.NET Core Jwt use the API certification
Would like .NET Core in secure authentication to the API, the easiest nothing more than Jwt, leisurely remember a year ago to write Jwt Demo, now get back into .NET Core, but the change in the coding is not large, because Jwt powerful enough. Divided in the project DotNetCore_Jwt_Server and DotNetCore_Jwt_Client, can be seen from the name What do you mean, garden experts gathered blog, I will not tell, when will this blog is a record.
Of course, this case is double Server & Client project, if you want to synthesize their own certification form, then you change the code under their own play.
In the Server layer will have a Token distribution service, in which the judge made a user password, and then according to Claim generated operating jwtToken of.
Token service which generates the code:
DotNetCore_Jwt_Server.Services namespace
{
public interface ITokenService
{
String the GetToken (the User User);
}
public class TokenService: ITokenService
{
Private Readonly JwtSetting _jwtSetting;
public TokenService (IOptions <JwtSetting> Option)
{
_jwtSetting = option.Value;
}
public String the GetToken (the User user)
{
// create a user identity, may need to add more information
var Claims the Claim new new = []
{
new new the Claim (JwtRegisteredClaimNames.Jti, Guid.NewGuid (). the ToString ()),
new new the Claim ( "ID", user.Id.ToString (), ClaimValueTypes.Integer32),
new Claim("name", user.Name),
new Claim("admin", user.IsAdmin.ToString(),ClaimValueTypes.Boolean)
};
//创建令牌
var token = new JwtSecurityToken(
issuer: _jwtSetting.Issuer,
audience: _jwtSetting.Audience,
signingCredentials: _jwtSetting.Credentials,
claims: claims,
notBefore: DateTime.Now,
expires: DateTime.Now.AddSeconds(_jwtSetting.ExpireSeconds)
);
string jwtToken = new JwtSecurityTokenHandler().WriteToken(token);
return jwtToken;
}
}
}
In Token we get dependency injection service into the controller, and then rely on it for authentication and distribution Token,
public class ValuesController : ControllerBase
{
private readonly IUserService _userService;
private readonly ITokenService _tokenService;
public ValuesController(IUserService userService,
ITokenService tokenService)
{
_userService = userService;
_tokenService = tokenService;
}
[HttpGet]
public async Task<string> Get()
{
await Task.CompletedTask;
return "Welcome the Json Web Token Solucation!";
}
[HttpGet("getToken")]
public async Task<string> GetTokenAsync(string name, string password)
{
var user = await _userService.LoginAsync(name, password);
if (user == null)
return "Login Failed";
var token = _tokenService.GetToken(user);
var response = new
{
Status = true,
Token = token,
Type = "Bearer"
};
return JsonConvert.SerializeObject(response);
}
}
Then, we fill in the project configuration file in several fields related notes annotated, but worthy of note is a friend asked me, Token generated by the server does not need to save it, such as Redis or Session, in fact Jwt Token is stateless, the contrast between their first token to decrypt your information out correctly or not, the second part is to see if you SecurityKey is correct, so their certification will be the result.
"JwtSetting": {
"SecurityKey": "d0ecd23c-DFDB-4005-A2EA-0fea210c858a", // Key
"Issuer": "jwtIssuertest", // issuer
"Audience": "jwtAudiencetest", // recipient
" ExpireSeconds ": 20000 // expiration time
}
Then we need two interfaces DI initial setup and related fields.
public void ConfigureServices(IServiceCollection services)
{
services.Configure<JwtSetting>(Configuration.GetSection("JwtSetting"));
services.AddScoped<IUserService, UserService>();
services.AddScoped<ITokenService, TokenService>();
services.AddControllers();
}
In Client, I usually create a middleware for receiving the authentication result, AspNetCore Jwt source code provides us with middleware, we further expanded, its source code is defined as follows:
/// <summary>
/// Extension methods to expose Authentication on HttpContext.
/// </summary>
public static class AuthenticationHttpContextExtensions
{/// <summary>
/// Extension method for authenticate.
/// </summary>
/// <param name="context">The <see cref="HttpContext"/> context.</param>
/// <param name="scheme">The name of the authentication scheme.</param>
/// <returns>The <see cref="AuthenticateResult"/>.</returns>
public static Task<AuthenticateResult> AuthenticateAsync(this HttpContext context, string scheme) =>
context.RequestServices.GetRequiredService<IAuthenticationService>().AuthenticateAsync(context, scheme);
}
That the extension will return a result AuthenticateResult type, which is defined in part so that we can be counted on, give him a woes.
