卷曲附加授权标头但控制器仍为 401

Question

我正在使用 swagger gen ui，我正在使用以下设置并关注此 GitHub 资源。

根据 GitHub，这似乎是 swagger 的一个已知问题，我使用的是基于 jwt barrer 的令牌。 https://github.com/domaindrivendev/Swashbuckle.AspNetCore/issues/1425

我已经按如下方式设置了我的 swagger gen

services.AddSwaggerGen(c =>
{

            c.SwaggerDoc("v1", new OpenApiInfo { Title = "App Manager - Running Buddies", Version = "v1" });

            c.AddSecurityDefinition("Bearer", new OpenApiSecurityScheme {
                Description = "JWT Authorization header using the Bearer scheme.",
                Name = "Authorization",
                In = ParameterLocation.Header,
                Type = SecuritySchemeType.ApiKey,
                Scheme = "bearer"
            });

            c.AddSecurityRequirement(new OpenApiSecurityRequirement
            {
            {
                new OpenApiSecurityScheme
                {
                    Reference = new OpenApiReference
                    {
                        Type = ReferenceType.SecurityScheme,
                        Id = "Bearer"
                    }
                }, new List<string>()
            }
        });
   });

curl -X GET "https://localhost:44396/api/BmiInformations" -H "接受： text/plain" -H "授权： eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE1OTAxOTMyNzQsImlzcyI6Imh0dHBzOi8vbG9jYWxob3N0OjQ0Mzk2LyIsImF1ZCI6Imh0dHBzOi8vbG9jYWxob3N0OjQ0Mzk2LyJ9.cbePeT9RJprvTWyQECiUCaoqjc25eFKtf7jh5DwOnU0" P>

但我仍然得到 401 未授权，我使用的是有效的基于 JWT 的令牌。

private string BuildToken(LoginModel login) {
    var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_config["JwtToken:SecretKey"]));
    var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
    JwtSecurityToken token;

    token = new JwtSecurityToken(_config["JwtToken:Issuer"],
    _config["JwtToken:Issuer"], expires: DateTime.Now.AddMinutes(30),
    signingCredentials: creds); 
    return new JwtSecurityTokenHandler().WriteToken(token);
    }

private UserModel Authenticate(LoginModel login) {
    UserModel user = null;
    //var result = await _signInManager.PasswordSignInAsync(, lockoutOnFailure: false);
    if (login.Username == "mario" && login.Password == "secret") {
        user = new UserModel { UserName = "Mario Rossi", Email = "mario.rossi@domain.com" };
    }
     return user;
}

这就是我构建过滤器的方式。

 public class AddAuthHeaderOperationFilter : IOperationFilter {

    public void Apply(OpenApiOperation operation, OperationFilterContext context) {
        if (operation.Security == null)
            operation.Security = new List<OpenApiSecurityRequirement>();


        var scheme = new OpenApiSecurityScheme { Reference = new OpenApiReference { Type = ReferenceType.SecurityScheme, Id = "bearer" } };
        operation.Security.Add(new OpenApiSecurityRequirement {
            [scheme] = new List<string>()
        });
    }

我已经在我的 barrer bit 之后添加了。但它仍然没有显示barrer这个词

 services.AddDbContext<AppManagerDL.AppManagerDBContext>
 (options => options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection")));
 services.AddSwaggerGen(c =>
    {              
            c.SwaggerDoc("v1", new OpenApiInfo { Title = "App Manager - Running Buddies", Version = "v1" });
            c.AddSecurityDefinition("Bearer", new OpenApiSecurityScheme
        {
            Description = "JWT Authorization header using the Bearer scheme.",
            Name = "Authorization",
            In = ParameterLocation.Header,
            Type = SecuritySchemeType.ApiKey,
            Scheme = "bearer"
        });

       c.OperationFilter<AddAuthHeaderOperationFilter>();

编辑 4 好的，现在我让它在 curl 中正确显示 Barrer，但它现在说签名无效，即使它从我的 appsettings 中获得了正确的签名。

curl -X GET "https://localhost:44396/api/BmiInformations" -H "接受： text/plain" -H "授权：承载 eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE1OTAxOTc0MTcsImlzcyI6Imh0dHBzOi8vbG9jYWxob3N0OjQ0Mzk2LyIsImF1ZCI6Imh0dHBzOi8vbG9jYWxob3N0OjQ0Mzk2LyJ9.fLWxG1bRX6yCTqFe8XZbgL6Lh1RNcmVFX-636ZvqhNg“ P>

我在启动时的设置如下。

 public void ConfigureServices(IServiceCollection services) {

        services.AddDbContext<AppManagerDL.AppManagerDBContext>
          (options => options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection")));

        services.AddSwaggerGen(c => {

            c.SwaggerDoc("v1", new OpenApiInfo { Title = "App Manager - Running Buddies", Version = "v1" });

            c.AddSecurityDefinition("Bearer", new OpenApiSecurityScheme {
                Description = "JWT Authorization header using the Bearer scheme.",
                Name = "Authorization",
                In = ParameterLocation.Header,
                Type = SecuritySchemeType.Http,
                Scheme = "bearer",
                BearerFormat = "JWT"

            });

            c.AddSecurityRequirement(new OpenApiSecurityRequirement{
{
    new OpenApiSecurityScheme{
        Reference = new OpenApiReference{
            Id = "Bearer", //The name of the previously defined security scheme.
            Type = ReferenceType.SecurityScheme
        }
    },new List<string>()
  }
});

我现在得到的确切错误是。

日期：2020 年 5 月 23 日星期六 01:04:11 GMT 服务器：Microsoft-IIS/10.0
状态：401 www-authenticate: Bearer error="invalid_token", error_description="签名无效" x-powered-by: ASP.NET

Answer 1

尝试将您当前的安全定义替换为：

c.AddSecurityDefinition("Bearer", new OpenApiSecurityScheme
{
    Description = "JWT Authorization header using the Bearer scheme.",
    Name = "Authorization",
    In = ParameterLocation.Header,
    Scheme = "bearer",
    Type = SecuritySchemeType.Http,
    BearerFormat = "JWT"
});