使用Jwt为.Net Core SignalR保驾护航

前言

  SignalR Demo搭建起来之后,是没有相应的认证和授权功能的。于是乎,参考官方文档实现了相应的逻辑。

简单认证

  首先使用稍微简单的方式实现。添加如下代码:

 services.AddAuthentication(auth =>
           {
                auth.DefaultScheme = "User";
           }).AddScheme<UserAuthenticationOptions, UserAuthenticationHandler>("User", o => { });

  

1
2
3
4
public class UserAuthenticationOptions : AuthenticationSchemeOptions
   {
      
   }

  然后在新增Handler,重写 AuthenticationHandler 的HandleAuthenticateAsync 方法

复制代码
  public class UserAuthenticationHandler : AuthenticationHandler<UserAuthenticationOptions>
    {
        private readonly ILayIMUserFactory userFactory;

        public UserAuthenticationHandler(IOptionsMonitor<UserAuthenticationOptions> options, ILoggerFactory logger, UrlEncoder encoder, ISystemClock clock, IServiceProvider serviceProvider)
        : base(options, logger, encoder, clock)
        {
            userFactory = serviceProvider.GetService<ILayIMUserFactory>();
        }
        protected override Task<AuthenticateResult> HandleAuthenticateAsync()
        {
            var userId = userFactory.GetUserId(Request.HttpContext);
            if (string.IsNullOrEmpty(userId))
            {
                return Task.FromResult(AuthenticateResult.Fail("no user"));
            }
            var claims = new[] { new Claim("user", userId) };
            var identity = new ClaimsIdentity(claims, nameof(UserAuthenticationHandler));
            var ticket = new AuthenticationTicket(new ClaimsPrincipal(identity), Scheme.Name);
            return Task.FromResult(AuthenticateResult.Success(ticket));
        }
    }
复制代码

  最后在Hub上增加AuthorizeAttribute即可

1
2
[Authorize(AuthenticationSchemes = “User”)]
public class LayIMHub : Hub<ILayIMClient>{}

JWT Bearer认证

  首先安装 Microsoft.AspNetCore.Authentication.JwtBearer .

  然后在Startup中增加如下代码:(基本上就是官方教程中的)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
services.AddAuthentication(options =>
           {
               options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
               options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
           })
           .AddJwtBearer(options =>
           {
               options.TokenValidationParameters =
                   new TokenValidationParameters
                   {
                       LifetimeValidator = (before, expires, token, param) =>
                       {
                           return expires > DateTime.UtcNow;
                       },
                       ValidateAudience = false,
                       ValidateIssuer = false,
                       ValidateActor = false,
                       ValidateLifetime = true,
                       IssuerSigningKey = new SymmetricSecurityKey(Encoding.ASCII.GetBytes(SignalRSecurityKey.TOKEN_KEY))
                   };
               options.Events = new JwtBearerEvents
               {
                   OnMessageReceived = context =>
                   {
                       var accessToken = context.Request.Query["access_token"];
 
                       var path = context.HttpContext.Request.Path;
                       if (!string.IsNullOrEmpty(accessToken) &&
                           (path.StartsWithSegments("/layimHub")))
                       {
                           context.Token = accessToken;
                       }
                       return Task.CompletedTask;
                   }
               };
           });

  不过AuthorizeAttribute 的Scheme 要改成  JwtBearerDefaults.AuthenticationScheme. 运行一下程序,因为刚开始没有提供token,所以肯定是401的。

  

  对了,客户端连接的时候要加上accessTokenFactory:

1
2
3
4
5
6
7
8
var options = {};
    options.accessTokenFactory = () => token;
    //options.skipNegotiation = true;
    connection = new signalR.HubConnectionBuilder()
        .configureLogging(signalR.LogLevel.Trace)
        .withUrl(hubRoute, options)
        .withHubProtocol(protocol)
        .build();

  我们在实现一个获取Token的接口,在调用SignalR连接之前,先获取Token,然后把token带上即可。以下代码是生成Token的方法,Subject的内容可以随便定义

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
var tokenHandler = new JwtSecurityTokenHandler();
     var key = Encoding.ASCII.GetBytes(SignalRSecurityKey.TOKEN_KEY);
     var authTime = DateTime.UtcNow;
     var expiresAt = authTime.AddDays(7);
     var tokenDescriptor = new SecurityTokenDescriptor
     {
         Subject = new ClaimsIdentity(new Claim[]
         {
            new Claim("uid",userId)
         }),
         Expires = expiresAt,
         SigningCredentials = new SigningCredentials(new SymmetricSecurityKey(key), SecurityAlgorithms.HmacSha256Signature)
     };
     var token = tokenHandler.CreateToken(tokenDescriptor);
     var tokenString = tokenHandler.WriteToken(token);
     return tokenString;

  下面在看演示:

  

  再次请求,已经带上了token头

  

  最后,在websocket握手阶段,也会将这个token传到后端。

 

 

   这样我们的程序就能正常运行了。

总结

  本文只是一篇简单的流水账记录。就酱吧

  代码地址:https://github.com/fanpan26/LayIM.AspNetCore/tree/master/src/LayIM.AspNetCore/LayIM.AspNetCore.IM.SignalR

 

posted @   丶Pz  阅读(1301)  评论(0编辑  收藏  举报
编辑推荐:
· go语言实现终端里的倒计时
· 如何编写易于单元测试的代码
· 10年+ .NET Coder 心语,封装的思维:从隐藏、稳定开始理解其本质意义
· .NET Core 中如何实现缓存的预热?
· 从 HTTP 原因短语缺失研究 HTTP/2 和 HTTP/3 的设计差异
阅读排行:
· 周边上新:园子的第一款马克杯温暖上架
· Open-Sora 2.0 重磅开源!
· 分享 3 个 .NET 开源的文件压缩处理库,助力快速实现文件压缩解压功能!
· Ollama——大语言模型本地部署的极速利器
· DeepSeek如何颠覆传统软件测试?测试工程师会被淘汰吗?
历史上的今天:
2017-09-19 项目多,微信授权回调地址来回变怎么办?
点击右上角即可分享
微信分享提示

目录

目录

X
+

"大爷常来玩呀"

微信支付