c# dotnet core Jwtbearer Authentication实例

什么是JWT?

JWT(JSON Web Token), 顾名思义就是在Web上以JSON格式传输的Token

是HTTP提供了一套标准的身份验证框架：服务器可以用来针对客户端的请求发送质询(challenge)，客户端根据质询提供身份验证凭证。质询与应答的工作流程如下：服务器端向客户端返回401（Unauthorized，未授权）状态码，并在WWW-Authenticate头中添加如何进行验证的信息，其中至少包含有一种质询方式。然后客户端可以在请求中添加Authorization头进行验证，其Value为身份验证的凭证信息

JWT的构成

JWT一般由三段构成，用"."号分隔开如下:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA1LzA1L2lkZW50aXR5L2NsYWltcy9uYW1lIjoiaHgwMDIiLCJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dzLzIwMDgvMDYvaWRlbnRpdHkvY2xhaW1zL3JvbGUiOiJhZG1pbiIsIm5iZiI6MTU2MDE0NzkzMiwiZXhwIjoxNTYwMTQ4NTMzLCJpc3MiOiJIeElzc3VlciIsImF1ZCI6Ikh4QXVkaWVuY2UifQ.b1Jcji5XTOkKtQ3xFV3vmAHqmz0wwhYNqH9-UjEtfzE

1、新建Jwtsetting.cs（jwt配置类,映射appsettings.json中Jwtsetting配置）和LoginViewModel.cs类（用户信息类）

public class Jwtsetting
    {
        /// <summary>
        /// 证书颁发者
        /// </summary>
        public string Issuer { get; set; }

        /// <summary>
        /// 允许使用的角色
        /// </summary>
        public string Audience { get; set; }

        /// <summary>
        /// 加密字符串
        /// </summary>
        public string SecretKey { get; set; }
    }


public class LoginViewModel
    {
        public string UserName { get; set; } = "hx002";
        public string Password { get; set; } = "hx123456";
    }

2、配置appsettings.json

{
  "Logging": {
    "LogLevel": {
      "Default": "Warning"
    }
  },
  "JWTSetting": {
    "Issuer": "Issuer",//发行者
    "Audience": "Audience",//允许使用者(角色)
    "SecretKey": "123213sadassdakey"//加密密匙字符串
  },
  "AllowedHosts": "*"
}

3、Startup配置依赖注入

   public class Startup
    {
        public Startup(IConfiguration configuration)
        {
            Configuration = configuration;
        }

        public IConfiguration Configuration { get; }

        // This method gets called by the runtime. Use this method to add services to the container.
        public void ConfigureServices(IServiceCollection services)
        {
            //获取配置参数
            services.Configure<Jwtsetting>(Configuration.GetSection("JWTSetting"));
            Jwtsetting setting = new Jwtsetting();
            Configuration.Bind("JWTSetting", setting);
            services.AddAuthentication(option =>
            {
                option.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                option.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
            }).AddJwtBearer(config =>
            {
                config.SecurityTokenValidators.Clear();
                config.SecurityTokenValidators.Add(new MyTokenValidate());
                config.Events = new JwtBearerEvents()
                {
                    OnMessageReceived = context =>
                    {
                        Microsoft.Extensions.Primitives.StringValues token = context.Request.Headers["myToken"];//myToken参数名称
                        context.Token = token.FirstOrDefault();
                        return Task.CompletedTask;
                    }
                };
            });
            services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_2);

        }

        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IHostingEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }
            else
            {
                // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
                app.UseHsts();
            }
            //启动验证
            app.UseAuthentication();
            app.UseHttpsRedirection();
            app.UseMvc();
        }
    }

4、新增LoginController,用于测试生成token

   [Route("api/[controller]/[action]")]
    [ApiController]
    public class LoginController : ControllerBase
    {
        private Jwtsetting Setting;
        public LoginController(IOptions<Jwtsetting> options)
        {
            Setting = options.Value;
        }
        [HttpGet]
        public Object Login(string UserName = "002",string Password= "123456")
        {
            string tokenValue = string.Empty;
            if (ModelState.IsValid)
            {
                Claim[] claims = new Claim[] {
                        new Claim(ClaimTypes.Name,UserName),
                    new Claim(ClaimTypes.Role, "admin")
                };
                //获取加密Key
                SymmetricSecurityKey key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Setting.SecretKey));
                //加密方式
                SigningCredentials creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
                //生成token
                JwtSecurityToken token = new JwtSecurityToken(Setting.Issuer, Setting.Audience, claims, DateTime.Now, DateTime.Now.AddMinutes(10), creds);
                tokenValue = new JwtSecurityTokenHandler().WriteToken(token).ToString();

            }
            return tokenValue;
        }
    }

5、新增MyTokenValidate，此类继承ISecurityTokenValidator，用于验证token是否正确

    public class MyTokenValidate : ISecurityTokenValidator
    {
        public bool CanValidateToken => throw new NotImplementedException();

        public int MaximumTokenSizeInBytes { get => throw new NotImplementedException(); set => throw new NotImplementedException(); }

        public bool CanReadToken(string securityToken)
        {
            return true;
        }

        /// <summary>
        /// 验证token
        /// </summary>
        /// <param name="securityToken"></param>
        /// <param name="validationParameters"></param>
        /// <param name="validatedToken"></param>
        /// <returns></returns>
        public ClaimsPrincipal ValidateToken(string securityToken, TokenValidationParameters validationParameters, out SecurityToken validatedToken)
        {
            ClaimsPrincipal principal;
            try
            {
                validatedToken = null;
                JwtSecurityToken token = new JwtSecurityToken(securityToken);
                //获取到Token的一切信息
                JwtPayload payload = token.Payload;
                object role = (from t in payload where t.Key == ClaimTypes.Role select t.Value).FirstOrDefault();
                object name = (from t in payload where t.Key == ClaimTypes.Name select t.Value).FirstOrDefault();
                string issuer = token.Issuer;
                SecurityKey key = token.SecurityKey;
                System.Collections.Generic.IEnumerable<string> audience = token.Audiences;
                ClaimsIdentity identity = new ClaimsIdentity(JwtBearerDefaults.AuthenticationScheme);
                identity.AddClaim(new Claim(ClaimTypes.Name, name.ToString()));
                identity.AddClaim(new Claim(ClaimsIdentity.DefaultRoleClaimType, "admin"));
                principal = new ClaimsPrincipal(identity);
            }
            catch (Exception)
            {

                throw;
            }

            return principal;
        }
    }

 6、权限控制

 [Route("api/[controller]/[action]")]
    [ApiController]
    [Authorize(Roles = "admin")]