ASP.NET Core Authorization: 跳过JWT校验

本文记录了如何在asp.net core 9.0上为WebApi配置跳过JWT校验的方法。

项目准备

执行以下命令

dotnet new webapi --use-minimal-apis --name MockJwtTestApi --output MockJwtTestApi --auth None
dotnet add package Swashbuckle.AspNetCore --project MockJwtTestApi
dotnet add package Microsoft.AspNetCore.Authentication.JwtBearer --project MockJwtTestApiy以

以创建名为MockJwtTestApi的WebApi项目。

核心实现

编辑MockJwtTestApi\Program.cs，使之内容为

using Microsoft.OpenApi.Models;


(OpenApiSecurityScheme Scheme, OpenApiSecurityRequirement Requirement) jwtSchemeA =
(
    Scheme: new OpenApiSecurityScheme 
    { 
        In = ParameterLocation.Header, 
        Type = SecuritySchemeType.Http, 
        Scheme = Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerDefaults.AuthenticationScheme 
    },

    Requirement: new OpenApiSecurityRequirement
    {
        [new OpenApiSecurityScheme { Reference = new OpenApiReference { Type = ReferenceType.SecurityScheme, Id = nameof(jwtSchemeA) } }] = Array.Empty<string>()
    }
);

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddSwaggerGen((option) =>
{
    option.AddSecurityDefinition(nameof(jwtSchemeA), jwtSchemeA.Scheme);
});

builder.Services.AddOpenApi();

builder.Services.AddAuthorization();
builder.Services.AddAuthentication()
    .AddJwtBearer(nameof(jwtSchemeA), options =>
    {
        options.TokenValidationParameters = new()
        {
            ValidateAudience = false,
            ValidateIssuer = false,
            ValidateIssuerSigningKey = false,
            ValidateLifetime = false,
            SignatureValidator = (token, p) => new Microsoft.IdentityModel.JsonWebTokens.JsonWebToken(token)
        };

        // Do not map "sub", "scp" to the according Microsoft's qualified name specified in System.Security.Claims.ClaimTypes.
        options.MapInboundClaims = false;
    });

var app = builder.Build();

// Configure the HTTP request pipeline.
if (app.Environment.IsDevelopment())
{
    app.MapOpenApi();

    app.UseSwagger();
    app.UseSwaggerUI();
}

app.UseHttpsRedirection();

app.UseAuthentication();
app.UseAuthorization();

app.MapGet("/AuthorizedUser", (HttpContext httpContext) =>
{
    return new
    {
        IsAuthenticated = httpContext.User.Identity.IsAuthenticated,
        Claims = httpContext.User.Claims?.Select(c => new { c.Type, c.Value }).ToArray()
    };
})
.WithOpenApi((operation) =>
{
    operation.Security = [jwtSchemeA.Requirement];

    return operation;
});

app.MapGet("/PublicAccess", (HttpContext httpContext) =>
{
    return new
    {
        IsAuthenticated = httpContext.User.Identity.IsAuthenticated,
        Claims = httpContext.User.Claims?.Select(c => new { c.Type, c.Value }).ToArray()
    };
});

await app.RunAsync();

 

实现跳过JWT签名校验的关键是第37行。注意这里不能用new System.IdentityModel.Tokens.Jwt.JwtSecurityToken(token)为返回值，否则会失败——在AddJwtBearer扩展方法里，为JwtBearerOptions对象的Events属性配上OnAuthenticationFailed事件

options.Events = new()
{
   OnAuthenticationFailed = context => Console.WriteLine(context.Exception.Message); 
};

将可以看到如下异常信息：

IDX10506: Signature validation failed. The user defined 'Delegate' specified on TokenValidationParameters did not return a 'Microsoft.IdentityModel.JsonWebTokens.JsonWebToken', but returned a 'System.IdentityModel.Tokens.Jwt.JwtSecurityToken' when validating token: '[PII of type 'Microsoft.IdentityModel.JsonWebTokens.JsonWebToken' is hidden. For more details, see https://aka.ms/IdentityModel/PII.]'. If you are using ASP.NET Core 8 or later, see https://learn.microsoft.com/en-us/dotnet/core/compatibility/aspnet-core/8.0/securitytoken-events for more details.

 

参考资料：

[1] "Add an authorization header to your swagger-ui with Swashbuckle (revisited)", https://mattfrear.com/2018/07/21/add-an-authorization-header-to-your-swagger-ui-with-swashbuckle-revisited/
[2] "ASP.NET Core 同时支持多种认证方式 | Swagger 支持", https://blog.csdn.net/mzl87/article/details/126605540
[3] "ASP.NET Core 同时支持多种认证方式", https://blog.csdn.net/mzl87/article/details/126605384
[4] "ASP.NET Core 实现自定义认证", https://blog.csdn.net/mzl87/article/details/123823581
[5] ".Net 6 Minimal Api Authentication (JWT) with Swagger and Open API", https://dev.to/moe23/net-6-minimal-api-authentication-jwt-with-swagger-and-open-api-2chh
[6] ".NET 6 WebApi Swagger 配置 JWT token+Authorize认证", https://blog.csdn.net/qq_61596453/article/details/136416534