.Net Core webapi 实现JWT认证
文章目录
- 需求
- 准备
- 创建JWT配置
- 创建JWTService
- 注册JWT
- 创建中间件读取jwt的token
- 在需要的接口上添加属性
- 启动认证
- 启动swagger的授权认证
- 使用
需求
实现一个记录某个用户所有操作的功能
准备
- 创建你的webapi项目
- 从nuget下载安装JWT资源包根据你的项目使用.net版本下载对应的jwt版本，测试项目使用了.net8.0：
Microsoft.AspNetCore.Authentication.JwtBearer
创建JWT配置
在appsettings.json中新增JWTOptions
"JWTOptions": {
//你的jwt加密密钥
"SecretKey": "ThisIsASecretKeyForJWTTokenGeneration",
"Issuer": "localhost", //令牌颁发者
"Audience": "localhost", //令牌接收者
"Expired": 5 //令牌过期时间
}
创建jwt配置类并注册
public class JWTOptions
{
/// <summary>
/// jwt加密密钥，任意字符串
/// </summary>
public string SecretKey { get; set; }
/// <summary>
/// 颁发者
/// </summary>
public string Issuer { get; set; }
/// <summary>
/// 接收者
/// </summary>
public string Audience { get; set; }
/// <summary>
/// 过期时间
/// </summary>
public int Expired { get; set; }
}
//在program.cs中注册该option
builder.Services.Configure<JWTOptions>(builder.Configuration.GetSection("JWTOptions"));
创建JWTService
创建服务生成token
public class GenerateJWTService
{
private readonly JWTOptions _options;
public GenerateJWTService(IOptionsMonitor<JWTOptions> options)
{
_options = options.CurrentValue;
}
public JWTokenTResult GenerateToken(string userName)
{
var claims = new List<Claim>
{
new("userName", userName),
new(JwtRegisteredClaimNames.Sub, userName),
};
var validFrom = DateTime.Now;
var validTo = DateTime.Now.AddMinutes(10);
//创建令牌
var jwt = new JwtSecurityToken(
issuer: _options.Issuer,
audience: _options.Audience,
claims: claims,
notBefore: validFrom,
expires: validTo,
signingCredentials: new Microsoft.IdentityModel.Tokens.SigningCredentials(new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_options.SecretKey)), SecurityAlgorithms.HmacSha256)
) ;
string accessToken = new JwtSecurityTokenHandler().WriteToken(jwt);
return new JWTokenTResult
{
AccessToken = accessToken,
ExpireIn = _options.Expired * 60,
TokenType = JwtBearerDefaults.AuthenticationScheme
};
}
}
//jwt模型
public class JWTokenTResult
{
public string AccessToken { get; set; }
public string RefreshToken { get; set; }
/// <summary>
/// 过期时间，单位s
/// </summary>
public int ExpireIn { get; set; }
public string TokenType { get; set; }
public LoginUserModel User { get; set; }
}
public class LoginUserModel
{
public string UserId { get; set; }
public string UserName { get; set; }
public string Roles { get; set; }
}
注册JWT
把jwt注册到服务中
public static void AddJWTTokenAuth(this IServiceCollection serivces, IConfiguration configuration)
{
var jwtSettings = configuration.GetSection("JWTOptions");
serivces.Configure<JWTOptions>(configuration.GetSection("JWTOptions"));
serivces.AddAuthentication(JwtBearerDefaults.AuthenticationScheme).AddJwtBearer(options =>
{
options.SaveToken = true;
options.TokenValidationParameters = new TokenValidationParameters
{
ValidateIssuer = true,
ValidateAudience = true,
ValidateLifetime = true,//启动token有效时间校验
ClockSkew = TimeSpan.Zero, //默认ClockSkew是5分钟，当前时间和JWT的过期时间之间的差距小于 5 分钟，Token 仍然会被认为是有效的
ValidateIssuerSigningKey = true,
ValidIssuer = jwtSettings["Issuer"],
ValidAudience = jwtSettings["Audience"],
IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwtSettings["SecretKey"]))
};
});
}
//在program.cs中调用
builder.Services.AddJWTTokenAuth(builder.Configuration);
创建中间件读取jwt的token
