jwt - 授权属性为asp.net核心中的控制器授权任何JWT令牌？

Question

我正在尝试在我的 ASP.NET CORE 项目中使用JWT身份验证。

Step-1：我在Starup.cs文件的ConfigureServices方法中添加了 JWT 服务。

    services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.TokenValidationParameters = new TokenValidationParameters
        {
            IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration["Jwt:SecretKey"])),
            RequireExpirationTime = true,
            ValidateLifetime = true,
            ValidateAudience = false,
            ValidateActor = false,
            ValidateIssuer = false
        };
    });

并在Configure方法中添加以下代码：

app.UseAuthentication();

步骤 2：登录时发送 jwt 令牌。

public class LoginRepository
{
    public LoginRepository()
    {
        //TODO: Dependency to MongoDB will be initialized here
    }

    public LoginStatus Authenticate(string username, string password)
    {
        LoginStatus loginStatus = new LoginStatus();
        string secretKey = ConfigurationManager.AppSetting["Jwt:SecretKey"];
        int tokenExpirationHours = int.Parse(ConfigurationManager.AppSetting["Jwt:TokenExpirationHours"]);
        //TODO: Need to add the userID in the payload. UserID will come from Database
        Dictionary<string, string> payload = new Dictionary<string, string>() {
                { "UserName", username}
            };

        //TODO: Need to check the username and password in Database and then generate the token
        loginStatus.Token = JwtTokenHelper.GenerateJwtToken(secretKey, payload, tokenExpirationHours);

        return loginStatus;
    }
}

这是 JwtTokenHelper：

public class JwtTokenHelper
{
    public static string GenerateJwtToken(string secretKey, IReadOnlyDictionary<string, string> payloadContents, int tokenExpirationHours)
    {
        JwtSecurityTokenHandler jwtSecurityTokenHandler = new JwtSecurityTokenHandler();
        var securityKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(secretKey));
        var signingCredentials = new SigningCredentials(securityKey, SecurityAlgorithms.HmacSha256Signature);

        var payloadClaims = payloadContents.Select(c => new Claim(c.Key, c.Value));

        var payload = new JwtPayload("", "", payloadClaims, DateTime.Now, DateTime.Now.AddHours(tokenExpirationHours));

        var header = new JwtHeader(signingCredentials);
        var securityToken = new JwtSecurityToken(header, payload);

        return jwtSecurityTokenHandler.WriteToken(securityToken);
    }
  }

在这里，我成功获得了 JWT 令牌。

第 3 步：现在，我尝试授权控制器，当我在 Postman 的 Authorization 标头中提供令牌时，它运行良好。

namespace SampleAPI.Controllers
{
    [Authorize]
    [Produces("application/json")]
    [Route("api/Test")]
    public class TestController : Controller
    {
        [HttpGet]
        [Route("Testing")]
        public IActionResult Testing()
        {
            return Ok("Yes");
        }
    }
}

但是，如果我更改 JWT 令牌中的某些内容并再次点击此端点，它会返回“是”，表示 jwt 令牌是有效的。但是在发送授权标头之前，我已经更改了该令牌的某些部分。

我在这里想念什么？您能否指出我应该遵循的更多步骤？

标签： jwtasp.net-core-2.0