.net core webapi 使用Authorize身份认证

素颜马尾好姑娘i 2023-10-17 18:12 46阅读 0赞

1.使用JWT身份认证模式，引入库：IdentityServer4.AccessTokenValidation

2.在StartUp.cs中添加加密秘钥串：

public static readonly SymmetricSecurityKey symmetricKey = new SymmetricSecurityKey(Encoding.ASCII.GetBytes("need_to_get_this_from_enviroment"));

3.在ConfigureServices方法中在services.AddMvc();之前添加代码：

services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
            .AddJwtBearer(o =>
            {
                o.TokenValidationParameters = new TokenValidationParameters
                {
                    NameClaimType = JwtClaimTypes.Name,
                    RoleClaimType = JwtClaimTypes.Role,
    
                    ValidIssuer = "YFAPICommomCore",
                    ValidAudience = "api",
                    IssuerSigningKey = symmetricKey
    
    
                    /***********************************TokenValidationParameters的参数默认值***********************************/
                    // RequireSignedTokens = true,
                    // SaveSigninToken = false,
                    // ValidateActor = false,
                    // 将下面两个参数设置为false，可以不验证Issuer和Audience，但是不建议这样做。
                    // ValidateAudience = true,
                    // ValidateIssuer = true, 
                    // ValidateIssuerSigningKey = false,
                    // 是否要求Token的Claims中必须包含Expires
                    // RequireExpirationTime = true,
                    // 允许的服务器时间偏移量
                    // ClockSkew = TimeSpan.FromSeconds(300),
                    // 是否验证Token有效期，使用当前时间与Token的Claims中的NotBefore和Expires对比
                    // ValidateLifetime = true
                };
            });

在Configure方法中app.UseMvc();之前添加代码：

app.UseAuthentication();

4.在一个ApiController中增加生成access\_token的方法：

[HttpPost("authenticate")]
            public IActionResult Authenticate([FromBody]User userDto)
            {
                var tokenHandler = new JwtSecurityTokenHandler();
                var authTime = DateTime.UtcNow;
                var expiresAt = authTime.AddDays(7);
                var tokenDescriptor = new SecurityTokenDescriptor
                {
                    Subject = new ClaimsIdentity(new Claim[]
                    {
                new Claim(JwtClaimTypes.Audience,"api"),
                new Claim(JwtClaimTypes.Issuer,"YFAPICommomCore"),
                new Claim(JwtClaimTypes.Id, "1"),
                new Claim(JwtClaimTypes.Name, "xxx"),
                new Claim(JwtClaimTypes.Email, "xxx@qq.com"),
                new Claim(JwtClaimTypes.PhoneNumber, "13500000000")
                    }),
                    Expires = expiresAt,
                    SigningCredentials = new SigningCredentials(Startup.symmetricKey, SecurityAlgorithms.HmacSha256Signature)
                };
                var token = tokenHandler.CreateToken(tokenDescriptor);
                var tokenString = tokenHandler.WriteToken(token);
                return Ok(new
                {
                    access_token = tokenString,
                    token_type = "Bearer",
                    profile = new
                    {
                        sid = "1",
                        name = "xxxx",
                        auth_time = new DateTimeOffset(authTime).ToUnixTimeSeconds(),
                        expires_at = new DateTimeOffset(expiresAt).ToUnixTimeSeconds()
                    }
                });
            }

5.然后就可以在任意ApiController方法中添加 \[Authorize\] 使用了：

[Authorize]
            [HttpPost]
            [HttpGet]
            public string Test2()
            {
                var identity = (ClaimsIdentity)User.Identity;
                var id = identity.Claims.FirstOrDefault(u=>u.Type== JwtClaimTypes.Id).Value;
                return "test auth";
            }

注意：在ConfigureServices中初始化Swagger的时候，可以加上对auth的支持。

Init Swagger
                services.AddSwaggerGen(options =>
                {
                    options.SwaggerDoc("v1", new Info
                    {
                        Version = "v1",
                        Title = "WebAPI"
                    });
                    //启用auth支持
                    options.AddSecurityDefinition("Bearer", new ApiKeyScheme
                    {
                        Description = "JWT Authorization header using the Bearer scheme. Example: \"Authorization: Bearer {token}\"",
                        Name = "Authorization",
                        In = "header",
                        Type = "apiKey"
                    });
    
                    ///Determine base path for the application.  
                    var basePath = PlatformServices.Default.Application.ApplicationBasePath;
                    var xmlPath = Path.Combine(basePath, "TestCore.xml");
    
                    //var xmlPath = "/opt/zili/gongyeyun/TestCore.xml";
    
                    options.IncludeXmlComments(xmlPath);
                });

工程git地址：https://github.com/zzzili/YFAPICommonCore