Chain sets directly receive httpContext.AuthenticateAsync (JwtBearerDefaults.AuthenticationScheme) returns the value back, and then returns the appropriate judgment Http response code.
public class AuthMiddleware
{
private readonly RequestDelegate _next;
public AuthMiddleware(RequestDelegate next)
{
_next = next;
}
public async Task Invoke(HttpContext httpContext)
{
var result = await httpContext.AuthenticateAsync(JwtBearerDefaults.AuthenticationScheme);
if (!result.Succeeded)
{
httpContext.Response.StatusCode = (int)HttpStatusCode.Unauthorized;
await httpContext.Response.WriteAsync("Authorize error");
}
else
{
httpContext.User = result.Principal;
await _next.Invoke(httpContext);
}
}
}
当然你也得在Client中添加认证的一些设置，它和Server端的 IssuerSigningKey 一定要对应，否则认证失败。
public void ConfigureServices(IServiceCollection services)
{
services.AddHttpContextAccessor();
services.AddScoped<IIdentityService, IdentityService>();
var jwtSetting = new JwtSetting();
Configuration.Bind("JwtSetting", jwtSetting);
services.AddCors(options =>
{
options.AddPolicy("any", builder =>
{
builder.AllowAnyOrigin() //允许任何来源的主机访问
.AllowAnyMethod()
.AllowAnyHeader();
});
});
services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
.AddJwtBearer(options =>
{
options.TokenValidationParameters = new TokenValidationParameters
{
ValidIssuer = jwtSetting.Issuer,
ValidAudience = jwtSetting.Audience,
IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwtSetting.SecurityKey)),
默认 300s
ClockSkew = TimeSpan.Zero
};
});
services.AddControllers();
}
随后，你就可以编写带需认证才可以访问的API了，如果认证失败则会返回401的错误响应。
[Route("api/[controller]")]
[ApiController]
public class ValuesController : ControllerBase
{
private readonly IIdentityService _identityService;
public ValuesController(IIdentityService identityService)
{
_identityService = identityService;
}
[HttpGet]
[Authorize]
public async Task<string> Get()
{
await Task.CompletedTask;
return $"{_identityService.GetUserId()}:{_identityService.GetUserName()}";
}
值得一提的是，我们可以根据 IHttpContextAccessor 以来注入到我们的Service或者Api中，它是一个当前请求的认证信息上下文，这将有利于你获取用户信息去做该做的事情。
public class IdentityService : IIdentityService
{
private readonly IHttpContextAccessor _context;
public IdentityService(IHttpContextAccessor context)
{
_context = context;
}
public int GetUserId()
{
var nameId = _context.HttpContext.User.FindFirst("id");
return nameId != null ? Convert.ToInt32(nameId.Value) : 0;
}
public string GetUserName()
{
return _context.HttpContext.User.FindFirst("name")?.Value;
}
}
在源码中该类的定义如下，实际上我们可以看到只不过是判断了当前的http上下文吧，所以我们得出，如果认证失败，上下本信息也是空的。
public class HttpContextAccessor : IHttpContextAccessor
{
private static AsyncLocal<HttpContextHolder> _httpContextCurrent = new AsyncLocal<HttpContextHolder>();
public HttpContext HttpContext
{
get
{
return _httpContextCurrent.Value?.Context;
}
set
{
var holder = _httpContextCurrent.Value;
if (holder != null)
{
// Clear current HttpContext trapped in the AsyncLocals, as its done.
holder.Context = null;
}
if (value != null)
{
// Use an object indirection to hold the HttpContext in the AsyncLocal,
// so it can be cleared in all ExecutionContexts when its cleared.
