#region

configuration[JWTToken:Issuer];

string

configuration[JWTToken:Audience];

string

configuration[JWTToken:SecretKey];

//注入jwt

builder.Services.AddAuthentication(options

JwtBearerDefaults.AuthenticationScheme;

{options.TokenValidationParameters

new

TokenValidationParameters(){//过期时间容错值解决服务器端时间不同步问题秒//允许服务器时间偏移量30秒即我们配置的过期时间加上这个允许偏移的时间值才是真正过期的时间(过期时间

TimeSpan.FromSeconds(30),//要求Token的Claims中必须包含ExpiresRequireExpirationTime

true,//是否在令牌期间验证签发者ValidateIssuer

Issuer,

true,//是否验证失效时间ValidateLifetime

true,//是否验证签名SecurityKeyValidateIssuerSigningKey

Audience,//密钥SecurityKeyIssuerSigningKey

new

SymmetricSecurityKey(Encoding.UTF8.GetBytes(SecretKey)),

});

builder.Services.AddSingleton(new

#endregion//注入Swagger注入这个才能在调试接口时输入token

builder.Services.AddSwaggerGen(options

{options.AddSecurityRequirement(new

Microsoft.OpenApi.Models.OpenApiSecurityRequirement{{new

OpenApiSecurityScheme{Referencenew

OpenApiReference{IdBearer,TypeReferenceType.SecurityScheme},},Array.Emptystring()}});options.AddSecurityDefinition(Bearer,

new

Microsoft.OpenApi.Models.OpenApiSecurityScheme{Description

请输入文字Bearer

Microsoft.OpenApi.Models.ParameterLocation.Header,Type

Microsoft.OpenApi.Models.SecuritySchemeType.ApiKey});

});//配置跨域

builder.Services.AddCors(policy

opt

opt.AllowAnyOrigin().AllowAnyHeader().AllowAnyMethod().WithExposedHeaders(X-Pagination));

4.相关配置结束后我们得生成Token这时我们创建一个专门生成Token的类里面有两个生成Token的方法想用哪个用哪个。

该类在Program里有引用。

///

//HttpContext.User.Identity.Namenew

RoleName),

//HttpContext.User.IsInRole(r_admin)new

Claim(JwtRegisteredClaimNames.Jti,

Claim(Permission,

SymmetricSecurityKey(Encoding.UTF8.GetBytes(_configuration[JWTToken:SecretKey]));//

选择加密算法var

SecurityAlgorithms.HmacSha256;//

生成Credentialsvar

_configuration[JWTToken:Issuer],

//发布者audience:

_configuration[JWTToken:Audience],

//接收者claims:

System.DateTime.Now.AddHours(48),

//有效期设置为48小时signingCredentials:

signingCredentials

//数字签名,用于生成Token的Header,其余都是荷载数据);//

将token变为stringvar

JwtSecurityTokenHandler().WriteToken(Token);return

token;}///

Claim(JwtRegisteredClaimNames.Jti,

Claim(Account,

PassWord)//密码可以要求使用特定加密技术加密//new

Claim(Username,

SymmetricSecurityKey(Encoding.UTF8.GetBytes(_configuration[JWTToken:SecretKey]));//

选择加密算法var

SecurityAlgorithms.HmacSha256;//

生成Credentialsvar

_configuration[JWTToken:Issuer],

//发布者audience:

_configuration[JWTToken:Audience],

//接收者claims:

System.DateTime.Now.AddHours(48),

//有效期设置为48小时signingCredentials:

signingCredentials

//数字签名,用于生成Token的Header,其余都是荷载数据);//

将token变为stringvar

JwtSecurityTokenHandler().WriteToken(Token);return

token;}}

5.这时可以生成Token了我们来新建一个控制器来生成一个试试:

[ApiController]

jwtHelper;}[HttpPost][Route(Token)]public

TaskJsonResult

_jwtHelper.CreateLoginToken(token.Name,

User,

6.既然可以生成Token了那么就该给控制器授权了总不能让每个携带Token的用户能访问系统所以的API吧那样会出现垂直越权的情况渗透测试过不了哦。

相关标签Authorize

此处着重说Policy方式对Role方法感兴趣的可以看我前面的Cookie方式验证。

6.1首先新建一个JwtAuthorizationRequirement类(类名不固定)用于继承IAuthorizationRequirement

public

{//这里可以扩展一些其他的角色或者需要的东西.//txt参数是在使用策略授权时传入进来的例如:Authorize(Policy

JwtAuthorizationRequirement(string

name){Name

6.2然后新建一个JwtAuthorizationHandler类继承AuthorizationHandlerJwtAuthorizationRequirement

///

MVC继承AuthorizeAttribute实现JWT的拦截器的效果。

///

AuthorizationHandlerJwtAuthorizationRequirement

{protected

HandleRequirementAsync(AuthorizationHandlerContext

context,

Task.CompletedTask;}//requirement.Name

string?

context.User.Claims.FirstOrDefault(p

p.Type

requirement.Name)?.Value;string?

