【ASP.NET Core 认证】自定义Jwt token验证（ISecurityTokenValidator）
Core为我们提供了自定义token验证的接口，当我们需要使用自己的方式验证token时可以使用。
比如Jwt只能数据签名，不能加密。当需要校验加密的jwt token。在登录时将jwt token加密后传给客户端，客户端回传token。这时需要我们自定义token校验。
自定义token校验，实现ISecurityTokenValidator接口
/// <summary>
/// 自定义token校验
/// </summary>
public class MyTokenValidator : ISecurityTokenValidator
{
public int MaximumTokenSizeInBytes { get; set; }
public bool CanReadToken(string securityToken)
{
return true;
}
public bool CanValidateToken
{
get
{
return true;
}
}
//验证token
public ClaimsPrincipal ValidateToken(string securityToken, TokenValidationParameters validationParameters, out SecurityToken validatedToken)
{
string jwtToken = AESCryptoHelper.Decrypt(securityToken);
ClaimsPrincipal principal = new JwtSecurityTokenHandler().ValidateToken(jwtToken, validationParameters, out validatedToken);
return principal;
}
}
配置文件中添加配置：
"JwtTokenOptions": {
"Issuer": "FAN.Issuer",
"ValidateIssuer": true,
"Audience": "FAN.Audience",
"ValidateAudience": true,
"RawSigningKey": "11111111-1111-1111-1111-111111111111",/*签名秘钥*/
"ValidateIssuerSigningKey": true,
"ValidateLifetime": false,
"RequireExpirationTime": false,
"JwtExpiresInMinutes": 6000,
"ValidateIntervaltime": true,
"IntervalExpiresInMinutes": 3000
}
Startup.cs添加如下内容：
public void ConfigureServices(IServiceCollection services)
{
services.AddScoped<TokenBuilder>();
services.Configure<JwtTokenOptions>(Configuration.GetSection("JwtTokenOptions"));
JwtTokenOptions tokenOptions = Configuration.GetSection("JwtTokenOptions").Get<JwtTokenOptions>();
services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
//开启Bearer服务认证
.AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
{
options.SaveToken = true;
options.TokenValidationParameters = tokenOptions.ToTokenValidationParams();
options.SecurityTokenValidators.Clear();
options.SecurityTokenValidators.Add(new MyTokenValidator());
});
}
public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
app.UseAuthentication();
}
User:用户信息
/// <summary>
/// 登录用户信息
/// </summary>
public class User
{
public int UserID { get; set; }
public string Email { get; set; }
public string Name { get; set; }
public string Role { get; set; }
public User(int userID, string name, string email, string role)
{
this.UserID = userID;
this.Name = name;
this.Email = email;
this.Role = role;
}
}
TokenBuilder：用于创建jwt token
/// <summary>
/// token创建
/// </summary>
public class TokenBuilder
{
private JwtTokenOptions _tokenOptions = null;
public TokenBuilder(IOptions<JwtTokenOptions> tokenOptions)
{
this._tokenOptions = tokenOptions.Value;
}
/// <summary>
/// 创建加密JwtToken
/// </summary>
/// <param name="user"></param>
/// <returns></returns>
public string CreateJwtToken(User user)
{
var claimList = this.CreateClaimList(user);
JwtSecurityToken jwtSecurityToken = new JwtSecurityToken(
issuer: this._tokenOptions.Issuer
, audience: this._tokenOptions.Audience
, claims: claimList
//, notBefore: utcNow
, expires: DateTime.Now.AddDays(3)
, signingCredentials: new SigningCredentials(this._tokenOptions.SigningKey, SecurityAlgorithms.HmacSha256)
);
string jwtToken = new JwtSecurityTokenHandler().WriteToken(jwtSecurityToken);
//加密jwtToken
jwtToken = AESCryptoHelper.Encrypt(jwtToken);
return jwtToken;
}
/// <summary>
/// 创建包含用户信息的CalimList
/// </summary>
/// <param name="authUser"></param>
/// <returns></returns>
private List<Claim> CreateClaimList(User authUser)
{
//身份单元项项集合
List<Claim> claimList = new List<Claim>()
{
new Claim(type: ClaimTypes.Email, value: authUser.Email), //身份单元项
new Claim(type: ClaimTypes.Name, value: authUser.Name),
new Claim(type: ClaimTypes.NameIdentifier, value: authUser.UserID.ToString()),
new Claim(type: ClaimTypes.Role, value: authUser.Role ?? string.Empty)
};
return claimList;
}
}
AESCryptoHelper:使用AES对jwttoken的加密解密
/// <summary>
/// AES加密解密
/// </summary>
public class AESCryptoHelper
{
/// <summary>
/// AES加密解密Key，Key必须十六位
/// </summary>
private static readonly string AESKey = "1111111111111111";
/// <summary>
/// AES 加密
/// </summary>
/// <param name="plainText"></param>
/// <returns></returns>
public static string Encrypt(string plainText)
