我的方式非主流，控制卻可以更加靈活，喜歡的朋友，不妨花一點時間學習一下
jwt認證分為兩部分，第一部分是加密解密，第二部分是靈活的應用於中介軟體，我的處理方式是將獲取token放到api的一個具體的controller中，將發放token與驗證分離，token的失效時間，發證者，使用者等資訊存放到config中。
1.配置：
在appsettings.json中增加配置
"Jwt": { "Issuer": "issuer",//隨意定義 "Audience": "Audience",//隨意定義 "SecretKey": "abc",//隨意定義 "Lifetime": 20, //單位分鐘 "ValidateLifetime": true,//驗證過期時間 "HeadField": "useless", //頭欄位 "Prefix": "prefix", //字首 "IgnoreUrls": [ "/Auth/GetToken" ]//忽略驗證的url }
2:定義配置類：
internal class JwtConfig
{
public string Issuer { get; set; }
public string Audience { get; set; }
/// <summary>
/// 加密key
/// </summary>
public string SecretKey { get; set; }
/// <summary>
/// 生命週期
/// </summary>
public int Lifetime { get; set; }
/// <summary>
/// 是否驗證生命週期
/// </summary>
public bool ValidateLifetime { get; set; }
/// <summary>
/// 驗證頭欄位
/// </summary>
public string HeadField { get; set; }
/// <summary>
/// jwt驗證字首
/// </summary>
public string Prefix { get; set; }
/// <summary>
/// 忽略驗證的url
/// </summary>
public List<string> IgnoreUrls { get; set; }
}
3.加密解密介面：
public interface IJwt { string GetToken(Dictionary<string, string> Clims); bool ValidateToken(string Token,out Dictionary<string ,string> Clims); }
4.加密解密的實現類：
install-package System.IdentityModel.Tokens.Jwt
public class Jwt : IJwt { private IConfiguration _configuration; private string _base64Secret; private JwtConfig _jwtConfig = new JwtConfig(); public Jwt(IConfiguration configration) { this._configuration = configration; configration.GetSection("Jwt").Bind(_jwtConfig); GetSecret(); } /// <summary> /// 獲取到加密串 /// </summary> private void GetSecret() { var encoding = new System.Text.ASCIIEncoding(); byte[] keyByte = encoding.GetBytes("salt"); byte[] messageBytes = encoding.GetBytes(this._jwtConfig.SecretKey); using (var hmacsha256 = new HMACSHA256(keyByte)) { byte[] hashmessage = hmacsha256.ComputeHash(messageBytes); this._base64Secret= Convert.ToBase64String(hashmessage); } } /// <summary> /// 生成Token /// </summary> /// <param name="Claims"></param> /// <returns></returns> public string GetToken(Dictionary<string, string> Claims) { List<Claim> claimsAll = new List<Claim>(); foreach (var item in Claims) { claimsAll.Add(new Claim(item.Key, item.Value)); } var symmetricKey = Convert.FromBase64String(this._base64Secret); var tokenHandler = new JwtSecurityTokenHandler(); var tokenDescriptor = new SecurityTokenDescriptor { Issuer = _jwtConfig.Issuer, Audience = _jwtConfig.Audience, Subject = new ClaimsIdentity(claimsAll), NotBefore = DateTime.Now, Expires = DateTime.Now.AddMinutes(this._jwtConfig.Lifetime), SigningCredentials =new SigningCredentials(new SymmetricSecurityKey(symmetricKey), SecurityAlgorithms.HmacSha256Signature) }; var securityToken = tokenHandler.CreateToken(tokenDescriptor); return tokenHandler.WriteToken(securityToken); } public bool ValidateToken(string Token, out Dictionary<string, string> Clims) { Clims = new Dictionary<string, string>(); ClaimsPrincipal principal = null; if (string.IsNullOrWhiteSpace(Token)) { return false; } var handler = new JwtSecurityTokenHandler(); try { var jwt = handler.ReadJwtToken(Token); if (jwt == null) { return false; } var secretBytes = Convert.FromBase64String(this._base64Secret); var validationParameters = new TokenValidationParameters { RequireExpirationTime = true, IssuerSigningKey = new SymmetricSecurityKey(secretBytes), ClockSkew = TimeSpan.Zero, ValidateIssuer = true,//是否驗證Issuer ValidateAudience = true,//是否驗證Audience ValidateLifetime = this._jwtConfig.ValidateLifetime,//是否驗證失效時間 ValidateIssuerSigningKey = true,//是否驗證SecurityKey ValidAudience = this._jwtConfig.Audience, ValidIssuer = this._jwtConfig.Issuer }; SecurityToken securityToken; principal = handler.ValidateToken(Token, validationParameters, out securityToken); foreach (var item in principal.Claims) { Clims.Add(item.Type, item.Value); } return true; } catch (Exception ex) { return false; } } }
5.定義獲取Token的Controller:
在Startup.ConfigureServices中注入 IJwt
services.AddTransient<IJwt, Jwt>();//Jwt注入
[Route("[controller]/[action]")] [ApiController] public class AuthController : ControllerBase { private IJwt _jwt; public AuthController(IJwt jwt) { this._jwt = jwt; } /// <summary> /// getToken /// </summary> /// <returns></returns> [HttpPost] public IActionResult GetToken() { if (true) { Dictionary<string, string> clims = new Dictionary<string, string>(); clims.Add("userName", userName); return new JsonResult(this._jwt.GetToken(clims)); } } }
6.建立中介軟體：
public class UseJwtMiddleware { private readonly RequestDelegate _next; private JwtConfig _jwtConfig =new JwtConfig(); private IJwt _jwt; public UseJwtMiddleware(RequestDelegate next, IConfiguration configration,IJwt jwt) { _next = next; this._jwt = jwt; configration.GetSection("Jwt").Bind(_jwtConfig); } public Task InvokeAsync(HttpContext context) { if (_jwtConfig.IgnoreUrls.Contains(context.Request.Path)) { return this._next(context); } else { if (context.Request.Headers.TryGetValue(this._jwtConfig.HeadField, out Microsoft.Extensions.Primitives.StringValues authValue)) { var authstr = authValue.ToString(); if (this._jwtConfig.Prefix.Length > 0) { authstr = authValue.ToString().Substring(this._jwtConfig.Prefix.Length+1, authValue.ToString().Length -(this._jwtConfig.Prefix.Length+1)); } if (this._jwt.ValidateToken(authstr, out Dictionary<string, string> Clims)) { foreach (var item in Clims) { context.Items.Add(item.Key, item.Value); } return this._next(context); } else { context.Response.StatusCode = 401; context.Response.ContentType = "application/json"; return context.Response.WriteAsync("{\"status\":401,\"statusMsg\":\"auth vaild fail\"}"); } } else { context.Response.StatusCode = 401; context.Response.ContentType = "application/json"; return context.Response.WriteAsync("{\"status\":401,\"statusMsg\":\"auth vaild fail\"}"); } } } }
7.中介軟體暴露出去
public static class UseUseJwtMiddlewareExtensions
{
/// <summary>
/// 許可權檢查
/// </summary>
/// <param name="builder"></param>
/// <returns></returns>
public static IApplicationBuilder UseJwt(this IApplicationBuilder builder)
{
return builder.UseMiddleware<UseJwtMiddleware>();
}
}
8.在Startup.Configure中使用中介軟體：
app.UseJwt();
以1的配置為例：
除了請求 /auth/getToken 不需要加頭資訊外，其他的請求一律要求頭資訊中必須帶著
userless:prefix (從Auth/GetToken中獲取到的token)