authentication - 身份验证和授权 - HTTP 请求正文中的令牌

问题描述

我正在尝试创建一个自定义身份验证处理程序，该处理程序需要Bearer JWT在 HTTP 请求的正文中，但我不希望创建一个全新的自定义授权。不幸的是，我唯一能做的就是读取 HTTP 请求正文，从那里获取令牌并将其放入请求的 Authorization 标头中。

有没有一种不同的、更有效的方法来做到这一点？我所做的只是在GitHub 上找到默认JwtBearerHandler实现，但是当我进行一些修改时，它无法正确读取主体。

启动.cs：

services.AddAuthentication(auth =>
{
    auth.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    auth.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddJwtBearer(options =>
{
    options.RequireHttpsMetadata = true;
    options.SaveToken = true;
    options.TokenValidationParameters = new TokenValidationParameters
    {
        ValidateIssuerSigningKey = true,
        ValidateIssuer = false,
        ValidateAudience = false,
        ValidateLifetime = true,
        IssuerSigningKey = new SymmetricSecurityKey(key),
        RequireExpirationTime = true,
        ClockSkew = TimeSpan.FromSeconds(30)
    };

    options.Events = new JwtBearerEvents
    {
        OnAuthenticationFailed = ctx =>
        {
            if (ctx.Exception.GetType() == typeof(SecurityTokenExpiredException))
            {
                ctx.Response.Headers.Add("Token-Expired", "true");
            }
            return Task.CompletedTask;
        }
    };
});

public class AuthHandler : JwtBearerHandler
{
    private readonly IRepositoryEvonaUser _repositoryUser;
    private OpenIdConnectConfiguration _configuration;

    public AuthHandler(IOptionsMonitor<JwtBearerOptions> options,
        ILoggerFactory logger,
        UrlEncoder encoder,
        IDataProtectionProvider dataProtection,
        ISystemClock clock,
        IRepositoryUser repositoryUser,
        OpenIdConnectConfiguration configuration
        )
        : base(options, logger, encoder, dataProtection, clock)
    {
        _repositoryUser = repositoryUser;
    }

    protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
    {
        string token = null;
        try
        {
            var messageReceivedContext = new MessageReceivedContext(Context, Scheme, Options);

            await Events.MessageReceived(messageReceivedContext);
            if (messageReceivedContext.Result != null)
            {
                return messageReceivedContext.Result;
            }
            token = messageReceivedContext.Token;

            if (string.IsNullOrEmpty(token))
            {
                Request.EnableBuffering();
                using (var reader = new StreamReader(Request.Body, Encoding.UTF8, true, 10, true))
                {
                    var jsonBody = reader.ReadToEnd();
                    var body = JsonConvert.DeserializeObject<BaseRequest>(jsonBody);
                    if (body != null)
                    {
                        token = body.Token;
                    }
                    Request.Body.Position = 0;
                }

                if (string.IsNullOrEmpty(token))
                {
                    return AuthenticateResult.NoResult();
                }
            }


            if (_configuration == null && Options.ConfigurationManager != null)
            {
                _configuration = await Options.ConfigurationManager.GetConfigurationAsync(Context.RequestAborted);
            }

            var validationParameters = Options.TokenValidationParameters.Clone();
            if (_configuration != null)
            {
                var issuers = new[] { _configuration.Issuer };
                validationParameters.ValidIssuers = validationParameters.ValidIssuers?.Concat(issuers) ?? issuers;
            }

            List<Exception> validationFailures = null;
            SecurityToken validatedToken;

            foreach (var validator in Options.SecurityTokenValidators)
            {
                if (validator.CanReadToken(token))
                {
                    ClaimsPrincipal principal; // it can't find this
                    try
                    {
                        principal = validator.ValidateToken(token, validationParameters, out validatedToken);
                    }
                    catch (Exception ex)
                    {

                        if (Options.RefreshOnIssuerKeyNotFound && Options.ConfigurationManager != null
                            && ex is SecurityTokenSignatureKeyNotFoundException)
                        {
                            Options.ConfigurationManager.RequestRefresh();
                        }

                        if (validationFailures == null)
                        {
                            validationFailures = new List<Exception>(1);
                        }
                        validationFailures.Add(ex);
                        continue;
                    }

                    var tokenValidatedContext = new TokenValidatedContext(Context, Scheme, Options)
                    {
                        Principal = principal,
                        SecurityToken = validatedToken
                    };

                    await Events.TokenValidated(tokenValidatedContext);
                    if (tokenValidatedContext.Result != null)
                    {
                        return tokenValidatedContext.Result;
                    }

                    if (Options.SaveToken)
                    {
                        tokenValidatedContext.Properties.StoreTokens(new[]
                        {
                            new AuthenticationToken { Name = "access_token", Value = token }
                        });
                    }

                    tokenValidatedContext.Success();
                    return tokenValidatedContext.Result;
                }
            }

            if (validationFailures != null)
            {
                var authenticationFailedContext = new AuthenticationFailedContext(Context, Scheme, Options)
                {
                    Exception = (validationFailures.Count == 1) ? validationFailures[0] : new AggregateException(validationFailures)
                };

                await Events.AuthenticationFailed(authenticationFailedContext);
                if (authenticationFailedContext.Result != null)
                {
                    return authenticationFailedContext.Result;
                }

                return AuthenticateResult.Fail(authenticationFailedContext.Exception);
            }

            return AuthenticateResult.Fail("No SecurityTokenValidator available for token: " + token ?? "[null]");
        }
        catch (Exception ex)
        {

            var authenticationFailedContext = new AuthenticationFailedContext(Context, Scheme, Options)
            {
                Exception = ex
            };

            await Events.AuthenticationFailed(authenticationFailedContext);
            if (authenticationFailedContext.Result != null)
            {
                return authenticationFailedContext.Result;
            }

            throw;
        }
    }
}

或者，有没有办法告诉应用程序在 HTTP 请求正文中期望 JWT？我很清楚令牌应该在请求标头而不是正文中发送，但我很想看看是否（如果是，如何）这可以实现。

我也试过这个：

OnMessageReceived = ctx =>
{
       ctx.Request.EnableBuffering();
       using (var reader = new StreamReader(ctx.Request.Body, Encoding.UTF8, true, 10, true))
       {
              var jsonBody = reader.ReadToEnd();
              var body = JsonConvert.DeserializeObject<BaseRequest>(jsonBody);
              if (body != null)
              {
                     ctx.Token = body.Token;
                     ctx.Request.Body.Position = 0;
              }
       }
       return Task.CompletedTask;
}

标签： authentication.net-corejwtasp.net-core-webapibearer-token

authentication - 身份验证和授权 - HTTP 请求正文中的令牌

问题描述

解决方案

推荐阅读