AspNet Core: Jwt 身份认证

目录

• AspNet Core: Jwt 身份认证
  • 资源服务器
    • 创建项目
    • 依赖包
    • 添加API
    • Program
  • 认证服务器
    • 创建项目
    • 依赖包
    • 数据库
      • JWTUser
      • JWTDbContext
    • appsettings.json
    • 用户注册
    • Token 控制器
    • Program
  • 客户端
    • 创建项目
    • 添加 JS 库
    • 用户注册
    • 用户登录
    • 获取API数据
    • Program
  • 有关刷新token

AspNet Core: Jwt 身份认证

资源服务器

创建项目

新建一个“AspNetCore WebApi” 项目，名为：DotNet.WebApi.Jwt.ApiResources

依赖包

添加依赖包：

<PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="7.0.3" />

添加API

新建控制器 Controllers/StudentController.cs:

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

namespace DotNet.WebApi.Jwt.ApiResources.Controllers
{
    //[Authorize(Policy = "OnlyRead")]
    [Authorize]
    [Route("api/[controller]")]
    [ApiController]
    public class StudentController : ControllerBase
    {
        [Authorize(Policy = "ReadWrite")]
        [HttpGet("GetStudents")]
        public ActionResult<dynamic> GetStudents()
        {
            return new List<dynamic>()
            {
                new {Id=1,Name="张三",Age=21 },
                new {Id=2,Name="李四",Age=22 },
                new {Id=3,Name="王五",Age=23 },
            };
        }

        [Authorize(Policy = "OnlyRead")]
        [HttpGet("GetStudent")]
        public ActionResult<dynamic> GetStudent()
        {
            return new List<dynamic>()
            {
            new { Id = 10, Name = "钱六", Age = 19 }
            };
        }
    }
}

Program

将 Program.cs 修改为：

using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.IdentityModel.Tokens;
using System.Text;

namespace DotNet.WebApi.Jwt.ApiResources
{
    public class Program
    {
        public static void Main(string[] args)
        {
            Console.Title = "API资源服务器";

            var builder = WebApplication.CreateBuilder(args);

            //设置跨域
            builder.Services.AddCors(options =>
            {
                options.AddDefaultPolicy(
                    builder =>
                    {
                        //允许任何来源访问。
                        builder.AllowAnyOrigin().AllowAnyHeader();
                        //将isexpired头添加到策略中。
                        builder.WithExposedHeaders(new string[] { "isexpired" });
                    });
            });

            //配置策略授权
            builder.Services.AddAuthorization(options => {
                options.AddPolicy("OnlyRead", policy => policy.RequireRole("Read").Build());
            });

            //配置JWT。
            builder.Services.AddAuthentication(a =>
            {
                a.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                a.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
            }).AddJwtBearer(j =>
            {
                j.RequireHttpsMetadata = false;
                j.SaveToken = true;
                j.TokenValidationParameters = new TokenValidationParameters
                {
                    //是否调用对签名securityToken的SecurityKey进行验证
                    ValidateIssuerSigningKey = true,
                    IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("798654167464654646")),//签名秘钥
                    ValidateIssuer = true,//是否验证颁发者
                    ValidIssuer = "dotnet-jwt",//颁发者
                    ValidateAudience = true, //是否验证接收者
                    ValidAudience = "StudentAPI",//接收者
                    ValidateLifetime = true,//是否验证失效时间
                };
                //捕获Token过期事件
                j.Events = new JwtBearerEvents
                {
                    OnAuthenticationFailed = context =>
                    {
                        //出现此类异常。
                        if (context.Exception.GetType() == typeof(SecurityTokenExpiredException))
                        {
                            //在响应头中添加isexpired:true键值对。
                            context.Response.Headers.Add("isexpired", "true");
                        }
                        return Task.CompletedTask;
                    }
                };
            });

            builder.Services.AddAuthorization();
            builder.Services.AddControllers();
            builder.Services.AddEndpointsApiExplorer();
            builder.Services.AddSwaggerGen();

            var app = builder.Build();

