webapi授权认证
webapi授权认证
一、需要类包
- Microsoft.AspNetCore.Authentication.JwtBearer
二、相关名词
Authentication（认证）：标识用户的身份，一般发生在登录的时候。
Authorization（授权）：授予用户权限，指定用户能访问哪些资源；授权的前提是知道这个用户是谁，所以授权必须在认证之后。
三、认证
3.1 基本步骤
1.安装相关 Nuget 包：Microsoft.AspNetCore.Authentication.JwtBearer
2.准备配置信息（密钥等）
3.注册服务
4.调用中间件
5.实现一个 JwtHelper，用于生成 Token
6.控制器限制访问（添加 Authorize 标签）
3.2 appsetting.json配置信息
// token配置
"JwtConfig": {
"SecretKey": "zhouxxxxxx@qq.email", // 密钥
//"Issuer": "zhouBing", // 颁发单位
"Issuer": "https://www.baidu.com/", // 颁发单位
//"Audience": "http://localhost:8080", // 接收单位
"Audience": "https://www.baidu.com/", // 接收单位
"Expired": 30, // 过期时间（单位min）30min
"RefreshTokenExpired": 60, // 刷新Token 60min
"NotBefore": "", // 有效期自
"Expiration": "", // 到期时间
"SigningKey": "", // 签名密钥
"SigningCredentials": "" // 签名凭证
},
3.3 注册服务和调用中间件
//引入所需的命名空间
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.IdentityModel.Tokens;
using System.Text;
// 将 JwtHelper 的创建交由 DI 容器
builder.Services.AddSingleton(new GenerateJwt(_configuration, _dbContext));
JwtInfo jwtInfo = new JwtInfo();
builder.Configuration.Bind("JwtConfig", jwtInfo);
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme) // 默认 Bearer JwtBearerDefaults.AuthenticationScheme
.AddJwtBearer(options =>
{
options.TokenValidationParameters = new TokenValidationParameters()
{
ValidateIssuer = true,//是否验证 Issuer（发行商）
ValidateAudience = true,//是否验证 Audience（受众者）
ValidateLifetime = true,//是否验证失效时间
ValidateIssuerSigningKey = true,//是否验证 Issuer 的签名键
ValidAudience = jwtInfo.Audience, //此处应该是IdentityServer的地址
ValidIssuer = jwtInfo.Issuer,// ValidAudience,ValidIssuer这两项的值要和验证中心的只保持一致。
ClockSkew = TimeSpan.FromSeconds(30), //过期时间容错值，解决服务器端时间不同步问题（秒）
IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwtInfo.SecretKey!))
};
});
//调用中间件：UseAuthentication（认证），必须在所有需要身份认证的中间件前调用，比如 UseAuthorization（授权）。
app.UseAuthentication();
app.UseAuthorization();
JwtInfo类型
public class JwtInfo:BaseEntitys
{
public Guid Id { get; set; }
public string TokenId { get; set; } = null!;
//public JwtInfo Value => this;
[DisplayName("密钥")]
public string? SecretKey { get; set; } = null!;// 密钥
[DisplayName("颁发者")]
public string? Issuer { get; set; } // 颁发者
[DisplayName("接收者")]
public string? Audience { get; set; } // 接收者
[DisplayName("过期时间")]
public int Expired { get; set; }// 过期时间
[DisplayName("上次颁发时间")]
public DateTime NotBefore { get; set; } // 上次颁发时间
[DisplayName("发布时间")]
public DateTime IssuedAt { get; set; } // 发布时间
[DisplayName("到期时间")]
public DateTime Expiration { get; set; } // = IssuedAt.AddMinutes(Expired);// 到期时间
[DisplayName("签名密钥")]
public string? SigningKey { get; set; } = null!;// 签名密钥
//public static SecurityKey? SigningKey { get; set; } = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(SecretKey));// 签名密钥
[DisplayName("签名凭证")]
public string? SigningCredentials { get; set; } // 签名凭证
//public SigningCredentials? SigningCredentials { get; set; } = new SigningCredentials(SigningKey, SecurityAlgorithms.HmacSha256);// 签名凭证
}
3.4 JwtHelper 类实现
public class GenerateJwt
{
public JwtInfoDto _jwtConfig;
public readonly IConfiguration _configuration;
// public readonly MysqlDbContext _dbContext;
