.net core 授权验证学习

 

1、Cookies 授权验证方式

　　Startup.cs 文件

 

　　// 注册Cookie认证服务

　　services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme).AddCookie(o =>
　　{
　　o.ExpireTimeSpan = TimeSpan.FromDays(1);

　　....
　　});

　　

　　//身份认证中间件

　　app.UseAuthentication();

　　//授权中间件
　　app.UseAuthorization();

 

　　Cookies 的写入

//用户信息
var claims = new List<Claim>();
claims.Add(new Claim("id", "Id 值"));
claims.Add(new Claim("name", "Name 值"));
claims.Add(new Claim("role", "角色值"));
var claimsIdentity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme);
var principal = new ClaimsPrincipal(claimsIdentity);

//写入Cookies
await this.HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme,principal);

　　

　　在需要授权的地api 方法上增加Cookies 验证特性

　　[Authorize(AuthenticationSchemes = CookieAuthenticationDefaults.AuthenticationScheme)]

 

　　//设置支持多种请认方式，以下为 Token 和 cookies 两种认证方式

　　[Authorize(AuthenticationSchemes = "Cookies,Bearer")]

　　//不验证授权

 　　[AllowAnonymous]

2、Jwt Token 授权方式

　　

//配置 Jwt 认证服务
services
.AddOptions<JwtBearerOptions>(JwtBearerDefaults.AuthenticationScheme)
.Configure<IOptions<TokenOptions>>((options, tokenOptions) =>
{
    var opt = tokenOptions.Value;
    options.TokenValidationParameters = new TokenValidationParameters
    {
        ValidateIssuer = opt.Issuer != null,
        ValidateAudience = opt.Audience != null,
        ValidateLifetime = true,
        ValidateIssuerSigningKey = true,

        ClockSkew = TimeSpan.FromMinutes(30),
        ValidIssuer = opt.Issuer,
        ValidAudience = opt.Audience,
        IssuerSigningKey = opt.ToSecurityKey()
    };
});

//注册 Jwt 认证服务
services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme).AddJwtBearer();

　　

/// <summary>
    /// 表示token选项
    /// </summary>
    public class TokenOptions
    {
        /// <summary>
        /// 证书路径
        /// </summary>
        public string Pfx { get; set; } = "certs/jwt/jwt.pfx";

        /// <summary>
        /// 安全算法
        /// </summary>
        public string SecurityAlgorithm { get; set; } = SecurityAlgorithms.RsaSha256;

        /// <summary>
        /// Issuer字段
        /// </summary>
        public string? Issuer { get; set; } = "http://medical.com";

        /// <summary>
        /// Audience字段
        /// </summary>
        public string? Audience { get; set; }

        /// <summary>
        /// 过期时间
        /// </summary>
        public TimeSpan Expire { get; set; } = TimeSpan.FromDays(365);

        /// <summary>
        /// 转换为安全键
        /// </summary>
        /// <returns></returns>
        public SecurityKey ToSecurityKey()
        {
            var path = Path.Combine(AppContext.BaseDirectory, this.Pfx);
            var certificate = new X509Certificate2(path);
            return new X509SecurityKey(certificate);
        }

        /// <summary>
        /// 创建jwt
        /// </summary> 
        /// <param name="claims"></param>
        /// <param name="expire"></param> 
        /// <returns></returns>
        public TokenResult CreateToken(IEnumerable<Claim> claims, TimeSpan? expire = null)
        {
            var securityKey = this.ToSecurityKey();
            var signingCredentials = new SigningCredentials(securityKey, this.SecurityAlgorithm);
            var jwtHandler = new JwtSecurityTokenHandler();

            var expireValue = expire == null ? this.Expire : expire.Value;
            var jwt = jwtHandler.CreateJwtSecurityToken(
                issuer: this.Issuer,
                audience: this.Audience,
                expires: DateTime.Now.Add(expireValue),
                signingCredentials: signingCredentials,
                subject: new ClaimsIdentity(claims)
            );
            var token = jwtHandler.WriteToken(jwt);
            return new TokenResult
            {
                Access_token = token,
                Expires_in = (long)expireValue.TotalSeconds,
                Refresh_token = null,
                Token_type = "bearer"
            };
        }
    }

/// <summary>
    /// 表示token描述
    /// </summary>
    public class TokenResult
    {
        /// <summary>
        /// token值
        /// </summary>
        public string Access_token { get; set; } = string.Empty;

        /// <summary>
        /// 过期时间戳(秒)
        /// </summary>
        public long Expires_in { get; set; }

        /// <summary>
        /// token类型
        /// </summary>
        public string Token_type { get; set; } = "bearer";

        /// <summary>
        /// 刷新token
        /// </summary>
        public string? Refresh_token { get; set; }
    }

 

 

备注：程序运行时经常出现以下异常：

Microsoft.AspNetCore.DataProtection.KeyManagement.XmlKeyManager

解决办法

　　1、服务注册，重定义新的目录；

　　　　services.AddDataProtection().PersistKeysToFileSystem(new DirectoryInfo(Path.Combine(AppContext.BaseDirectory, "DataProtection")));

　　2、删除 C:\Users\******\AppData\Local\ASP.NET\DataProtection-Keys 下的所有文件