            // Configure the HTTP request pipeline.
            if (app.Environment.IsDevelopment())
            {
                app.UseSwagger();
                app.UseSwaggerUI();
            }

            if (app.Environment.IsProduction())
            {
                //生产环境端口号
                app.Urls.Add("https://*:6002");
            }

            app.UseHttpsRedirection();
            app.UseCors();   //启用跨域
            app.UseAuthentication(); //身份验证
            app.UseAuthorization();  //授权
            app.MapControllers();

            app.Run();
        }
    }
}

代码解析：
（1）添加JWT 身份认证中间件

            //配置JWT。
            builder.Services.AddAuthentication(a =>
            {
                a.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                a.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
            }).AddJwtBearer(j =>
            {
                j.RequireHttpsMetadata = false;
                j.SaveToken = true;
                j.TokenValidationParameters = new TokenValidationParameters
                {
                    //是否调用对签名securityToken的SecurityKey进行验证
                    ValidateIssuerSigningKey = true,
                    IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("798654167464654646")),//签名秘钥
                    ValidateIssuer = true,//是否验证颁发者
                    ValidIssuer = "dotnet-jwt",//颁发者
                    ValidateAudience = true, //是否验证接收者
                    ValidAudience = "StudentAPI",//接收者
                    ValidateLifetime = true,//是否验证失效时间
                };
                //捕获Token过期事件
                j.Events = new JwtBearerEvents
                {
                    OnAuthenticationFailed = context =>
                    {
                        //出现此类异常。
                        if (context.Exception.GetType() == typeof(SecurityTokenExpiredException))
                        {
                            //在响应头中添加isexpired:true键值对。
                            context.Response.Headers.Add("isexpired", "true");
                        }
                        return Task.CompletedTask;
                    }
                };
            });

（2）捕获 Token 事件，处理refreshToken:

                //捕获Token过期事件
                j.Events = new JwtBearerEvents
                {
                    OnAuthenticationFailed = context =>
                    {
                        //出现此类异常。
                        if (context.Exception.GetType() == typeof(SecurityTokenExpiredException))
                        {
                            //在响应头中添加isexpired:true键值对。
                            context.Response.Headers.Add("isexpired", "true");
                        }
                        return Task.CompletedTask;
                    }
                };

（3）添加基于策略的授权：

            //配置策略授权
            builder.Services.AddAuthorization(options => {
                options.AddPolicy("OnlyRead", policy => policy.RequireRole("Read").Build());
            });

然后在控制器中使用基于策略的授权：
代码：Controllers/StudentController.cs:

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

namespace DotNet.WebApi.Jwt.ApiResources.Controllers
{
    [Authorize]
    [Route("api/[controller]")]
    [ApiController]
    public class StudentController : ControllerBase
    {
        [Authorize(Policy = "ReadWrite")]
        [HttpGet("GetStudents")]
        public ActionResult<dynamic> GetStudents()
        {
            ......
        }

        [Authorize(Policy = "OnlyRead")]
        [HttpGet("GetStudent")]
        public ActionResult<dynamic> GetStudent()
        {
            ......
        }
    }
}

认证服务器

创建项目

新建一个“AspNetCore 空” 项目，名为：DotNet.WebApi.Jwt.Authentication

依赖包

添加依赖包：

<PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="7.0.3" />

数据库

创建一个数据库，用于保存登录用户

JWTUser

namespace DotNet.WebApi.Jwt.Authentication.Data
{
    public class JWTUser
    {
        //用户Id。
        [Key]
        public int UserId { get; set; }
        //用户名。
        public string? UserName { get; set; }
        //用户密码。
        public string? UserPwd { get; set; }
        //用户邮箱。
        public string? UserEmail { get; set; }
    }
}

JWTDbContext

using Microsoft.EntityFrameworkCore;

namespace DotNet.WebApi.Jwt.Authentication.Data
{
    /// <summary>
    /// 数据库上下文。
    /// </summary>
    public class JWTDbContext : DbContext
    {
        public JWTDbContext(DbContextOptions<JWTDbContext> options) : base(options)
        {
        }

        public DbSet<JWTUser>? JWTUsers { get; set; }
    }
}

appsettings.json

{
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },
  "AllowedHosts": "*",
  "ConnectionStrings": {
    "JwtDbConnection": "Server=localhost;Database=JWTDb;Uid=sa;Pwd=123456;Encrypt=True;TrustServerCertificate=True;"
  }
}

用户注册

Controllers/AccountController.cs

using DotNet.WebApi.Jwt.Authentication.Data;
using Microsoft.AspNetCore.Mvc;

namespace DotNet.WebApi.Jwt.Authentication.Controllers
{
    [Route("api/[controller]")]
    [ApiController]
    public class AccountController : ControllerBase
    {
        private readonly JWTDbContext _context;

        public AccountController(JWTDbContext context)
        {
            _context = context;
        }