public GenerateJwt(IConfiguration configuration)z
// public GenerateJwt(IConfiguration configuration, MysqlDbContext dbContext)
{
_configuration = configuration;
_jwtConfig = _configuration.GetSection("JwtConfig").Get<JwtInfoDto>();
// _dbContext = dbContext;
}
/// <summary>
/// 生成token
/// </summary>
/// <param name="sub"></param>
/// <param name="customClaims">携带的用户信息</param>
/// <returns></returns>
public JwtTokenResult GenerateEncodedTokenAsync(string sub, LoginUserModel customClaims)
{
//创建用户身份标识，可按需要添加更多信息
var claims = new List<Claim>
{
//new Claim("Userid", customClaims.Userid),
new Claim("Username", customClaims.Username),
new Claim("Realname",customClaims.Realname),
new Claim("Roles", customClaims.Roles),
new Claim("Permissions", customClaims.Permissions),
new Claim("NormalPermissions", customClaims.NormalPermissions),
new Claim(JwtRegisteredClaimNames.Sub, sub),
};
DateTime dateNow = DateTime.Now;
var authSecurityKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_configuration["JwtConfig:SecretKey"]));
//创建令牌
var jwt = new JwtSecurityToken(
issuer: _jwtConfig.Issuer,
audience: _jwtConfig.Audience,
claims: claims,
//notBefore: _jwtConfig.NotBefore,
notBefore: dateNow,
//expires: _jwtConfig.Expiration,
expires: dateNow.AddMinutes(_jwtConfig.Expired),
//signingCredentials: null, // 签名凭证
signingCredentials: new SigningCredentials(authSecurityKey, SecurityAlgorithms.HmacSha256) // 签名凭证
);
string access_token = new JwtSecurityTokenHandler().WriteToken(jwt);
string refresh_Token = CreateRefreshTokenBase64();
return new JwtTokenResult()
{
Access_token = access_token,
Expires_in = dateNow.AddMinutes(_jwtConfig.Expired), // 过期时间
//Expires_in = _jwtConfig.Expired * 60, // 过期时间(秒)
Token_type = JwtBearerDefaults.AuthenticationScheme,
Refresh_token = refresh_Token,
User = customClaims,
SigningCredentials = jwt.SigningCredentials
};
}
/// <summary>
/// 简单的生成RefreshToken
/// </summary>
/// <param name="access_token"></param>
/// <param name="refresh_Token"></param>
/// <returns></returns>
public string CreateRefreshTokenBase64()
{
// 创建一个随机的Token用做Refresh Token
var randomNumber = new byte[32];
using var rng = RandomNumberGenerator.Create();
rng.GetBytes(randomNumber);
return Convert.ToBase64String(randomNumber);
}
/// <summary>
/// 生成RefreshToken
/// </summary>
/// <param name="token"></param>
/// <returns></returns>
/// <exception cref="SecurityTokenException"></exception>
public string CreateRefreshToken(string UserId)
{
GetDbContext dbContext = new GetDbContext(_configuration);
var _dbContext = dbContext.GetContext();
var context = new MysqlDbContext(_dbContext);
if (!context.UserToken.Where(x => x.UserId.Equals(UserId) && x.Refresh_token == null).Any())
{
return CreateRefreshTokenBase64();
}
return "";
}
/// <summary>
/// 根据过期Token生成新的Token
/// </summary>
/// <param name="token"></param>
/// <returns></returns>
/// <exception cref="SecurityTokenException"></exception>
public bool GetPrincipalFromExpiredToken(string token)
{
// 根据已过期的Token获取用户相关的Principal数据，用来生成新的Token
var jwtSettings = _configuration.GetSection("JwtConfig");
var authSecurityKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_configuration["JwtConfig:SecretKey"]));