{
return Encrypt(plainText, AESKey);
}
/// <summary>
/// AES 加密
/// </summary>
/// <param name="plainText"></param>
/// <param name="key">密码必须是16位，否则会报错哈</param>
/// <returns></returns>
public static string Encrypt(string plainText, string key)
{
string result = null;
if (string.IsNullOrEmpty(plainText))
{
return result;
}
byte[] plainTextArray = Encoding.UTF8.GetBytes(plainText);
using (MD5CryptoServiceProvider provider = new MD5CryptoServiceProvider())
{
using (RijndaelManaged rijndaelManaged = new RijndaelManaged
{
Key = provider.ComputeHash(Encoding.UTF8.GetBytes(key)),
//Key = Encoding.UTF8.GetBytes(key),
Mode = CipherMode.ECB,
Padding = PaddingMode.PKCS7
})
{
using (ICryptoTransform cryptoTransform = rijndaelManaged.CreateEncryptor())
{
byte[] resultArray = cryptoTransform.TransformFinalBlock(plainTextArray, 0, plainTextArray.Length);
result = Convert.ToBase64String(resultArray, 0, resultArray.Length);
Array.Clear(resultArray, 0, resultArray.Length);
resultArray = null;
}
}
}
Array.Clear(plainTextArray, 0, plainTextArray.Length);
plainTextArray = null;
return result;
}
/// <summary>
/// AES 解密
/// </summary>
/// <param name="encryptText"></param>
/// <returns></returns>
public static string Decrypt(string encryptText)
{
return Decrypt(encryptText, AESKey);
}
/// <summary>
/// AES 解密
/// </summary>
/// <param name="encryptText"></param>
/// <param name="key">密码必须是16位，否则会报错哈</param>
/// <returns></returns>
public static string Decrypt(string encryptText, string key)
{
string result = null;
if (string.IsNullOrEmpty(encryptText))
{
return result;
}
byte[] encryptTextArray = Convert.FromBase64String(encryptText);
using (MD5CryptoServiceProvider provider = new MD5CryptoServiceProvider())
{
using (RijndaelManaged rijndaelManaged = new RijndaelManaged
{
Key = provider.ComputeHash(Encoding.UTF8.GetBytes(key)),
//Key = Encoding.UTF8.GetBytes(key),
Mode = CipherMode.ECB,
Padding = PaddingMode.PKCS7
})
{
using (ICryptoTransform cryptoTransform = rijndaelManaged.CreateDecryptor())
{
byte[] resultArray = cryptoTransform.TransformFinalBlock(encryptTextArray, 0, encryptTextArray.Length);
result = Encoding.UTF8.GetString(resultArray);
Array.Clear(resultArray, 0, resultArray.Length);
resultArray = null;
}
}
}
Array.Clear(encryptTextArray, 0, encryptTextArray.Length);
encryptTextArray = null;
return result;
}
}
控制器：
[Route("api/[controller]/[action]")]
[ApiController]
public class ValuesController : ControllerBase
{
private TokenBuilder _tokenBuilder = null;
public ValuesController(TokenBuilder tokenBuilder)
{
this._tokenBuilder = tokenBuilder;
}
/// <summary>
/// 登录，生成加密token
/// </summary>
/// <returns></returns>
[HttpGet]
public ActionResult<string> Login()
{
//省略登录逻辑。。。。
var user = new User(1, "fan", "410577910@qq.com", "admin");
string signToken = this._tokenBuilder.CreateJwtToken(user);
return signToken;
}
/// <summary>
/// 创建订单，需要校验token
/// </summary>
/// <returns></returns>
[Authorize]
[HttpPost]
public ActionResult<string> CreateOrder()
{
if (base.User.Identity.IsAuthenticated)
{
string userName = base.User.Identity.Name;
}
//省略创建订单逻辑。。。
return "生成订单成功";
}
}
测试
登录：（获取token）
http://localhost:5000/api/values/CreateOrder
创建订单：（带上token，才能授权通过）
http://localhost:5000/api/values/CreateOrder POST
Headers添加：
Key： Authorization
Value： Bearer 2FrDOaIT8r9n7axl4ARhe2dp7S7bWS5+eCcErbkeIIzVbutYr+LmMI1HBEWCLwgwS80adJlwDGW9iNtL2Kp4y+twxHmEpPJfhmg8X1uzgYReh6Nd7XcJmQh9zXvma9gfySU8DcEOijD79wellmRqPNh8ZYX7C0DqKx55L8DVgkJ4emOHIyni/V7qs3xqgU6RstCCxOAI4tHS7v67jmtQJks2x88iBntAJWsPwr7jRChvdWXHpsMeOzyZDjEwiT/XZIFHwB6wyUOfGqqkpdj3s36XwaKEvEBJzwSL2LCUEpMJUr7SQ0r4ZJNnPEBsFoiA/s35nbhgt9OU5w4Z+9MUJ2hBW/eTRlhwtcUR48nitE+PyJS9Ipan+wngvKkkX64BU0l4aLQ9b+REmjf9NZ1RD1UGCL2bmP5XDeoHtYM8uEGYCXu4vvZ1C16oy7AJv/PEEUtL1WNEwJ0Pf9A3DV0o0UxR1q1T5x5nFHftmUu/wrgL2R6GJkUKvWOFWJgAILRk1jHd6HueuqTdTZWdPIDmUH6XwaKEvEBJzwSL2LCUEpMATTE2c3Sw+06USRWWJ3+pIYWS7pM632cOahyPj5iyAihGleXc3bFgjTH/9zlUnJAz3FTrFdRLjj4Vy/UTQDwUKLZEcPWXcYFTPtfuMuR1rwrzIXJOa8ywA/qdbn0XTHtCbTPTHADBaqPEzK8NxMQdCrtgfuCjJ4kPrmVxOaf784RiHgDmcvJ+2Xtazf09hYo+gKtSy8xLTktDZHxfniAtfZP8QU18rpGNsOcKl/E7rA==