PassWord

context.User.Claims.FirstOrDefault(p

p.Type

PassWord)?.Value;//这里时数据库或者其他方式校验

(Account1234){context.Succeed(requirement);}else{context.Fail();}return

Task.CompletedTask;}

builder.Services.AddSingletonIAuthorizationHandler,

//账号密码验证策略

builder.Services.AddAuthorization(p

JwtAuthorizationRequirement(Account));});

});

DateTime.Now.AddDays(index),TemperatureC

55),Summary

Summaries[Random.Shared.Next(Summaries.Length)]}).ToArray();}

///

PermissionAuthorizationRequirement

{///

参数是在使用策略授权时传入进来的例如:Authorize(Policy

/summary///

PermissionAuthorizationRequirement(string

name){Name

AuthorizationHandlerPermissionAuthorizationRequirement{protected

override

HandleRequirementAsync(AuthorizationHandlerContext

context,

PermissionAuthorizationRequirement

requirement){//取出当前用户的所有Permission的参数var

permissions

_.Value).ToList();//是否满足授权满足则运行

context.Succeed

_.StartsWith(requirement.Name))){context.Succeed(requirement);}else{context.Fail();}return

Program

builder.Services.AddSingletonIAuthorizationHandler,

PermissionAuthorizationHandler();

//控制器方法验证策略

builder.Services.AddAuthorization(options

{options.AddPolicy(Permissions.UserCreate,

policy

PermissionAuthorizationRequirement(Permissions.UserCreate)));options.AddPolicy(Permissions.UserUpdate,

policy

PermissionAuthorizationRequirement(Permissions.UserUpdate)));options.AddPolicy(Permissions.UserDelete,

policy

PermissionAuthorizationRequirement(Permissions.UserDelete)));options.AddPolicy(Permissions.UserSelect,

policy

PermissionAuthorizationRequirement(Permissions.UserSelect)));

});

WebApplication.CreateBuilder(args);//

Add

container.builder.Services.AddControllers();

Learn

https://aka.ms/aspnetcore/swashbuckle

builder.Services.AddEndpointsApiExplorer();

builder.Services.AddSwaggerGen();

//首先引用Microsoft.AspNetCore.Mvc.NewtonsoftJson包。

再在builder.Services.AddControllers()后添加相应内容

builder.Services.AddControllers().AddNewtonsoftJson(options

{//设置JSON返回数据格式大小写与Model一致options.SerializerSettings.ContractResolver

new

DefaultContractResolver();//设置一般API的日期格式options.SerializerSettings.DateFormatString

yyyy-MM-dd

configuration[JWTToken:Issuer];

string

configuration[JWTToken:Audience];

string

configuration[JWTToken:SecretKey];

//注入jwt

builder.Services.AddAuthentication(options

JwtBearerDefaults.AuthenticationScheme;

{options.TokenValidationParameters

new

TokenValidationParameters(){//过期时间容错值解决服务器端时间不同步问题秒//允许服务器时间偏移量30秒即我们配置的过期时间加上这个允许偏移的时间值才是真正过期的时间(过期时间

TimeSpan.FromSeconds(30),//要求Token的Claims中必须包含ExpiresRequireExpirationTime

true,//是否在令牌期间验证签发者ValidateIssuer

Issuer,

true,//是否验证失效时间ValidateLifetime

true,//是否验证签名SecurityKeyValidateIssuerSigningKey

Audience,//密钥SecurityKeyIssuerSigningKey

new

SymmetricSecurityKey(Encoding.UTF8.GetBytes(SecretKey)),

});

builder.Services.AddSingleton(new

builder.Services.AddSingletonIAuthorizationHandler,

//账号密码验证策略

builder.Services.AddAuthorization(p

JwtAuthorizationRequirement(Account));});

});builder.Services.AddSingletonIAuthorizationHandler,

PermissionAuthorizationHandler();

//控制器方法验证策略

builder.Services.AddAuthorization(options

{options.AddPolicy(Permissions.UserCreate,

policy

PermissionAuthorizationRequirement(Permissions.UserCreate)));options.AddPolicy(Permissions.UserUpdate,

policy

PermissionAuthorizationRequirement(Permissions.UserUpdate)));options.AddPolicy(Permissions.UserDelete,

policy

PermissionAuthorizationRequirement(Permissions.UserDelete)));options.AddPolicy(Permissions.UserSelect,

policy

PermissionAuthorizationRequirement(Permissions.UserSelect)));

});

builder.Services.AddSwaggerGen(options

{options.AddSecurityRequirement(new

Microsoft.OpenApi.Models.OpenApiSecurityRequirement{{new

OpenApiSecurityScheme{Referencenew

OpenApiReference{IdBearer,TypeReferenceType.SecurityScheme},},Array.Emptystring()}});options.AddSecurityDefinition(Bearer,

new

Microsoft.OpenApi.Models.OpenApiSecurityScheme{Description

请输入文字Bearer

Microsoft.OpenApi.Models.ParameterLocation.Header,Type

Microsoft.OpenApi.Models.SecuritySchemeType.ApiKey});

});//配置跨域

builder.Services.AddCors(policy

opt

opt.AllowAnyOrigin().AllowAnyHeader().AllowAnyMethod().WithExposedHeaders(X-Pagination));

});

(app.Environment.IsDevelopment())

{app.UseSwagger();app.UseSwaggerUI();

}app.UseHttpsRedirection();app.MapControllers();app.Run();参考链接:ASP.NET

Core