成功验证 ServiceStack 后未定义 RefreshToken

Question

• ServiceStack 5.0 版
• ServiceStack Typescript 客户端版本 0.0.40

以下代码调用我的身份验证微服务并成功验证用户并返回承载令牌：

var request = new Authenticate();
request.provider = "credentials";
request.userName = userName;
request.password = password;
request.useTokenCookie = true;

this.client.post(request)
.then(res => {
    if (res.bearerToken != null) {
    console.log('auth success', res);
    console.log('auth refresh token', res.refreshToken);
    resolve(true);
    }
    resolve(false);
}, msg => {
    console.log('log in failed');
    reject(msg);
})

问题是我的 Auth 微服务没有返回刷新令牌：

我的身份验证微服务配置：

Plugins.Add(new AuthFeature(() => new CustomUserSession(),
    new IAuthProvider[] {
        new JwtAuthProvider
        {
            HashAlgorithm = AuthSettings.HashAlgorithm,
            RequireSecureConnection = requireSecureConnection,
            AuthKeyBase64 = AuthSettings.JwtAuthKeyBase64,
            ExpireTokensIn        = TimeSpan.FromHours(_configuration["AuthSettings:ExpireTokensIn"].ToDouble()),
            ExpireRefreshTokensIn = TimeSpan.FromHours(_configuration["AuthSettings:ExpireRefreshTokensIn"].ToDouble()),
            CreatePayloadFilter = (payload,session) => {
                    payload["zipCode"] = ((CustomUserSession)session).ZipCode;
            },
            PopulateSessionFilter = AuthSettings.PopulateSessionFilterImplementation
        },
        new CustomCredentialsAuthProvider((ITsoContext)_serviceProvider.GetService(typeof(ITsoContext))) //HTML Form post of User/Pass
    }));

Answer 1

如果您使用自定义 AuthProvider 覆盖 CredentialsAuthProvider，请确保您也是 setting Authentication was performed：

authService.Request.Items[Keywords.DidAuthenticate] = true;

也支持 JWT RefreshTokens requires a registered AuthRepository。

如果您使用没有 IAuthRepository 的自定义 AuthProvider，我刚刚添加了对实现 IUserSessionSource 的支持，作为在新 JWT 令牌中填充会话的替代来源，您可以通过在 IOC 中注册来使用它或让您的自定义 AuthProvider 实施：

public interface IUserSessionSource
{
    IAuthSession GetUserSession(string userAuthId);
}

如果他们被允许登录，实现应该只返回一个填充的IAuthSession，即如果他们的帐户被暂停，它应该抛出一个异常，如：

throw HttpError.Forbidden("User is suspended");

ServiceStack v5 支持IUserSessionSource，现在是available on MyGet。升级前请review v5 changes。