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
var token = new JwtSecurityToken(
issuer: _configuration.Value.Issuer,
audience: _configuration.Value.Audience,
claims: claims,
notBefore: DateTime.UtcNow,
expires: expires,
signingCredentials: creds);
return new JwtSecurityTokenHandler().WriteToken(token);
}
生成的令牌样本
验证链接
,所以我的问题是我的ITokenValidatorService
中的一个错误,这是您自定义的验证您自己的令牌的方法。
OnTokenValidated = context =>
{
var tokenValidatorService = context.HttpContext.RequestServices.GetRequiredService<ITokenValidatorService>();
return tokenValidatorService.ValidateAsync(context);
},
上面显示的配置工作正常
,但我仍然想知道为什么JWT验证器继续返回任何已提交的令牌为无效!