try
{
var tokenValidationParameters = new TokenValidationParameters
{
ValidateAudience = true,
ValidateIssuer = true,
ValidateIssuerSigningKey = true,
IssuerSigningKey = authSecurityKey,
ValidateLifetime = true,
ValidIssuer = jwtSettings["Issuer"],
ValidAudience = jwtSettings["Audience"],
};
var tokenHandler = new JwtSecurityTokenHandler();
var principal = tokenHandler.ValidateToken(token, tokenValidationParameters, out var securityToken);
if (securityToken is not JwtSecurityToken jwtSecurityToken ||
!jwtSecurityToken.Header.Alg.Equals(SecurityAlgorithms.HmacSha256, StringComparison.InvariantCultureIgnoreCase))
{
return false;
}
}
catch(Exception ex)
{
return false;
}
return true;
}
}
四、测试
4.1 操作步骤
1. 生成Token
2. 携带Token访问接口
控制器
[ApiController]
[Route("[controller]/[action]")]
public class UserController : ControllerBase
{
private string connectionString;
private IConfiguration _configuration;
private readonly JwtInfo _config;
private IServiceProvider _serviceProvider;
private readonly MysqlDbContext _dbContext;
//private IdentifityApp _IdentifityApp;
//private IConnectionFactory _IConnectionFactory;
public UserController(IConfiguration configuration, IOptions<JwtInfo> config, IServiceProvider serviceProvider, MysqlDbContext dbContext)
{
_configuration = configuration;
_config = config.Value;
//_IConnectionFactory = iConnectionFactory;
_serviceProvider = serviceProvider;
//_IdentifityApp=identifityApp;
connectionString = _configuration.GetConnectionString("MySQLConnection");
_dbContext = dbContext;
}
// 生成Token
//[Authorize(Roles = "Administrators")]
[Authorize(Roles= "admin")]
[HttpPost]
public JsonResult GetAuthority()
{
//using (var cnn = _IConnectionFactory.Connection())
//{
string result = "";
List<Authority> list = new List<Authority>();
using (MySqlConnection connection = new MySqlConnection(_configuration.GetConnectionString("MySQLConnection"))) {
string sql = "select * from Authority";
MySqlCommand command = new MySqlCommand(sql, connection);
connection.Open();
using (MySqlDataReader reader = command.ExecuteReader())
{
while (reader.Read())
{
list.Add(new Authority
{
Id = reader.GetInt16("Id"),
AuthorityName = reader.GetString("AuthorityName"),
});
}
}
}
JsonResult json = new JsonResult(new
{
code = 200,
msg = "成功",
resule = list
});
return json;
//}
}
[HttpPost]
public JsonResult GenerateToken()
{
LoginUserModel loginUserModel = new LoginUserModel();
//loginUserModel.Userid = "08db7530-382f-42bf-828c-32dd169ac2d9";
loginUserModel.Username = "admin";
loginUserModel.Realname = "zxx";
loginUserModel.Roles = "admin";
loginUserModel.Permissions = "1";
loginUserModel.NormalPermissions = "2";
GenerateJwt generateJwt = new GenerateJwt(_configuration, _dbContext);
JwtTokenResult JwtInfo = generateJwt.GenerateEncodedTokenAsync("Sub", loginUserModel);
JsonResult json = new JsonResult(new
{
code = "200",
msg = "成功",
result = JwtInfo
});
return json;
}
[HttpGet]
//[Authorize(AuthenticationSchemes = JwtBearerDefaults.AuthenticationScheme)]
[Authorize]
public object GetData()
{
return new
{
Id = 1,
Name = "Tom"
};
}
}
4.2 Postman测试
4.2.1 获取token
4.2.2 调用权限接口
