在客户端 API 中使用 JWT 令牌

Question

我在 .NET5 中有一个 API，使用 JWTBearer 来保护 API。现在我想配置我的客户端应用程序以使用从 api/gettoken 生成的令牌。它在招摇中工作得很好，但我不知道如何配置我的 MVC 和 API（消费 API）来使用这个令牌。有人可以通过在启动时提供配置服务和配置方法来提供帮助吗

致格伦，

我有 3 个项目 JWT.IDP、JWT.API、JWT.MVC。 JWT.IDP 颁发令牌，我的意图是在 JWT.API 中使用该令牌并从 JWT.MVC 调用 JWT.API 函数。 IDP 运行良好，我可以生成令牌并且我的 JWT.MVC 登录控制器能够接收它。下面代码中的最后一个函数（GetWeatherData）是根据您给出的想法编码的。如果我不通过令牌，我以前会得到 401 错误，现在我得到 500 Internal Server Error

namespace JWT.MVC.Controllers
{
    public class LoginController : Controller
    {

        public IActionResult DoLogin()
        {

            return View();
        }


        [HttpPost]
        [ValidateAntiForgeryToken]
        public async Task<IActionResult> DoLogin([Bind("EmailOrName,Password")] LoginRequestModel loginRequestModel)
        {
            var apiName = $"https://localhost:44318/api/User/login";

            HttpClient httpClient = new HttpClient();
            HttpResponseMessage response = await httpClient.PostAsJsonAsync(apiName, loginRequestModel);
            var jasonString = await response.Content.ReadAsStreamAsync();

            var data = await JsonSerializer.DeserializeAsync<IEnumerable<AccessibleDb>>
                    (jasonString, new JsonSerializerOptions() { PropertyNameCaseInsensitive = true });

            foreach (var item in data)
            {
                item.UserName = loginRequestModel.EmailOrName;
            }

            return View("SelectDatabase" , data);
        }

      
        public async Task<IActionResult> PostLogin(string db, string user)
        {
            TokenRequestModel tokenRequestModel = new TokenRequestModel() { Database = db, UserName = user };

            var apiName = $"https://localhost:44318/api/User/tokenonly";

            HttpClient httpClient = new HttpClient();
            HttpResponseMessage response = await httpClient.PostAsJsonAsync(apiName, tokenRequestModel);
            var jasonString = await response.Content.ReadAsStreamAsync();

            var data = await JsonSerializer.DeserializeAsync<AuthenticationModel>
                    (jasonString, new JsonSerializerOptions() { PropertyNameCaseInsensitive = true });

            var stream = data.Token;
            var handler = new JwtSecurityTokenHandler();
            var jsonToken = handler.ReadToken(stream);
            var tokenS = jsonToken as JwtSecurityToken;
            var selectedDb = tokenS.Claims.First(claim => claim.Type == "Database").Value;

            ViewBag.SelectedDb = selectedDb;

            return View(data);
        }

        public async Task<IActionResult> GetWeatherData(string token)
        {

            var apiName = $"https://localhost:44338/weatherforecast";

            HttpClient httpClient = new HttpClient();
            httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token);
            HttpResponseMessage response = await httpClient.GetAsync(apiName);
            if (!response.IsSuccessStatusCode)
            {
                ViewBag.Error = response.StatusCode;
                return View("Weatherdata");
            }
            var jasonString = await response.Content.ReadAsStreamAsync();
            var data = await JsonSerializer.DeserializeAsync<WeatherForecast>
                    (jasonString, new JsonSerializerOptions() { PropertyNameCaseInsensitive = true });

        
            return View("Weatherdata" , data);
        }
    }
}

JWT.MVC 的启动类如下

 public void ConfigureServices(IServiceCollection services)
        {
            services.AddControllersWithViews();
            services.AddAuthentication("Bearer")
             .AddJwtBearer("Bearer", options =>
             {

                 options.Audience = "SecureApiUser";
                 options.Authority = "https://localhost:44318";
                 options.TokenValidationParameters = new TokenValidationParameters
                 {
                     ValidateAudience = false
                 };
             });

          
        }

JWT.API 的启动类如下

  public void ConfigureServices(IServiceCollection services)
        {

            services.AddControllers();
            //Copy from IS4
            services.AddAuthentication("Bearer")
              .AddJwtBearer("Bearer", options =>
              {
                  
                  options.Audience = "SecureApiUser";
                  options.Authority = "https://localhost:44318";
                  options.TokenValidationParameters = new TokenValidationParameters
                  {
                      ValidateAudience = false
                  };
              });

          
            //End
            services.AddSwaggerGen(c =>
            {
                c.SwaggerDoc("v1", new OpenApiInfo { Title = "JWT.API", Version = "v1" });
            });
        }

JWT.IDP 的启动类如下

  public void ConfigureServices(IServiceCollection services)
        {

            services.AddControllers();

            //Configuration from AppSettings
            services.Configure<JwtSettings>(Configuration.GetSection("JWT"));
            //User Manager Service
            services.AddIdentity<ApplicationUser, IdentityRole>().AddEntityFrameworkStores<IdentityDbContext>();
            services.AddScoped<IUserService, UserService>();
            //Adding DB Context with MSSQL
            services.AddDbContext<IdentityDbContext>(options =>
                options.UseSqlServer(
                    Configuration.GetConnectionString("IdentityDbConnectionString"),
                    b => b.MigrationsAssembly(typeof(IdentityDbContext).Assembly.FullName)));

            //Adding Athentication - JWT
            services.AddAuthentication(options =>
            {
                options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
            })
                .AddJwtBearer(o =>
                {
                    o.RequireHttpsMetadata = false;
                    o.SaveToken = false;
                    o.TokenValidationParameters = new TokenValidationParameters
                    {
                        ValidateIssuerSigningKey = true,
                        ValidateIssuer = true,
                        ValidateAudience = true,
                        ValidateLifetime = true,
                        ClockSkew = TimeSpan.FromMinutes(Convert.ToInt32(Configuration["JWT:DurationInMinutes"])),
                        ValidIssuer = Configuration["JWT:Issuer"],
                        ValidAudience = Configuration["JWT:Audience"],
                        IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration["JWT:Key"]))
                    };
                });

           

            services.AddSwaggerGen(c =>
            {
                c.SwaggerDoc("v1", new OpenApiInfo { Title = "JWT.IDP", Version = "v1" });
            });
        }

JWT 设置如下

 "JWT": {
    "key": "C1CF4B7DC4C4175B6618DE4F55CA4",
    "Issuer": "http://localhost:44318",
    "Audience": "SecureApiUser",
    "DurationInMinutes": 60
  },

Answer 1

简短的回答是

httpClient.DefaultRequestHeaders.Authorization =
  new AuthenticationHeaderValue("Bearer", [token])

保持“Bearer”不变，它只是一个常数。将 [token] 替换为您使用的 OAuth 协议返回给我们的 base 64 编码令牌值。