jwt生成和url解析

1、公共方法

using System.Security.Claims;
using System.Security.Cryptography;
using System.Security.Principal;

namespace HRS.Web.Helper
{
    public class TokenHelper
    {
        private static string _Secret = ConfigurationManager.AppSettings["TokenSercert"];
        private static string _Issuer = ConfigurationManager.AppSettings["Issuer"];

        public static string GenerateToken(string username, int expireMinutes = 120)
        {
            var symmetricKey = Convert.FromBase64String(_Secret);  // 生成二进制字节数组
            var tokenHandler = new JwtSecurityTokenHandler(); // 创建一个JwtSecurityTokenHandler类用来生成Token
            var now = DateTime.UtcNow; // 获取当前时间
            var tokenDescriptor = new SecurityTokenDescriptor // 创建一个 Token 的原始对象
            {
                Subject = new ClaimsIdentity(new[] // Token的身份证，类似一个人可以有身份证，户口本
                        {
                            new Claim("username", username) // 可以创建多个
                        }),
                Expires = now.AddMinutes(Convert.ToInt32(expireMinutes)), // Token 有效期
                NotBefore = now,
                IssuedAt = now,
                Issuer = _Issuer,
                SigningCredentials = new SigningCredentials(new SymmetricSecurityKey(symmetricKey), SecurityAlgorithms.HmacSha256)
            };
            var stoken = tokenHandler.CreateToken(tokenDescriptor); // 生成一个编码后的token对象实例
            var token = tokenHandler.WriteToken(stoken); // 生成token字符串，给前端使用
            return token;
        }

        /// <summary>
        /// 验证token
        /// </summary>
        /// <param name="token"></param>
        /// <returns></returns>
        public static IPrincipal AuthenticateJwtToken(string token)
        {
            string userName;
            if (ValidateToken(token, out userName))
            {
                // 这里就是验证成功后要做的逻辑，也就是处理WWW-Authenticate验证
                var info = new List<Claim>()
                {
                    new Claim(ClaimTypes.Name, userName)
                };// 根据验证token后获取的用户名重新建一个声明，你可以在这里创建多个声明
                // Claims就像你身份证上面的信息，一个Claim就是一条信息，将这些信息放在ClaimsIdentity就构成身份证
                var infos = new ClaimsIdentity(info, "Jwt");
                // 将上面的身份证放在ClaimsPrincipal里面，相当于把身份证给持有人
                IPrincipal user = new ClaimsPrincipal(infos);
                return user;
            }
            return null;
        }

        private static bool ValidateToken(string token, out string userName)
        {
            userName = null;
            var simplePrincipal = GetPrincipal(token); // 调用自定义的GetPrincipal获取Token的信息对象
            var identity = simplePrincipal.Identity as ClaimsIdentity; // 获取主声明标识
            if (identity == null) return false;
            if (!identity.IsAuthenticated) return false;
            var userNameClaim = identity.FindFirst("username"); // 获取声明类型是ClaimTypes.Name的第一个声明
            userName = userNameClaim.Value; // 获取声明的名字，也就是用户名
            if (string.IsNullOrEmpty(userName)) return false;
            return true;
        }

        /// <summary>
        /// 此方法用解码字符串token，并返回秘钥的信息对象
        /// </summary>
        /// <param name="token"></param>
        /// <returns></returns>
        private static ClaimsPrincipal GetPrincipal(string token)
        {
            try
            {
                var tokenHandler = new JwtSecurityTokenHandler(); // 创建一个JwtSecurityTokenHandler类，用来后续操作
                var jwtToken = tokenHandler.ReadToken(token) as JwtSecurityToken; // 将字符串token解码成token对象
                if (jwtToken == null) throw new ShowInfoException("token错误");

                var symmetricKey = Convert.FromBase64String(_Secret); // 生成编码对应的字节数组
                var validationParameters = new TokenValidationParameters() // 生成验证token的参数
                {
                    RequireExpirationTime = true, // token是否包含有效期
                    ValidateIssuer = false, // 验证秘钥发行人，如果要验证在这里指定发行人字符串即可
                    ValidIssuer = _Issuer,
                    ValidateAudience = false, // 验证秘钥的接受人，如果要验证在这里提供接收人字符串即可
                    IssuerSigningKey = new SymmetricSecurityKey(symmetricKey), // 生成token时的安全秘钥
                    ValidateLifetime = false, //是否验证失效时间
                    LifetimeValidator = (DateTime? notBefore, DateTime? expires, SecurityToken scToken, TokenValidationParameters vParameters) => expires > DateTime.UtcNow,
                };
                SecurityToken securityToken; // 接受解码后的token对象
                var principal = tokenHandler.ValidateToken(token, validationParameters, out securityToken);
                return principal; // 返回秘钥的主体对象，包含秘钥的所有相关信息
            }
            catch (SecurityTokenInvalidLifetimeException ex)
            {
                throw new ShowInfoException("token超时，请重新获取token");
            }
            catch (SecurityTokenInvalidIssuerException ex)
            {
                throw new ShowInfoException("token发行人错误，应该是【{0}】", _Issuer);
            }
            catch (Exception ex)
            {
                throw new ShowInfoException("token错误");
            }
        }
    }
}

2、生成

respone.access_token = TokenHelper.GenerateToken(model.businesslicenseNo, 5);

