.Net Core之JWT认证方案

.Net Core提供了JWT的认证方案，开箱即用，我们再配合Redis启用黑名单机制，基本可以满足需求

基本功能 

开启JWT认证：

public void ConfigureServices(IServiceCollection services)
{
    services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme).AddJwtBearer(opt =>
                {
                    opt.TokenValidationParameters = new TokenValidationParameters
                    {
                        NameClaimType = ClaimTypes.Name,
                        RoleClaimType = ClaimTypes.Role,

                        ValidIssuer = Issuer,
                        ValidAudience = Audience,
                        IssuerSigningKey = new SymmetricSecurityKey(Encoding.ASCII.GetBytes(Secret))
                    };
                });
}

public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
    app.UseAuthentication();
}

开启认证之后，就可以在增加认证接口：

/// <summary>
/// 认证
/// </summary>
[AllowAnonymous]
[HttpPost("authenticate")]
public async Task<IActionResult> Authenticate([FromBody]UserDTO userDto)
{
    var user = await _userRepo.GetAll()
                              .FirstOrDefaultAsync(e => e.Code == userDto.UserName);
    if (user == null)
    {
        return BadRequest("user_not_found");
    }
    //这里对密码MD5加密
    if (user.Password is Wrong)
    {
        return BadRequest("wrong_password");
    }
    //Token生成：按需配置
    var tokenHandler = new JwtSecurityTokenHandler();
    var key = Encoding.ASCII.GetBytes(Secret);
    var authTime = DateTime.Now;
    var expiresAt = authTime.AddDays(1);//按需设置时长
    var jti = Guid.NewGuid().ToString();
    var tokenDescriptor = new SecurityTokenDescriptor
    {
        Audience = Audience,
        Issuer = Issuer,
        Subject = new ClaimsIdentity(new Claim[]
        {
            new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()),
            new Claim(ClaimTypes.Name, user.Code),
            new Claim(JwtRegisteredClaimNames.Jti, jti)
        }),
        IssuedAt = authTime,
        Expires = expiresAt,
        SigningCredentials = new SigningCredentials(new SymmetricSecurityKey(key), SecurityAlgorithms.HmacSha256Signature)
    };
    var token = tokenHandler.CreateToken(tokenDescriptor);
    var tokenString = tokenHandler.WriteToken(token);

    return Ok(new AuthResponseDTO
    {
        Access_Token = tokenString,
        Token_Type = "Bearer",
        Expires_At = expiresAt,
        User = user
    });
}

黑名单机制

经过以上两步，初步实现了JWT认证的功能，但我们还需要关注Token失效的问题。我们可以尽量设置短的过期时间，同时配合RefreshToken。不过这里不讨论这种方案，只采用黑名单机制（Redis）。

• 在退出登录的时候将相应Token加入黑名单；
• 修改人员的时候记录人员和时间，将当时间之前的所有Token判定为无效；
• 每次请求都通过Redis黑名单验证Token的有效性。
• 配合Redis验证Token有效性，就要重写默认的JwtSecurityTokenHandler：

public class CustomJwtSecurityTokenHandler : JwtSecurityTokenHandler
{
    private readonly IRedisRepo _redis;

    public RevokableJwtSecurityTokenHandler(IServiceProvider serviceProvider)
    {
        _redis = serviceProvider.GetRequiredService<IRedisRepo>();
    }

    public override ClaimsPrincipal ValidateToken(string token, TokenValidationParameters validationParameters,
        out SecurityToken validatedToken)
    {
        var claimsPrincipal = base.ValidateToken(token, validationParameters, out validatedToken);
        //通过Redis验证Token
        if (!_redis.IsTokenActive(claimsPrincipal))
        {
            throw new UnauthorizedException();
        }

        return claimsPrincipal;
    }
}

public void ConfigureServices(IServiceCollection services)
{
    services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme).AddJwtBearer(opt =>
                {
                    opt.SecurityTokenValidators.Clear();
                    opt.SecurityTokenValidators.Add(new CustomJwtSecurityTokenHandler(services.BuildServiceProvider()));
                });
}

public bool IsTokenActive(ClaimsPrincipal principal)
{
    //解析ClaimsPrincipal取出UserId、Iat和Jti
    //具体的验证步骤有两个：
    //- 到Redis查找该用户的Token失效时间，如果当前Token的颁发时间在此之前就是无效的；
    //- 到Redis的黑名单里判断是否存在该Token；
}