本文主要分为两个部分：

    1、概念

    2、.net 8 demo

    第一部分主要描述所有与 JWT 相关的概念以及词汇，及其原理；第二部分是代码示例。

1、概念

一个 token 由 3 个部分组成，并且以实心句号 . 分割，以下为一个 token 示例：

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoidXNlcjEyMyIsIm5iZiI6MTczMTM5MzYzNiwiZXhwIjoxNzMxMzk3MjM2LCJpYXQiOjE3MzEzOTM2MzYsImlzcyI6InlvdXJkb21haW4uY29tIiwiYXVkIjoieW91ci1hcGktYXVkaWVuY2UifQ.q2zUeZ3RAVIxg5CVNI2Pjq9Nfvue3_tCQagDRJmStYI

* base64 transfer online : Base64编码_base64在线解码_base64加密在线转换

2、.net 8 demo

2.1 Authentication

包引用

using Microsoft.IdentityModel.Tokens;
using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;

创建 token 的方法

 1 public string GenerateJwtToken(string userName)
 2 {
 3 
 4     var tokenHander = new JwtSecurityTokenHandler();
 5     var key = Encoding.ASCII.GetBytes("your secret key");
 6     var tokenDescriptor = new SecurityTokenDescriptor
 7     {
 8         // configure the custome information in the Claim instance
 9         Subject = new System.Security.Claims.ClaimsIdentity(new[] { new Claim("name", userName) }),
10 
11         // configure the expiration time
12         Expires = DateTime.UtcNow.AddHours(1),
13 
14         // issuer could be your service name or other, and it will be the [iss] of the token
15         Issuer = "xx Servicing",
16 
17         // audience could be the audience of your service, and it will be the [aud] of the token
18         Audience = "your api audience",
19 
20         // configure secret algorithm and secret key for signature part
21         SigningCredentials = new SigningCredentials(new SymmetricSecurityKey(key), SecurityAlgorithms.HmacSha256Signature)
22 
23     };
24 
25     var token = tokenHander.CreateToken(tokenDescriptor);
26     return tokenHander.WriteToken(token);
27 }

验证 token 的配置

 1 builder.Services.AddAuthentication(options =>
 2 {
 3     options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
 4     options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
 5 })
 6 .AddJwtBearer(options =>
 7 {
 8     options.TokenValidationParameters = new TokenValidationParameters
 9     {
10         // validate the token expiration
11         ValidateLifetime = true, 
12 
13         // validate signature
14         ValidateIssuerSigningKey = true,
15 
16         // need to sure the issuer/audience value here is same with the issuer/audience while token generating
17         ValidateIssuer = true,
18         ValidateAudience = true,
19         ValidIssuer = "yourdomain.com",
20         ValidAudience = "your-api-audience",
21 
22         //ValidateIssuer = false, // Skip issuer validation
23         //ValidateAudience = false, // Skip audience validation
24 
25         IssuerSigningKey = new SymmetricSecurityKey("your secret key"),
26         ClockSkew = TimeSpan.FromMinutes(5) // Allow for clock skew
27 
28     };
29 
30 });

开启 authentication 和 authorization

1 app.UseAuthentication();
2 app.UseAuthorization();

！注意：

1、此处的 Authentication，Authorization 都是 Miscroft.AspNetCore 自带的中间件。

2、Authentication 是鉴权，Authorization 是授权 / 批准，这两个中间件的位置不能错，必须是：鉴权在前。

2.2 Authorization

2.2.1 Authorize

1     // 标注 Authorize 后访问该api时会验证token
2     [Authorize]
3     [HttpGet("GetList")]
4     public IEnumerable<WeatherForecast> GetList()
5     {
6         ..
7     }

2.2.2 Policy 策略

 1     // 在 Startup.cs 中配置策略
 2     services.AddAuthorization(options =>
 3     {  
 4         options.AddPolicy("Over18", policy =>
 5             policy.RequireClaim("Age", "18"));  // 验证 token 中的 age 参数是否等于 18
 6     });
 7 
 8     // 在 Controller 中使用策略
 9     [Authorize(Policy = "Over18")]
10     public IActionResult RestrictedContent()
11     {
12        ..
13     }

 1     // 验证 token 中的 role 参数是否 ("Admin", "Manager")中的成员，注：大小写敏感
 2     services.AddAuthorization(options =>
 3     {
 4         options.AddPolicy("AdminOrManager", policy =>
 5             policy.RequireRole("Admin", "Manager"));
 6     });
 7 
 8     // 多个“并且”条件的声明
 9     services.AddAuthorization(options =>
10     {
11 
12         options.AddPolicy("EmployeeWithDepartment", policy =>
13             policy.RequireClaim("EmployeeNumber")
14                   .RequireClaim("Department", "HR", "IT"));
15     });

2.2.3 AllowAnonymous

 [Authorize] 可以修饰在 controller 上，这意味着该 controller 下的所有 api 都需要验证token，此时可以通过修饰 [AllowAnonymous] 特别指定某一个 api 不需要 token 验证。

 1 [Authorize]
 2 public class AccountController : Controller
 3 {
 4 
 5     [AllowAnonymous]
 6     public IActionResult Login()
 7     {
 8         ..
 9     }
10 
11 
12     public IActionResult Logout()
13     {
14         ..
15     }
16 
17 }

博客园的编辑器也太难用了吧！！

2024-11-13