_httpContextCurrent.Value = new HttpContextHolder { Context = value };
}
}
}
private class HttpContextHolder
{
public HttpContext Context;
}
}
如果要通过js来测试代码，您可以添加请求头来进行认证，beforeSend是在请求之前的事件。
beforeSend : function(request) {
request.setRequestHeader("Authorization", sessionStorage.getItem("Authorization"));
}
好了，今天就说到这,代码地址在https://github.com/zaranetCore/DotNetCore_Jwt 中。
在.NET Core中想给API进行安全认证，最简单的无非就是Jwt，悠然记得一年前写的Jwt Demo，现在拿回来改成.NET Core的，但是在编码上的改变并不大，因为Jwt已经足够强大了。在项目中分为 DotNetCore_Jwt_Server 以及 DotNetCore_Jwt_Client ，从名字就可以看出来是啥意思，博客园高手云集，我就不多诉说，这篇博客就当是一篇记录。
当然本案例是Server&Client双项目，如果你要合成自己发证的形式，那你就自己改下代码玩。
在Server层都会有分发Token的服务，在其中做了用户密码判断，随后根据 Claim 生成 jwtToken 的操作。
其生成Token的服务代码：
namespace DotNetCore_Jwt_Server.Services
{
public interface ITokenService
{
string GetToken(User user);
}
public class TokenService : ITokenService
{
private readonly JwtSetting _jwtSetting;
public TokenService(IOptions<JwtSetting> option)
{
_jwtSetting = option.Value;
}
public string GetToken(User user)
{
//创建用户身份标识，可按需要添加更多信息
var claims = new Claim[]
{
new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString()),
new Claim("id", user.Id.ToString(), ClaimValueTypes.Integer32),
new Claim("name", user.Name),
new Claim("admin", user.IsAdmin.ToString(),ClaimValueTypes.Boolean)
};
//创建令牌
var token = new JwtSecurityToken(
issuer: _jwtSetting.Issuer,
audience: _jwtSetting.Audience,
signingCredentials: _jwtSetting.Credentials,
claims: claims,
notBefore: DateTime.Now,
expires: DateTime.Now.AddSeconds(_jwtSetting.ExpireSeconds)
);
string jwtToken = new JwtSecurityTokenHandler().WriteToken(token);
return jwtToken;
}
}
}
在获取Token中我们依赖注入服务到控制器中，随后依赖它进行认证并且分发Token，
public class ValuesController : ControllerBase
{
private readonly IUserService _userService;
private readonly ITokenService _tokenService;
public ValuesController(IUserService userService,
ITokenService tokenService)
{
_userService = userService;
_tokenService = tokenService;
}
[HttpGet]
public async Task<string> Get()
{
await Task.CompletedTask;
return "Welcome the Json Web Token Solucation!";
}
[HttpGet("getToken")]
public async Task<string> GetTokenAsync(string name, string password)
{
var user = await _userService.LoginAsync(name, password);
if (user == null)
return "Login Failed";
var token = _tokenService.GetToken(user);
var response = new
{
Status = true,
Token = token,
Type = "Bearer"
};
return JsonConvert.SerializeObject(response);
}
}
随后，我们又在项目配置文件中填写了几个字段，相关备注已注释，但值得说明的是有位朋友问我，服务器端生成的Token不需要保存吗，比如Redis或者是Session，其实Jwt Token是无状态的，他们之间的对比第一个是你的token解密出来的信息正确与否，第二部则是看看你 SecurityKey 是否正确，就这样他们的认证才会得出结果。
"JwtSetting": {
"SecurityKey": "d0ecd23c-dfdb-4005-a2ea-0fea210c858a", // 密钥
"Issuer": "jwtIssuertest", // 颁发者
"Audience": "jwtAudiencetest", // 接收者
"ExpireSeconds": 20000 // 过期时间
}
随后我们需要DI两个接口以及初始化设置相关字段。
public void ConfigureServices(IServiceCollection services)
{
services.Configure<JwtSetting>(Configuration.GetSection("JwtSetting"));
services.AddScoped<IUserService, UserService>();
services.AddScoped<ITokenService, TokenService>();
services.AddControllers();
}
在Client中，我一般会创建一个中间件用于接受认证结果，AspNetCore Jwt 源码中给我们提供了中间件，我们在进一步扩展，其源码定义如下：
/// <summary>
/// Extension methods to expose Authentication on HttpContext.
/// </summary>
public static class AuthenticationHttpContextExtensions
{/// <summary>
/// Extension method for authenticate.