        /// <summary>
        /// 添加用户。
        /// </summary>
        /// <param name="user"></param>
        /// <returns></returns>
        [HttpPost("Register")]
        public async Task<ActionResult<int>> RegisterUser(JWTUser user)
        {
            //如果user参数为空，则返回404错误。
            if (user == null) return NotFound();
            //添加用户
            _context.JWTUsers?.Add(user);
            //执行操作。
            var count = await _context.SaveChangesAsync();
            return count;
        }
    }
}

Token 控制器

Controllers/TokenController.cs

using Microsoft.AspNetCore.Mvc;
using Microsoft.EntityFrameworkCore;
using Microsoft.IdentityModel.Tokens;
using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Text;
using DotNet.WebApi.Jwt.Authentication.Data;

namespace DotNet.WebApi.Jwt.Authentication.Controllers
{
    [Route("api/[controller]")]
    [ApiController]
    public class TokenController : ControllerBase
    {
        private readonly JWTDbContext _context;

        private const string signingKey = "798654167464654646";
        private const string issuer = "dotnet-jwt";
        private const string audience = "StudentAPI";

        public TokenController(JWTDbContext context)
        {
            _context = context;
        }

        /// <summary>
        /// 生成Token
        /// </summary>
        /// <returns></returns>
        [HttpGet("Get")]
        public async Task<ActionResult> BuildAccessToken(string userName, string userPwd)
        {
            //判断用户信息是否为空
            if (string.IsNullOrWhiteSpace(userName) || string.IsNullOrWhiteSpace(userPwd))
            {
                return NotFound();
            }
                
            //根据用户名和密码找到用户实体
            var user = await _context.JWTUsers!.AsNoTracking()
                .FirstOrDefaultAsync( u =>
                   u.UserName!.Equals(userName) && u.UserPwd!.Equals(userPwd)
                 );
            if (user == null) 
            {
                return BadRequest("用户名或密码错误。");
            }
                
            //声明
            var claims = new[]
            {
                new Claim(ClaimTypes.Sid,user.UserId.ToString()),
                new Claim(ClaimTypes.Name, userName),
                new Claim(ClaimTypes.Role,"Read")
            };
            //设置密钥
            var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(signingKey));
            //设置凭据
            var credentials = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
            //生成token
            var jwtToken = new JwtSecurityToken(issuer, 
                                                audience, 
                                                claims, 
                                                expires: DateTime.UtcNow.AddMinutes(30), 
                                                signingCredentials: credentials);
            var token = new JwtSecurityTokenHandler().WriteToken(jwtToken);

            return Ok(token);
        }

        /// <summary>
        /// 根据Token获取身份声明。
        /// </summary>
        /// <param name="token">token</param>
        /// <returns></returns>
        private ClaimsPrincipal GetPrincipalFromAccessToken(string token)
        {
            var jwtSecurityToken = new JwtSecurityTokenHandler();
            var claimsPrincipal = jwtSecurityToken.ValidateToken(token, new TokenValidationParameters
            {
                ValidateAudience = false,
                ValidateIssuer = false,
                ValidateIssuerSigningKey = true,
                IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(signingKey)),
                ValidateLifetime = false
            }, out SecurityToken validatedToken);

            return claimsPrincipal;
        }

        /// <summary>
        /// 根据旧Token换取新Token
        /// </summary>
        /// <param name="accessToken"></param>
        /// <returns></returns>
        [HttpGet("Refresh")]
        public ActionResult BuildRefreshToken(string accessToken)
        {
            if (string.IsNullOrWhiteSpace(accessToken)) return NotFound();
            var userClaims = GetPrincipalFromAccessToken(accessToken);
            if (userClaims == null) return NotFound();
            
            //获取旧Token中的声明
            var claims = new[]
            {
                //用户ID
                new Claim(ClaimTypes.Sid,userClaims.FindFirst(u=>u.Type.Equals(ClaimTypes.Sid))!.Value),
                //用户名
                new Claim(ClaimTypes.Name,userClaims.FindFirst(u=>u.Type.Equals(ClaimTypes.Name))!.Value),
                //角色
                new Claim(ClaimTypes.Role,userClaims.FindFirst(u=>u.Type.Equals(ClaimTypes.Role))!.Value)
            };
            //设置密钥
            var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(signingKey));
            //设置凭据
            var credentials = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
            //生成token
            var jwtToken = new JwtSecurityToken(issuer, audience, claims, expires: DateTime.UtcNow.AddMinutes(30), signingCredentials: credentials);
            var token = new JwtSecurityTokenHandler().WriteToken(jwtToken);

            return Ok(token);
        }
    }
}

代码分析:
(1).生成token：BuildAccessToken();
(2).刷新token：BuildRefreshToken(accessToken),调用GetPrincipalFromAccessToken(accessToken) 方法传入过期的 token 解析出 userClaims，用于生成新的token。

