asp.net core webapi实现jwt授权认证

2019独角兽企业重金招聘Python工程师标准>>>

Asp.net core WebApi实现JWT授权。首先在Start. cs启动类中，配置服务，代码如下：

  //配置授权
            services.AddAuthentication(options =>
            {
                options.DefaultAuthenticateScheme = "JwtBearer";
                options.DefaultChallengeScheme = "JwtBearer";

            }).AddJwtBearer("JwtBearer",
            (jwtBearerOptions) =>
            {
                jwtBearerOptions.TokenValidationParameters = new TokenValidationParameters
                {
                    ValidateIssuerSigningKey = true,
                    IssuerSigningKey = new SymmetricSecurityKey(System.Text.Encoding.UTF8.GetBytes(Configuration["JwtSecurityKey"])),//秘钥
                    ValidateIssuer = true,
                    ValidIssuer = Configuration["issuer"],
                    ValidateAudience = true,
                    ValidAudience = Configuration["audience"],
                    ValidateLifetime = true,
                    ClockSkew = TimeSpan.FromMinutes(5)
                };
            });

在这里，我创建了一个OAuthController控制器，新建一个Token action,用来获取token,具体代码如下：

/// <summary>
        /// 
        /// </summary>
        /// <returns></returns>
        [HttpPost]
        public string Token(string user, string password)
        {

            //验证用户名和密码
            var claims = new Claim[] { new Claim(ClaimTypes.Name, "John"), new Claim(JwtRegisteredClaimNames.Email, "john.doe@blinkingcaret.com") };

            var key = new SymmetricSecurityKey(System.Text.Encoding.UTF8.GetBytes(Configuration["JwtSecurityKey"]));
            var token = new JwtSecurityToken(
                        issuer: Configuration["issuer"],
                        audience: Configuration["audience"],
                        claims: claims,
                        notBefore: DateTime.Now,
                        expires: DateTime.Now.AddDays(28),
                        signingCredentials: new SigningCredentials(key, SecurityAlgorithms.HmacSha256));

            string jwtToken = new JwtSecurityTokenHandler().WriteToken(token);//生成Token
            return jwtToken;
        }

然后，我们再ValuesController中，   添加 [Authorize]特性，要求授权终端才能访问。

接下来，我们通过JS实现领取的获取及数据的获取，具体代码如下：

<script type="text/javascript">
    //获取令牌
    $.post("/oauth/token", $.param({ user: "lichaoqiang", password: "fdsfds" })).done(function (token) {
        localStorage.setItem("token", token);
    });

    //设置HTTP头
    $.ajaxSetup({
        beforeSend: function (xhr) {
            if (localStorage.getItem("token") !== null) {
                xhr.setRequestHeader('Authorization', 'Bearer ' + localStorage.getItem("token"));
            }
        }
    });
    $.getJSON("/api/values", function (data) { console.log(data); });
</script>

当客户请求受保护的资源时，通过HTTP header携带上token。这里需要注意的是，请求头必须是Authorization，值是Bearer空格加上token。这样访问资源时，通过HTTP header携带令牌信息，服务端，通过认证中间件，完成授权认证过程。在上面的示例中，通过向全局Ajax注册事件，将token写入请求Header。、

转载于:https://my.oschina.net/lichaoqiang/blog/1829100