/// </summary>
/// <param name="context">The <see cref="HttpContext"/> context.</param>
/// <param name="scheme">The name of the authentication scheme.</param>
/// <returns>The <see cref="AuthenticateResult"/>.</returns>
public static Task<AuthenticateResult> AuthenticateAsync(this HttpContext context, string scheme) =>
context.RequestServices.GetRequiredService<IAuthenticationService>().AuthenticateAsync(context, scheme);
}
其该扩展会返回一个 AuthenticateResult 类型的结果，其定义部分是这样的，我们就可以将计就计，给他来个连环套。
连环套直接接受 httpContext.AuthenticateAsync(JwtBearerDefaults.AuthenticationScheme) 返回回来的值，随后进行判断返回相应的Http响应码。
public class AuthMiddleware
{
private readonly RequestDelegate _next;
public AuthMiddleware(RequestDelegate next)
{
_next = next;
}
public async Task Invoke(HttpContext httpContext)
{
var result = await httpContext.AuthenticateAsync(JwtBearerDefaults.AuthenticationScheme);
if (!result.Succeeded)
{
httpContext.Response.StatusCode = (int)HttpStatusCode.Unauthorized;
await httpContext.Response.WriteAsync("Authorize error");
}
else
{
httpContext.User = result.Principal;
await _next.Invoke(httpContext);
}
}
}
当然你也得在Client中添加认证的一些设置，它和Server端的 IssuerSigningKey 一定要对应，否则认证失败。
public void ConfigureServices(IServiceCollection services)
{
services.AddHttpContextAccessor();
services.AddScoped<IIdentityService, IdentityService>();
var jwtSetting = new JwtSetting();
Configuration.Bind("JwtSetting", jwtSetting);
services.AddCors(options =>
{
options.AddPolicy("any", builder =>
{
builder.AllowAnyOrigin() //允许任何来源的主机访问
.AllowAnyMethod()
.AllowAnyHeader();
});
});
services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
.AddJwtBearer(options =>
{
options.TokenValidationParameters = new TokenValidationParameters
{
ValidIssuer = jwtSetting.Issuer,
ValidAudience = jwtSetting.Audience,
IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwtSetting.SecurityKey)),
默认 300s
ClockSkew = TimeSpan.Zero
};
});
services.AddControllers();
}
随后，你就可以编写带需认证才可以访问的API了，如果认证失败则会返回401的错误响应。
[Route("api/[controller]")]
[ApiController]
public class ValuesController : ControllerBase
{
private readonly IIdentityService _identityService;
public ValuesController(IIdentityService identityService)
{
_identityService = identityService;
}
[HttpGet]
[Authorize]
public async Task<string> Get()
{
await Task.CompletedTask;
return $"{_identityService.GetUserId()}:{_identityService.GetUserName()}";
}
值得一提的是，我们可以根据 IHttpContextAccessor 以来注入到我们的Service或者Api中，它是一个当前请求的认证信息上下文，这将有利于你获取用户信息去做该做的事情。
public class IdentityService : IIdentityService
{
private readonly IHttpContextAccessor _context;
public IdentityService(IHttpContextAccessor context)
{
_context = context;
}
public int GetUserId()
{
var nameId = _context.HttpContext.User.FindFirst("id");
return nameId != null ? Convert.ToInt32(nameId.Value) : 0;
}
public string GetUserName()
{
return _context.HttpContext.User.FindFirst("name")?.Value;
}
}
在源码中该类的定义如下，实际上我们可以看到只不过是判断了当前的http上下文吧，所以我们得出，如果认证失败，上下本信息也是空的。
public class HttpContextAccessor : IHttpContextAccessor
{
private static AsyncLocal<HttpContextHolder> _httpContextCurrent = new AsyncLocal<HttpContextHolder>();
public HttpContext HttpContext
{
get
{
return _httpContextCurrent.Value?.Context;
}
set
{
var holder = _httpContextCurrent.Value;
if (holder != null)
{
// Clear current HttpContext trapped in the AsyncLocals, as its done.
holder.Context = null;
}
if (value != null)
{
// Use an object indirection to hold the HttpContext in the AsyncLocal,
// so it can be cleared in all ExecutionContexts when its cleared.
_httpContextCurrent.Value = new HttpContextHolder { Context = value };
}
}
}
private class HttpContextHolder
{
public HttpContext Context;
}
}
如果要通过js来测试代码，您可以添加请求头来进行认证，beforeSend是在请求之前的事件。
beforeSend : function(request) {
request.setRequestHeader("Authorization", sessionStorage.getItem("Authorization"));
}
Well, today this point, the code in the address https://github.com/zaranetCore/DotNetCore_Jwt in.