3、解析和重定向

using HRS.Lib.Comm.Exceptions;
using HRS.Service.Contract.ContractParam.Base;
using HRS.Service.Contract.Security;
using HRS.Web.Helper;
using HRS.Web.JsonCommunication;
using HRS.Web.Rule;
using HRS.Web.WcfClient;
using System;
using System.Net;
using System.Text;
using System.Web.Mvc;

namespace HRS.Web.Controllers
{
    public class LoginController : BaseController
    {
        public const string USER_NAME_VERIFYCODE_KEY_NAME = "==VERIFYCODE==";
        //
        // GET: /Login/
        [AllowAnonymous]
        public ActionResult Index()
        {
            try
            {
                var authorization = Request.QueryString["jwt"]; // 获取请求的token对象
                if (authorization == null) throw new ShowInfoException("缺省jwt参数");

                var principal = TokenHelper.AuthenticateJwtToken(authorization); // 调用此方法，根据token生成对应的"身份证持有人"
                if (principal == null)
                {
                    throw new ShowInfoException("jwt参数格式不正确");
                }

                Login(principal.Identity.Name);
                return Redirect("~/dashboard.html");
            }
            catch(Exception e)
            {
                BusinessEngine.Logger.Error(e);
                return Content(e.Message);
            }
        }

        /// <summary>
        /// 登录
        /// </summary>
        private void Login(string username)
        {
            BaseRequstJson requestJson = new BaseRequstJson()
            {
                MethodFullName = "PotentialCustomer.Login",
                ParamTypeName = "LoginReqParam",
                ParamJsonData = "{\"Username\":\"" + username + "\",\"IsTempPwdLogin\":true,\"ExtraData\":{\"VerifyCode\":\"\"}}"
            };
            var param = GetParam(requestJson.ParamTypeName, requestJson.ParamJsonData);
            var paramUser = param as LoginReqParam;
            if (paramUser == null)
            {
                throw new ArgumentNullException("param type is not ParamUser");
            }
            // 登录信息
            ValidateIP(paramUser);

            //与wcf服务通讯
            var resp = ServiceCommunicator.Login<BaseResponse>(requestJson.MethodFullName, paramUser, paramUser.UserName);

            paramUser.UserID = resp.ExtraData.GetStr("UserID");

            SessionAdapter[BaseControllerEngine.CUR_USER_SESSION_NAME] = paramUser;
            SessionAdapter[BaseControllerEngine.CUR_USER_RES_NAME] = new UserRes();
            Session["UserID"] = paramUser.UserID;
            Session["UserType"] = paramUser.UserType;
            Session["LoginTime"] = DateTime.Now.ToString("yyyyMMddHHmmssffff");

            Session["UserCName"] = resp.ExtraData.GetStr("UserCName");
            Session["InstitutionName"] = resp.ExtraData.GetStr("InstitutionName");
        }

        /// <summary>
        /// 验证IP
        /// </summary>
        /// <param name="paramUser"></param>
        private void ValidateIP(LoginReqParam paramUser)
        {
            var sb = new StringBuilder();
            sb.Append("【UserAgent:】" + Request.UserAgent);
            sb.Append("【UserHostAddress:】" + Request.UserHostAddress);
            sb.Append("【UserHostName:】" + Request.UserHostName);

            string userHostAddress = string.Empty;
            if (null != Request.ServerVariables["HTTP_X_FORWARDED_FOR"])
            {
                userHostAddress = Request.ServerVariables["HTTP_X_FORWARDED_FOR"].ToString().Split(',')[0].Trim();
            }
            //否则直接读取REMOTE_ADDR获取客户端IP地址
            if (string.IsNullOrEmpty(userHostAddress))
            {
                userHostAddress = Request.ServerVariables["REMOTE_ADDR"];
            }
            //前两者均失败，则利用Request.UserHostAddress属性获取IP地址，但此时无法确定该IP是客户端IP还是代理IP
            if (string.IsNullOrEmpty(userHostAddress))
            {
                userHostAddress = Request.UserHostAddress;
            }
            //最后判断获取是否成功，并检查IP地址的格式（检查其格式非常重要）
            if (string.IsNullOrEmpty(userHostAddress) || !HRS.Lib.Comm.IO.WebUtil.IsIP(userHostAddress))
            {
                userHostAddress = "172.0.0.1";
            }
            sb.Append("【ClientIP:】" + userHostAddress);

            for (var i = 0; i < Request.ServerVariables.AllKeys.Length; i++)
            {
                var key = Request.ServerVariables.AllKeys[i];
                sb.Append(string.Format("【ServerVariables-{0}:】{1}", key, Request.ServerVariables[key]));
            }
            paramUser.ClientIP = userHostAddress;
            paramUser.LoginInfo = sb.ToString();
            #region 当前服务器信息
            var serverhost = Dns.GetHostEntry(Dns.GetHostName());
            var serverIP = string.Empty;
            foreach (IPAddress ip in serverhost.AddressList)
            {
                if (ip.AddressFamily.ToString() == "InterNetwork")
                {
                    serverIP = ip.ToString();
                    break;
                }
            }
            paramUser.ServerInfo = string.Format("{0}:{1}", serverhost.HostName, serverIP);
            #endregion
        }
    }
}

4、调用

http://localhost:8888/Login?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6Inh4eHh4LXh4eDEiLCJuYmYiOjE2NDc4MzE2NDksImV4cCI6MTY0NzgzMTk0OSwiaWF0IjoxNjQ3ODMxNjQ5LCJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjUwMDAifQ.8OnP1WF5EVI3O_TOnsVCkS_PC0tvtJQj268haOpuOY4