Program

Program.cs

using DotNet.WebApi.Jwt.Authentication.Data;
using Microsoft.EntityFrameworkCore;

namespace DotNet.WebApi.Jwt.Authentication
{
    public class Program
    {
        public static void Main(string[] args)
        {
            var builder = WebApplication.CreateBuilder(args);

            //注册数据库上下文服务
            //UseSqlServer表示使用SQLServer数据库。
            builder.Services.AddDbContext<JWTDbContext>(options =>
                options.UseSqlServer(builder.Configuration.GetConnectionString("JwtDbConnection")
            ));

            //设置跨域
            builder.Services.AddCors(options =>
            {
                options.AddDefaultPolicy(
                    builder =>
                    {
                        //允许任何来源访问。
                        builder.AllowAnyOrigin().AllowAnyHeader();
                    });
            });

            builder.Services.AddAuthorization();
            builder.Services.AddControllers();
            // Learn more about configuring Swagger/OpenAPI at https://aka.ms/aspnetcore/swashbuckle
            builder.Services.AddEndpointsApiExplorer();
            builder.Services.AddSwaggerGen();

            var app = builder.Build();
            //生成数据库和表结构
            var scope = app.Services.CreateScope();
            var context = scope.ServiceProvider.GetRequiredService<JWTDbContext>();
            //如果数据库不存在，则生成表结构。
            context.Database.EnsureCreated();
           
            if (app.Environment.IsDevelopment())
            {
                app.UseSwagger();
                app.UseSwaggerUI();
            }

            app.Urls.Add("https://*:6001"); // 修改端口
            app.UseHttpsRedirection();
            app.UseCors();     //启用跨域
            app.UseAuthorization();
            app.MapControllers();

            app.Run();
        }
    }
}

客户端

创建项目

创建一个 “AspNet Core 空项目”，名为:DotNet.WebApi.Jwt.WebClient。这个项目没用到 AspNet Core 的任何功能，仅仅只是作为一个静态文件站点，即：一个纯前端项目。

添加 JS 库

创建"wwwroot"文件夹，然后选择该文件夹，右键【添加/客户端库】，添加 jquery.min.js、bootstrap.min.css 文件。

用户注册

新建Html页面：wwwroot/Users/Register.html

<!DOCTYPE html>
<html>
<head>
    <meta charset="utf-8" />
    <title>用户注册</title>
    <link href="../bootstrap/css/bootstrap.min.css" rel="stylesheet" />
    <script src="../jquery/jquery.min.js"></script>
</head>
<body>
    <div style="padding:20px;width:600px;margin:30px;">
        <h3>用户注册</h3>
        <hr />
        <div class="form-floating">
            <div class="mb-3">
                <label class="form-label">用户名：</label>
                <input type="text" id="userName" class="form-control">
            </div>
            <div class="mb-3">
                <label class="form-label">密  码：</label>
                <input type="password" id="userPwd" class="form-control">
            </div>
            <div class="mb-3">
                <input type="submit" id="btn" value="注册" class="btn btn-primary" />
            </div>
            <div>
                <span id="msg" style="color:red"></span>
            </div>
        </div>
    </div>
    <script>
        $("#btn").click(function () {
            $.ajax({
                //请求类型
                type: "post",
                //请求路径
                url: "https://localhost:6001/api/Account/Register",
                //预期服务器返回的数据类型
                dataType: "text",
                data: JSON.stringify({ UserName: $("#userName").val(), UserPwd: $("#userPwd").val() }),
                contentType: "application/json",
                //请求成功时的回调函数
                success: function (result) {
                    if (result == "1") {
                        $("#msg").text("用户注册成功。");
                    }
                }
            });
        });
    </script>
</body>
</html>

