在netcore中jwt使用场景很多,网上有很多的资料,这里不再累述,之后有机会会单独介绍,今天主要以实战为主。
1、create jwt token
![](https://images.cnblogs.com/OutliningIndicators/ContractedBlock.gif)
1 public interface IJwtTokenService 2 { 3 string GetJwtToken(); 4 } 5 6 public class JwtTokenService : IJwtTokenService 7 { 8 private readonly IConfiguration _config; 9 public JwtTokenService(IConfiguration config) 10 { 11 this._config = config; 12 } 13 public string GetJwtToken() 14 { 15 var claims = new List<Claim>() 16 { 17 new Claim(JwtRegisteredClaimNames.Sub,"jwtsubvalue"), 18 new Claim(JwtRegisteredClaimNames.Name,"jwtnamevalue"), 19 new Claim("Scope","API"), 20 new Claim("Role","Admin") 21 }; 22 var securityKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_config["JwtToken:SecretKey"])); 23 var credentials = new SigningCredentials(securityKey,SecurityAlgorithms.HmacSha256); 24 var issuer = _config["JwtToken:Issuer"]; 25 var audience = _config["JwtToken:Audience"]; 26 var expires = DateTime.Now.AddMinutes(Convert.ToDouble(_config["JwtToken:ExpiredMinutes"])); 27 28 var jwtToken = new JwtSecurityToken(issuer, audience, claims: claims, notBefore: DateTime.Now, expires: expires, signingCredentials: credentials); 29 return new JwtSecurityTokenHandler().WriteToken(jwtToken); 30 } 31 }jwt token
2、configuration中所需配置信息
1 "JwtToken": { 2 "SecretKey": "12345678901234567890123456789012", 3 "Issuer": "https://localhost:5000", 4 "Audience": "https://localhost:5000", 5 "ExpiredMinutes": 10 6 }
3、在Program中配置authentication
![](https://images.cnblogs.com/OutliningIndicators/ContractedBlock.gif)
1 var configuration = builder.Configuration; 2 builder.Services.AddAuthentication(options => 3 { 4 options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme; 5 options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme; 6 }) 7 .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options => 8 { 9 options.TokenValidationParameters = new TokenValidationParameters 10 { 11 ValidateIssuer = true, 12 ValidateAudience = true, 13 ValidateLifetime = true, 14 ValidateIssuerSigningKey = true, 15 ValidIssuer = configuration["JwtToken:Issuer"], 16 ValidAudience = configuration["JwtToken:Audience"], 17 IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(configuration["JwtToken:SecretKey"])) 18 }; 19 options.Events = new JwtBearerEvents 20 { 21 OnTokenValidated = context => 22 { 23 var token = context.SecurityToken as JwtSecurityToken; 24 var identity = context.Principal?.Identity as ClaimsIdentity; 25 if (!string.IsNullOrEmpty(token?.Issuer)) 26 context.Success(); 27 else 28 context.Fail($"Token invalid"); 29 return Task.CompletedTask; 30 }, 31 OnAuthenticationFailed = context => 32 { 33 context.Fail(context.Exception); 34 return Task.CompletedTask; 35 }, 36 OnForbidden = context => 37 { 38 context.Fail("403 forbidden"); 39 return Task.CompletedTask; 40 }, 41 OnChallenge = context => 42 { 43 var error = context.Error; 44 return Task.CompletedTask; 45 }, 46 OnMessageReceived = context => 47 { 48 var token = context.Token; 49 return Task.CompletedTask; 50 } 51 }; 52 //Configure authentication scheme forwarding to another scheme 53 options.ForwardDefaultSelector = context => 54 { 55 if (context.Request.Headers.TryGetValue("x-api-type", out Microsoft.Extensions.Primitives.StringValues uiTokenType)) 56 return "CustomScheme"; 57 return JwtBearerDefaults.AuthenticationScheme; 58 }; 59 }).AddJwtBearer("CustomScheme", options => 60 { 61 options.Authority = configuration["JwtToken:Issuer"]; 62 options.TokenValidationParameters = new TokenValidationParameters 63 { 64 ValidateIssuer = true, 65 ValidIssuer = configuration["JwtToken:Issuer"] 66 }; 67 options.Events = new JwtBearerEvents 68 { 69 OnTokenValidated = context => 70 { 71 context.Success(); 72 return Task.CompletedTask; 73 } 74 }; 75 });authentication
4、在请求管道中应用authentication
app.UseAuthentication();
5、添加测试controller,指定[Authorize] atrribute
![](https://images.cnblogs.com/OutliningIndicators/ContractedBlock.gif)
1 [Authorize] 2 [HttpGet("all")] 3 public IActionResult Get([FromServices] IConfiguration configuration) 4 { 5 return Ok( 6 new 7 { 8 ID = 1, 9 Name = "consul service", 10 version = 1.0, 11 serviceIP = configuration["ip"], 12 servicePort = configuration["port"] 13 }); 14 }test controller
通过swagger测试返回401
6、swagger中authorize之后返回[Authorize] api controller,返回200
下面介绍下如何在swagger中支持authorize及api分组
![](https://images.cnblogs.com/OutliningIndicators/ContractedBlock.gif)