using System.IdentityModel.Tokens.Jwt;
using System.Text;
namespace JWTTest
{
public class UserMiddleware
{
private readonly RequestDelegate _next;
private readonly GenerateJWTService _generateJWTService;
public UserMiddleware(RequestDelegate next, GenerateJWTService generateJWTService)
{
_next = next;
_generateJWTService = generateJWTService;
}
public async Task InvokeAsync(HttpContext context)
{
if(context.User.Identity.IsAuthenticated)
{
var requestUrl = $"{context.Request.Scheme}://{context.Request.Host}{context.Request.Path}{context.Request.QueryString}";
if(context.Request.Method.ToUpper() == "GET")
{
}
else
{
context.Request.EnableBuffering();// 启用请求体流缓冲，以便多次读取
var reader = new StreamReader(context.Request.Body, Encoding.UTF8);
var body = await reader.ReadToEndAsync();
// 将请求体位置重置，避免后续中间件或控制器读取不到
context.Request.Body.Position = 0;
}
var userName = context.User.Claims.FirstOrDefault(c => c.Type == "userName")?.Value;
Console.WriteLine($"{userName} request");
var token = context.Request.Headers["Authorization"].FirstOrDefault()?.Split(" ").Last();
var tokenhandler = new JwtSecurityTokenHandler();
var jwtToken = tokenhandler.ReadToken(token) as JwtSecurityToken;
if(jwtToken != null)
{
//如果token将要过期，实现用户无感刷新，只需要前端判断response的header中是否有New-Access-Token，有就替换原来的token
if(jwtToken.ValidTo - DateTime.UtcNow < TimeSpan.FromMinutes(5))
{
var newAccessToken = _generateJWTService.GenerateToken(userName);
context.Response.Headers["New-Access-Token"] = "";//newAccessToken;
}
}
}
await _next(context);
}
}
}
在需要的接口上添加属性
在需要的接口上添加[Authorize]属性，也可以加到controller上，然后给不需要认证的接口添加[AllowAnonymous]，跳过认证
using JWTTest.Model;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
namespace JWTTest.Controllers
{
[ApiController]
[Route("[controller]/[action]")]
public class WeatherForecastController : ControllerBase
{
private static readonly string[] Summaries = new[]
{
"Freezing", "Bracing", "Chilly", "Cool", "Mild", "Warm", "Balmy", "Hot", "Sweltering", "Scorching"
};
private readonly ILogger<WeatherForecastController> _logger;
private readonly GenerateJWTService _generateJWTService;
public WeatherForecastController(ILogger<WeatherForecastController> logger, GenerateJWTService generateJWTService)
{
_logger = logger;
_generateJWTService = generateJWTService;
}
[HttpGet(Name = "GetWeatherForecast")]
[Authorize]
public IEnumerable<WeatherForecast> Get()
{
return Enumerable.Range(1, 5).Select(index => new WeatherForecast
{
Date = DateOnly.FromDateTime(DateTime.Now.AddDays(index)),
TemperatureC = Random.Shared.Next(-20, 55),
Summary = Summaries[Random.Shared.Next(Summaries.Length)]
})
.ToArray();
}
[Authorize]
[HttpPost("test/testpost")]
public ActionResult Test(LoginUserModel loginUserModel)
{
return default;
}
[HttpGet("/login")]
public ActionResult GetLogin(string name, string password)
{
var jwtTokenResult = _generateJWTService.GenerateToken(name);
//jwtTokenResult.refresh_token = refreshToken;
return Ok(jwtTokenResult);//这里可按需返回 如果不想返回用户信息 比如密码 可以在_generateJwt.GenerateEncodedTokenAsync去掉哦
}
}
}
启动认证
//在program.cs中启动认证，顺序不能错
app.UseAuthentication(); //身份验证，验证令牌信息
app.UseAuthorization();//授权
启动swagger的授权认证
using Microsoft.OpenApi.Models;
namespace Wonder.OHTC.Backend.Extension
{
public static class SwaggerAuthExtension