用户登录

新建Html页面：wwwroot/Users/Login.html

<!DOCTYPE html>
<html>
<head>
    <meta charset="utf-8" />
    <title>用户登录</title>
    <link href="../bootstrap/css/bootstrap.min.css" rel="stylesheet" />
    <script src="../jquery/jquery.min.js"></script>
</head>
<body>
    <div style="padding:20px;width:600px;margin:30px;">
        <h3>用户登录</h3>
        <hr />
        <div class="form-floating">
            <div class="mb-3">
                <label class="form-label">用户名：</label>
                <input type="text" id="userName" class="form-control">
            </div>
            <div class="mb-3">
                <label class="form-label">密  码：</label>
                <input type="password" id="userPwd" class="form-control">
            </div>
            <div class="mb-3">
                <input type="submit" id="btn" value="登录" class="btn btn-primary" />
            </div>
            <div class="mb-3">
                <span id="msg" style="color:red"></span>
            </div>
        </div>
    </div>
    <script>
        $("#btn").click(function () {
            $.ajax({
                //请求类型
                type: "get",
                //请求路径
                url: "https://localhost:6001/api/Token/Get",
                //预期服务器返回的数据类型
                dataType: "text",
                data: { UserName: $("#userName").val(), UserPwd: $("#userPwd").val() },
                contentType: "application/json",
                //请求成功时的回调函数
                success: function (token) {
                    localStorage.setItem("token", token);
                    console.log(token);
                    location.href = 'GetData.html';
                }
            });
        });
    </script>
</body>
</html>

代码解析：
(1).获取token：调用 Get请求：https://localhost:6001/api/Token/Get, 获取token。
(2).将token保存到本地存储： localStorage.setItem("token", token);

获取API数据

新建Html页面：wwwroot/Users/GetData.html，内部调用 认证服务器【DotNet.WebApi.Jwt.Authentication】获取 token，然后使用token调用资源服务器【DotNet.WebApi.Jwt.ApiResources】的API

<!DOCTYPE html>
<html>
<head>
    <meta charset="utf-8" />
    <title>获取数据</title>
    <link href="../bootstrap/css/bootstrap.min.css" rel="stylesheet" />
    <script src="../jquery/jquery.min.js"></script>
</head>
<body style="margin:20px;">
    <table id="showTable" class="table table-bordered">
        <thead>
            <tr>
                <td>ID</td>
                <td>姓名</td>
                <td>年龄</td>
            </tr>
        </thead>
        <tbody></tbody>
    </table>
    <script>
        var tbody = $("#showTable tbody")
        //请求资源
        $.ajax({
            type: 'get',
            contentType: 'application/json',
            url: 'https://localhost:6002/api/Student/GetStudent',
            beforeSend: function (xhr) {
                //获取Token
                var accessToken = localStorage.getItem("token");
                //使用Token请求资源
                xhr.setRequestHeader('Authorization', 'Bearer ' + accessToken);
            },
            //获取的数据
            success: function (data) {
                $.each(data, function (n, value) {
                    var trs = "";
                    trs += "<tr>" +
                        "<td>" + value.id + "</td>" +
                        "<td>" + value.name + "</td>" +
                        "<td>" + value.age + "</td>" +
                        "</tr>";
                    tbody += trs;
                });
                $("#showTable").append(tbody);
            },
            error: function (xhr) {
                if (xhr.status === 401 && xhr.getResponseHeader('isexpired') === 'true') {
                    //Token已过期了。
                    getRefreshAccessToken();
                }
            }
        })
        //获取刷新后的新Token。
        function getRefreshAccessToken() {
            $.ajax({
                type: 'get',
                contentType: 'application/json',
                url: 'https://localhost:6001/api/Token/Refresh',
                data: { accessToken: localStorage.getItem("token") },
                success: function (token) {
                    //将获取的新Token存储起来
                    localStorage.setItem("token", token);
                }
            })
        }
    </script>
</body>
</html>

代码解析：
(1) 从本地存储中获取token：var accessToken = localStorage.getItem("token");
(2) 刷新token： 当返回401并且响应头中有‘xhr.getResponseHeader('isexpired') === 'true'’，调用getRefreshAccessToken()从认证服务的
https://localhost:6001/api/Token/Refresh,参数为当前过期的 token，获取新的token。

Program

修改 Program.cs 为：

namespace DotNet.WebApi.Jwt.WebClient
{
    public class Program
    {
        public static void Main(string[] args)
        {
            var builder = WebApplication.CreateBuilder(args);
            var app = builder.Build();

            app.UseStaticFiles(); //启用静态文件

            app.Run();
        }
    }
}

有关刷新token

上述获取刷新token的方式是通过返回401和返回头中带特定的字段来判断token是否过期，这种做法的缺点就是必须失败一次。更好的做法是，

• 返回token的请求中包含其过期时间，
• 前端封装出一个Http请求函数：每次请求前都将当前时间与过期时间比对，若token过期，使用过期的token请求新的token，并重设请求头：authorization：bearer token.