JWT令牌验证

Question

我正在尝试为除LogIn和Register操作之外的每个操作执行JWT验证，但我无法在操作过滤器中找到这样做的方法，因为我需要令牌，而它在this.Request.Headers上。以下是有效的验证方法：

try
{
    JwtSecurityTokenHandler tokenHandler = new JwtSecurityTokenHandler();
    string sToken = token.Substring(7, token.Length - 7);

    if (!tokenHandler.CanReadToken(sToken))
    {
        return false;
    }

    JwtSecurityToken jwtToken = tokenHandler.ReadToken(sToken) as JwtSecurityToken;

    if (jwtToken == null)
    {
        return false;
    }

    TokenValidationParameters parameters = new TokenValidationParameters()
    {
        ValidateIssuer = true,
        ValidateAudience = true,
        ValidateLifetime = true,
        RequireExpirationTime = true,
        ValidAudience = "http://localhost",
        ValidIssuer = "http://localhost",
        IssuerSigningKey = new SymmetricSecurityKey(Encoding.Default.GetBytes(StandardValues.SecretKey))
    };

    SecurityToken securityToken;
    ClaimsPrincipal principal = tokenHandler.ValidateToken(sToken, parameters, out securityToken);

    if (principal == null)
    {
        return false;
    }
}
catch (Exception ex)
{
    return false;
}

return true;

并且我有多个要在其上执行验证的控制器。在将令牌作为验证方法的参数发送时，请让我知道如何在操作之外和操作之前执行此验证(进入操作筛选器或其他方式)。

Answer 1

在我们的ASP.Net WebApi中，我们使用以下内容来验证令牌：

 services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidateAudience = true,
            ValidateLifetime = true,
            ValidateIssuerSigningKey = true,
            ValidIssuer = $"https://{Configuration.GetValue<string>("AppServiceNameOutput")}",
            ValidAudience = $"https://{Configuration.GetValue<string>("AppServiceNameOutput")}",
            IssuerSigningKey = new SymmetricSecurityKey(
                Encoding.UTF8.GetBytes(Configuration.GetValue<string>("SigningKey"))),
        };
        options.Events = new JwtBearerEvents
        {
            OnTokenValidated = context =>
            {
                var tokenBlackList = context.HttpContext.RequestServices.GetRequiredService<ITokenBlackList>();
                var tokenParser = context.HttpContext.RequestServices.GetRequiredService<ITokenParser>();
                var bearer = context.HttpContext.Request.Headers["Authorization"];

                if (String.IsNullOrEmpty(bearer))
                {
                    bearer = context.Request.Query["access_token"];
                }

                var token = tokenParser.GetBearerTokenFromAuthHeaderString(bearer);
                if (tokenBlackList.TokenIsBlackListed(token).Result)
                {
                    context.Fail("Token has expired");
                }
                return Task.CompletedTask;
            }
        };
    });

然后，在每个控制器操作上，我们指定是否应该授权端点，以及允许访问哪些策略。

[Authorize(Policy = "ManagerOnly")]
[HttpPost]
public IActionResult Update([FromBody] UpdateAppRequest request)