令牌无法存储在 .NET Core 中

Question

我有一个使用 .NET 核心 3.1 版的项目，我正在使用令牌进行登录。使用 Postman 进行测试时一切正常，它创建了令牌，我可以使用它来访问主页。

问题是，当我开始在客户端进行测试时，它不起作用。我登录后调试看到，生成了token，但是因为[Authorize]属性，我无法访问HomeController。

这是我生成令牌的代码：

public async Task<HttpResponse<LoginResult>> GetTokenAsync(LoginRequest loginInfo)
{
    var audience = await _audiences.FindAsync(a => a.Id == loginInfo.ClientId);
    string message = string.Empty;

    if (audience != null)
    {
        bool audienceIsValid = _jwtProvider.ValidateAudience(audience.Issuer
                    , audience.SecretKey
                    , ref message);

        if (audienceIsValid)
            return await GenerateToken(loginInfo);
        else
            message = ErrorMessages.Login_AudienceInvalid;
    }
    else
        message = string.Format(ErrorMessages.Login_Not_Permitted, "Your client Id");
    return HttpResponse<LoginResult>.Error(message, HttpStatusCode.BadRequest);
}

我猜该令牌无法正确存储。

我错过了什么？

更新 这是我的登录代码

[HttpPost]
[Route("login")]
[AllowAnonymous]
public async Task<ActionResult> Login([FromForm]LoginRequest model)
{
      model.ClientId = 1;
      var response = await _services.GetTokenAsync(model);
      if (response.StatusCode == 200)
      {
           return RedirectToAction("Index", "Home");
      }
      return RedirectToAction("Login");
}

这就是我要访问的内容

[HttpGet]
[Route("index")]
[Authorize]
public IActionResult Index()
{
     return View();
}

Answer 1

您需要创建自定义策略以在配置为使用自定义需求处理程序的 Authorize 属性中指定

首先，您通过继承IAuthorizationRequirement 的类列出自定义策略的要求

public class TokenRequirement : IAuthorizationRequirement
{
}

如果需要，您可以在此处选择接受参数。但通常您在请求的标头中传递一个令牌，您的自定义策略的需求处理程序无需显式参数即可访问该令牌。

您的自定义策略要使用的需求处理程序看起来像这样

public class TokenHandler : AuthorizationHandler<TokenRequirement>
{
    //Some kind of token validator logic injected into your handler via DI
    private readonly TokenValidator _tokenValidator;

    //The http context of this request session also injected via DI
    private readonly IHttpContextAccessor _httpCtx;

    //The name of the header your token can be found under on a Http Request
    private const string tokenHeaderKey = "authToken";

    //Constructor using DI to get a instance of a TokenValidator class you would
    //have written yourself, and the httpContext
    public TokenHandler(TokenValidator tokenValidator, IHttpContextAccessor httpCtx)
    {
        _tokenValidator = tokenValidator;
        _httpCtx = httpCtx;
    }

    //Overriden implementation of base class AuthorizationHandler's HandleRequirementAsync method 
    //This is where you check your token.
    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context
        ,TokenRequirement requirement)
    {
        if (context.Resource is Endpoint endpoint)
        {
            HttpRequest httpReqCtx = _httpCtx.HttpContext.Request;
            string token =
                httpReqCtx.Headers.TryGetValue(tokenHeaderKey, out StringValues tokenVal)
                    ? tokenVal.FirstOrDefault()
                    : null;

            if (string.IsNullOrWhitespace(token))
            {
                context.Fail();
            }
            else
            {
                bool tokenIsValid = await _tokenValidator.ValidToken(token);
                if(tokenIsValid)
                    context.Succeed(requirement);
                else
                    context.Fail();
            }
        }
        return Task.CompletedTask;
    }
}

您可以像这样在 Startup.cs 中的自定义策略名称上注册自定义需求处理程序

//This is a framework extension method under Microsoft.Extensions.DependencyInjection
services.AddHttpContextAccessor();

//Your custom handler
services.AddSingleton<IAuthorizationHandler, TokenHandler>();

//Your custom policy
services.AddAuthorization(options =>
{
    options.AddPolicy(
        //Your custom policy's name, can be whatever you want
        "myCustomTokenCheckerPolicy",
        //The requirement your policy is going to check
        //Which will be handled by the req handler added above
        policy => policy.Requirements.Add(new TokenRequirement())
    );
});

属性上的 impl 看起来像这样

[HttpGet]
[Route("index")]
[Authorize(Policy = "myCustomTokenCheckerPolicy")]
public IActionResult Index()
{
    return View();
}