1 #region Swagger 2 builder.Services.AddEndpointsApiExplorer(); 3 builder.Services.AddSwaggerGen(c => 4 { 5 //c.IgnoreObsoleteActions(); 6 //c.TagActionsBy(api => 7 //{ 8 // if (api.GroupName != null) 9 // return new[] { api.GroupName }; 10 // var controllerActionDescriptor = api.ActionDescriptor as ControllerActionDescriptor; 11 // if (controllerActionDescriptor != null) 12 // return new[] { controllerActionDescriptor.ControllerName }; 13 // throw new InvalidOperationException("Unable to determine tag for endpoint."); 14 //}); 15 //c.DocInclusionPredicate((name, api) => api.GroupName == "demo1"); 16 17 c.SwaggerDoc("demo1", new OpenApiInfo { Title = "demo1", Description = "this is demo1 v1", Version = "demo1v1" }); 18 c.SwaggerDoc("demo2", new OpenApiInfo { Title = "demo2", Description = "this is demo2 v1", Version = "demo2v1" }); 19 20 c.AddSecurityDefinition("bearerauth", new OpenApiSecurityScheme 21 { 22 Name = "Authorization", 23 Type = SecuritySchemeType.Http, 24 Scheme = "Bearer", 25 BearerFormat = "Bearer", 26 In = ParameterLocation.Header, 27 Description = "JWT Authorization header using the Bearer scheme." 28 }); 29 c.AddSecurityRequirement(new OpenApiSecurityRequirement 30 { 31 { 32 new OpenApiSecurityScheme 33 { 34 //Notes: this is for swagger authentication 35 //Type= SecuritySchemeType.Http, 36 //In= ParameterLocation.Header, 37 38 Reference=new OpenApiReference { Type = ReferenceType.SecurityScheme, Id = "bearerauth" } 39 }, 40 new string[]{} 41 } 42 }); 43 }); 44 #endregionswagger authorize & group
![](https://images.cnblogs.com/OutliningIndicators/ContractedBlock.gif)
1 app.UseSwagger(); 2 app.UseSwaggerUI(c => 3 { 4 c.SwaggerEndpoint($"/swagger/demo1/swagger.json", "demo1"); 5 c.SwaggerEndpoint($"/swagger/demo2/swagger.json", "demo2"); 6 });swagger group endpoint
接下来介绍Authorization Policy及custom policy
![](https://images.cnblogs.com/OutliningIndicators/ContractedBlock.gif)
1 builder.Services.AddAuthorization(options => 2 { 3 var defaultPolicy = new AuthorizationPolicyBuilder(); 4 defaultPolicy.AddAuthenticationSchemes(JwtBearerDefaults.AuthenticationScheme); 5 defaultPolicy.RequireAuthenticatedUser(); 6 options.DefaultPolicy = defaultPolicy.Build(); 7 8 options.AddPolicy("CustomScopePolicy", policy => 9 { 10 policy.RequireAuthenticatedUser(); 11 policy.RequireClaim("Scope", "API"); 12 }); 13 options.AddPolicy("CustomRolePolicy", policy => 14 { 15 policy.RequireAuthenticatedUser(); 16 policy.RequireClaim("Role", "Admin"); 17 }); 18 options.AddPolicy("RoleScopePolicy", policy => 19 { 20 policy.RequireAuthenticatedUser(); 21 policy.AddRequirements(new CustomRequirement("admin")); 22 }); 23 }); 24 25 builder.Services.AddTransient<IJwtTokenService, JwtTokenService>(); 26 builder.Services.AddSingleton<IAuthorizationHandler, CustomRoleBaseAuthorizationHandler>(); 27 builder.Services.AddSingleton<IAuthorizationHandler, CustomScopeBaseAuthorizationHandler>();policy
app.UseAuthorization();
![](https://images.cnblogs.com/OutliningIndicators/ContractedBlock.gif)
1 public class CustomRoleBaseAuthorizationHandler : AuthorizationHandler<CustomRequirement> 2 { 3 protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, CustomRequirement requirement) 4 { 5 var principal = context.User; 6 var roleClaim = principal.Claims.FirstOrDefault(c => c.Type.Equals("Role", StringComparison.OrdinalIgnoreCase)); 7 if (roleClaim?.Value.Equals(requirement.Role, StringComparison.OrdinalIgnoreCase) ?? false) 8 context.Succeed(requirement); 9 return Task.CompletedTask; 10 } 11 } 12 13 public class CustomScopeBaseAuthorizationHandler : AuthorizationHandler<CustomRequirement> 14 { 15 protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, CustomRequirement requirement) 16 { 17 var principal = context.User; 18 var claim = principal.Claims.FirstOrDefault(c => c.Type.Equals("Scope", StringComparison.OrdinalIgnoreCase)); 19 if (claim?.Value.Equals("API", StringComparison.OrdinalIgnoreCase) ?? false) 20 context.Succeed(requirement); 21 return Task.CompletedTask; 22 } 23 }custom policy handler
![](https://images.cnblogs.com/OutliningIndicators/ContractedBlock.gif)
1 public class CustomRequirement : IAuthorizationRequirement 2 { 3 public string Role { get; set; } 4 public CustomRequirement(string role) 5 { 6 Role = role; 7 } 8 }custom requirement
添加测试controller
![](https://images.cnblogs.com/OutliningIndicators/ContractedBlock.gif)
1 [HttpGet("v1"), Authorize(Policy = "RoleScopePolicy")] 2 public IActionResult Index() 3 { 4 return new JsonResult(new List<string> { "group1", "group2" }); 5 } 6 7 [HttpGet("v2"),Authorize(Policy = "CustomRolePolicy")] 8 [ApiExplorerSettings(IgnoreApi = false)] 9 public IActionResult IndexV2() 10 { 11 return new JsonResult(new List<string> { "group3", "group4" }); 12 }test controller
测试结果
OK 搞定!
标签:return,NetCore,JWT,public,token,context,var,new,options From: https://www.cnblogs.com/qindy/p/17100967.html