(原)NET CORE3.1自定义JWT授权验证

原文链接地址：https://www.cnblogs.com/ruyun/p/12134290.html

登录获取JWT

    [ApiController]
    public class LoginController : ControllerBase
    {
        private readonly IOptions<JwtOption> options;
public LoginController(IOptions<JwtOption> options)

{

this.options = options;

}
[HttpGet("/login")]

[AllowAnonymous]

public IActionResult Login([FromQuery]string username)

{

string roleType = username == "admin" ? "Administrator" : "Other";
var claims = new Claim[]

{

new Claim("Role",roleType),

};

var token = new JwtToken(options.Value).GenerateToken(claims);

return Ok(token);

}

}

在初始控制器WeatherForecastController中Get上添加[Authorize]

自定义token的生成帮助类

    public class JwtToken
    {
        private readonly byte[] secret;
        private readonly string audience;
        private readonly string issuer;
        private readonly int expiresMinute;
public JwtToken(JwtOption options)

{

secret = Encoding.ASCII.GetBytes(options.Secret);

audience = options.Audience;

issuer = options.Issuer;

expiresMinute = options.ExpirationMinutes;

}

///生成JWT

public JwtResult GenerateToken(Claim[] claims)

{

var authTime = DateTime.UtcNow;

var expiresAt = authTime.AddMinutes(expiresMinute);
var tokenDescriptor = new SecurityTokenDescriptor

{

Audience = audience,

Issuer = issuer,

Subject = new ClaimsIdentity(claims),

Expires = expiresAt,

SigningCredentials = new SigningCredentials(

new SymmetricSecurityKey(secret), SecurityAlgorithms.HmacSha256Signature)

};

var tokenHandler = new JwtSecurityTokenHandler();

var token = tokenHandler.CreateToken(tokenDescriptor);

var tokenString = tokenHandler.WriteToken(token);

return new JwtResult

{

access_token = tokenString,

token_type = "Bearer",

auth_time = new DateTimeOffset(authTime).ToUnixTimeSeconds(),

expires_at = new DateTimeOffset(expiresAt).ToUnixTimeSeconds()

};

}

}

public class JwtResult

{

/// <summary>

/// access token

/// </summary>

public string access_token { get; set; }

/// <summary>

/// token type

/// </summary>

public string token_type { get; set; }

/// <summary>

/// 授权时间

/// </summary>

public long auth_time { get; set; }

/// <summary>

/// 过期时间

/// </summary>

public long expires_at { get; set; }

}

public class JwtOption

{

public string Secret { get; set; }

public string Issuer { get; set; }

public string Audience { get; set; }

public int ExpirationMinutes { get; set; }

}

在Appsettings中添加

  "Authorization": {
    "Secret": "qtiOLpT7mJQx239e2kgMheAH7B9lGQJnoxYRCb7KX3x1ogDEd55I7dJ1ziYptiTF",
    "Issuer": "https://www.cnblogs.com/ruyun/",
    "Audience": "https://www.cnblogs.com/ruyun/",
    "ExpirationMinutes": "2000"
  }

自定义授权类

    public class PermissionRequirement : IAuthorizationRequirement
    {
        public string PermissionName { get; }
public PermissionRequirement(string PermissionName)

{

this.PermissionName = PermissionName;

}

}

public class PermissionRequirementHandler : AuthorizationHandler<PermissionRequirement>

{

private readonly IHttpContextAccessor httpContextAccessor;
public PermissionRequirementHandler(IHttpContextAccessor httpContextAccessor)

{

this.httpContextAccessor = httpContextAccessor;

}
protected override async Task HandleRequirementAsync(AuthorizationHandlerContext context, PermissionRequirement requirement)

{

var result = await httpContextAccessor.HttpContext.AuthenticateAsync(JwtBearerDefaults.AuthenticationScheme);

if (!result.Succeeded)

{

context.Fail();

return;

}

httpContextAccessor.HttpContext.User = result.Principal;

var role = httpContextAccessor.HttpContext.User.FindFirst(c => c.Type == "Role");
if (role != null)

{

var roleValue = role.Value;

var permissions = RolePermissionCache.GetPermissions(role.Value);

if (permissions.Contains(requirement.PermissionName))

{

context.Succeed(requirement);

}

}

return;

}

}
//权限动态缓存类 临时替代数据库

public class RolePermissionCache

{

//实际在数据库获取与配置

public static List<string> GetPermissions(string role)

{

switch (role)

{

case "Administrator":

return new List<string>() { "Index", "CustomPermission" };

case "Custom":

return new List<string>() { "Index" };

}

return new List<string>();

}

}

internal class PermissionPolicyProvider : IAuthorizationPolicyProvider

{

//这里默认使用自定义的授权模式

public Task<AuthorizationPolicy> GetDefaultPolicyAsync()

{

var policy = new AuthorizationPolicyBuilder();

policy.AddRequirements(new PermissionRequirement("CustomPermission"));

return Task.FromResult(policy.Build());

}
public Task<AuthorizationPolicy> GetFallbackPolicyAsync()

{

return Task.FromResult(new AuthorizationPolicyBuilder().RequireAuthenticatedUser().Build());

}
public Task<AuthorizationPolicy> GetPolicyAsync(string policyName)

{

var policy = new AuthorizationPolicyBuilder();

policy.AddRequirements(new PermissionRequirement(policyName));

return Task.FromResult(policy.Build());

}

}