{
/// <summary>
/// 为swagger添加authorization
/// </summary>
/// <param name="services"></param>
public static void AddSwaggerExtension(this IServiceCollection services)
{
services.AddSwaggerGen(options =>
{
// 为 Swagger JSON and UI设置xml文档注释路径
var basePath = Path.GetDirectoryName(typeof(Program).Assembly.Location);//获取应用程序所在目录（绝对，不受工作目录影响，建议采用此方法获取路径）
var xmlPath = Path.Combine(basePath, "Wonder.OHTC.Backend.xml");
// 添加控制器层注释，true表示显示控制器注释 false表示只显示API接口的注释
options.IncludeXmlComments(xmlPath, true);
options.AddSecurityDefinition("Bearer", new OpenApiSecurityScheme()
{
In = ParameterLocation.Header,//jwt默认存放Authorization信息的位置(请求头中)
Description = "Please enter JWT with bearer into field",
Name = "Authorization",//jwt默认的参数名称
Type = SecuritySchemeType.ApiKey
});
options.AddSecurityRequirement(new OpenApiSecurityRequirement()
{
{
new OpenApiSecurityScheme
{
Reference = new OpenApiReference
{
Type = ReferenceType.SecurityScheme,
Id = "Bearer"
}
},
Array.Empty<string>()
}
});
});
}
}
}
//在program.cs中调用
builder.Services.AddSwaggerExtension();
也可以直接在program里面直接注册jwt
using JWTTest.Model;
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.IdentityModel.Tokens;
using Microsoft.OpenApi.Models;
using System.Text;
namespace JWTTest
{
public class Program
{
public static void Main(string[] args)
{
var builder = WebApplication.CreateBuilder(args);
// Add services to the container.
builder.Services.AddControllers();
// Learn more about configuring Swagger/OpenAPI at https://aka.ms/aspnetcore/swashbuckle
builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen(options =>
{
options.AddSecurityDefinition("Bearer", new Microsoft.OpenApi.Models.OpenApiSecurityScheme()
{
In = Microsoft.OpenApi.Models.ParameterLocation.Header,//jwt默认存放Authorization信息的位置(请求头中)
Description = "Please enter JWT with bearer into field",
Name = "Authorization",//jwt默认的参数名称
Type = Microsoft.OpenApi.Models.SecuritySchemeType.ApiKey
});
options.AddSecurityRequirement(new Microsoft.OpenApi.Models.OpenApiSecurityRequirement()
{
{
new OpenApiSecurityScheme
{
Reference = new OpenApiReference
{
Type = ReferenceType.SecurityScheme,
Id = "Bearer"
}
},
new string[]{}
}
});
});
var jwtSettings = builder.Configuration.GetSection("JWTOptions");
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme).AddJwtBearer(options =>
{
options.SaveToken = true;
options.TokenValidationParameters = new TokenValidationParameters
{
ValidateIssuer = true,
ValidateAudience = true,
ValidateLifetime = true,//启动token有效时间校验
ClockSkew = TimeSpan.Zero, //默认ClockSkew是5分钟，当前时间和JWT的过期时间之间的差距小于 5 分钟，Token 仍然会被认为是有效的
ValidateIssuerSigningKey = true,
ValidIssuer = jwtSettings["Issuer"],
ValidAudience = jwtSettings["Audience"],
IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwtSettings["SecretKey"]))
};
});
builder.Services.Configure<JWTOptions>(builder.Configuration.GetSection("JWTOptions"));
builder.Services.AddSingleton<GenerateJWTService>();
var app = builder.Build();
// Configure the HTTP request pipeline.
if (app.Environment.IsDevelopment())
{
app.UseSwagger();
app.UseSwaggerUI();
}
app.UseHttpsRedirection();
app.UseAuthentication(); //身份验证
app.UseAuthorization();//授权
app.MapControllers();
app.UseMiddleware<UserMiddleware>();
app.Run();
}
}
}
使用
