带jwt的core 2.0api auth返回未经授权的

我正在尝试将JWT的令牌身份验证添加到我的.NET Core 2.0应用程序中。我有一个简单的控制器,它返回要测试的用户列表。

[Authorize]
[Route("api/[controller]")]
public class UsersController : Controller
{
    ...

    [HttpGet]
    [Route("api/Users/GetUsers")]
    public IEnumerable<ApplicationUser> GetUsers()
    {
        return _userManager.Users;
    }


}

我有一个用于令牌安全的api控制器。它有一个返回令牌字符串结果的登录方法。

    [HttpPost(nameof(Login))]
    public async Task<IActionResult> Login([FromBody] LoginResource resource)
    {
        if (resource == null)
            return BadRequest("Login resource must be asssigned");

        var user = await _userManager.FindByEmailAsync(resource.Email);

        if (user == null || (!(await _signInManager.PasswordSignInAsync(user, resource.Password, false, false)).Succeeded))
            return BadRequest("Invalid credentials");

        string result = GenerateToken(user.UserName, resource.Email);

        // Token is created, we can sign out
        await _signInManager.SignOutAsync();

        return Ok(result);
    }

    private string GenerateToken(string username, string email)
    {
        var claims = new Claim[]
        {
            new Claim(ClaimTypes.Name, username),
            new Claim(ClaimTypes.Email, email),
            new Claim(JwtRegisteredClaimNames.Nbf, new DateTimeOffset(DateTime.Now).ToUnixTimeSeconds().ToString()),
            new Claim(JwtRegisteredClaimNames.Exp, new DateTimeOffset(DateTime.Now.AddDays(1)).ToUnixTimeSeconds().ToString()),
        };

        var token = new JwtSecurityToken(
            new JwtHeader(new SigningCredentials(
                new SymmetricSecurityKey(Encoding.UTF8.GetBytes("the secret that needs to be at least 16 characeters long for HmacSha256")),
                                         SecurityAlgorithms.HmacSha256)),
            new JwtPayload(claims));

        return new JwtSecurityTokenHandler().WriteToken(token);
    }

我有一个小的控制台应用程序只是用来测试API当我试图让用户使用jwt时。我马上收到一个“未经授权”的通知如果我从用户控制器中删除“[授权]”…成功似乎无法识别我的标题授权,但不确定原因。

    private static async Task<String> GetUsers(String jwt)
    {
        var url = "https://localhost:44300/";
        var apiUrl = $"/api/Users/";

        using (var client = new HttpClient() { BaseAddress = new Uri(url) })
        {
            client.BaseAddress = new Uri(url);
            client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
            client.DefaultRequestHeaders.Add("Authorization", $"Bearer {jwt}");

            using (var response = await client.GetAsync(apiUrl))
            {
                if (response.StatusCode == System.Net.HttpStatusCode.OK)
                    return await response.Content.ReadAsStringAsync();

                else return null;
            }
        }
    }

我的尝试是基于这篇文章 here ... 其中一些可能有点过时。

update-startup.cs的摘录

        services.AddAuthentication(options =>
        {
            options.DefaultAuthenticateScheme = "Jwt";
            options.DefaultChallengeScheme = "Jwt";
        }).AddJwtBearer("Jwt", options =>
        {
            options.TokenValidationParameters = new TokenValidationParameters
            {
                ValidateAudience = false,
                //ValidAudience = "the audience you want to validate",
                ValidateIssuer = false,
                //ValidIssuer = "the isser you want to validate",

                ValidateIssuerSigningKey = true,
                IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("the secret that needs to be at least 16 characeters long for HmacSha256")),

                ValidateLifetime = true, //validate the expiration and not before values in the token

                ClockSkew = TimeSpan.FromMinutes(5) //5 minute tolerance for the expiration date
            };
        });

配置。。。

    public void Configure(IApplicationBuilder app, IHostingEnvironment env)
    {
        if (env.IsDevelopment())
        {
            app.UseBrowserLink();
            app.UseDeveloperExceptionPage();
            app.UseDatabaseErrorPage();
        }
        else
        {
            app.UseExceptionHandler("/Home/Error");
        }

        app.UseStaticFiles();

        app.UseAuthentication();

        app.UseMvc(routes =>
        {
            routes.MapRoute(
                name: "default",
                template: "{controller=Home}/{action=Index}/{id?}");
        });

        //app.UseJwtBearerAuthentication(
        //    new Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerOptions
        //    );


    }

解决方案:

这一行正在转义令牌,因此在下一个请求中传递时使其无效:

var result = await response.Content.ReadAsStringAsync();

替换为:

var result = await response.Content.ReadAsAsync<string>();

注意:要使用这个ext方法,我必须“安装包Microsoft.AspNet.WebApi.Client”