在ASP.NET Core中實(shí)現(xiàn)一個(gè)Token base的身份認(rèn)證實(shí)例
以前在web端的身份認(rèn)證都是基于Cookie | Session的身份認(rèn)證, 在沒有更多的終端出現(xiàn)之前,這樣做也沒有什么問題,但在Web API時(shí)代,你所需要面對的就不止是瀏覽器了,還有各種客戶端,這樣就有了一個(gè)問題,這些客戶端是不知道cookie是什么鬼的。 (cookie其實(shí)是瀏覽器搞出來的小貓膩,用來保持會話的,但HTTP本身是無狀態(tài)的, 各種客戶端能提供的無非也就是HTTP操作的API)
而基于Token的身份認(rèn)證就是應(yīng)對這種變化而生的,它更開放,安全性也更高。
基于Token的身份認(rèn)證有很多種實(shí)現(xiàn)方式,但我們這里只使用微軟提供的API。
接下來的例子將帶領(lǐng)大家完成一個(gè)使用微軟JwtSecurityTokenHandler完成一個(gè)基于beare token的身份認(rèn)證。
注意:這種文章屬于Step by step教程,跟著做才不至于看暈,下載完整代碼分析代碼結(jié)構(gòu)才有意義。
前期準(zhǔn)備
推薦使用VS2015 Update3作為你的IDE,下載地址:http://www.dhdzp.com/softjc/446184.html
你需要安裝.NET Core的運(yùn)行環(huán)境以及開發(fā)工具,這里提供VS版:http://www.dhdzp.com/softs/472362.html
創(chuàng)建項(xiàng)目
在VS中新建項(xiàng)目,項(xiàng)目類型選擇ASP.NET Core Web Application(.NET Core), 輸入項(xiàng)目名稱為CSTokenBaseAuth
Coding
創(chuàng)建一些輔助類
在項(xiàng)目根目錄下創(chuàng)建一個(gè)文件夾Auth,并添加RSAKeyHelper.cs以及TokenAuthOption.cs兩個(gè)文件
在RSAKeyHelper.cs中
using System.Security.Cryptography;
namespace CSTokenBaseAuth.Auth
{
public class RSAKeyHelper
{
public static RSAParameters GenerateKey()
{
using (var key = new RSACryptoServiceProvider(2048))
{
return key.ExportParameters(true);
}
}
}
}
在TokenAuthOption.cs中
using System;
using Microsoft.IdentityModel.Tokens;
namespace CSTokenBaseAuth.Auth
{
public class TokenAuthOption
{
public static string Audience { get; } = "ExampleAudience";
public static string Issuer { get; } = "ExampleIssuer";
public static RsaSecurityKey Key { get; } = new RsaSecurityKey(RSAKeyHelper.GenerateKey());
public static SigningCredentials SigningCredentials { get; } = new SigningCredentials(Key, SecurityAlgorithms.RsaSha256Signature);
public static TimeSpan ExpiresSpan { get; } = TimeSpan.FromMinutes(20);
}
}
Startup.cs
在ConfigureServices中添加如下代碼:
services.AddAuthorization(auth =>
{
auth.AddPolicy("Bearer", new AuthorizationPolicyBuilder()
.AddAuthenticationSchemes(JwtBearerDefaults.AuthenticationScheme)
.RequireAuthenticatedUser().Build());
});
完整的代碼應(yīng)該是這樣
public void ConfigureServices(IServiceCollection services)
{
// Add framework services.
services.AddApplicationInsightsTelemetry(Configuration);
// Enable the use of an [Authorize("Bearer")] attribute on methods and classes to protect.
services.AddAuthorization(auth =>
{
auth.AddPolicy("Bearer", new AuthorizationPolicyBuilder()
.AddAuthenticationSchemes(JwtBearerDefaults.AuthenticationScheme)
.RequireAuthenticatedUser().Build());
});
services.AddMvc();
}
在Configure方法中添加如下代碼
app.UseExceptionHandler(appBuilder => {
appBuilder.Use(async (context, next) => {
var error = context.Features[typeof(IExceptionHandlerFeature)] as IExceptionHandlerFeature;
//when authorization has failed, should retrun a json message to client
if (error != null && error.Error is SecurityTokenExpiredException)
{
context.Response.StatusCode = 401;
context.Response.ContentType = "application/json";
await context.Response.WriteAsync(JsonConvert.SerializeObject(
new { authenticated = false, tokenExpired = true }
));
}
//when orther error, retrun a error message json to client
else if (error != null && error.Error != null)
{
context.Response.StatusCode = 500;
context.Response.ContentType = "application/json";
await context.Response.WriteAsync(JsonConvert.SerializeObject(
new { success = false, error = error.Error.Message }
));
}
//when no error, do next.
else await next();
});
});
這段代碼主要是Handle Error用的,比如當(dāng)身份認(rèn)證失敗的時(shí)候會拋出異常,而這里就是處理這個(gè)異常的。
接下來在相同的方法中添加如下代碼,
app.UseExceptionHandler(appBuilder => {
appBuilder.Use(async (context, next) => {
var error = context.Features[typeof(IExceptionHandlerFeature)] as IExceptionHandlerFeature;
//when authorization has failed, should retrun a json message to client
if (error != null && error.Error is SecurityTokenExpiredException)
{
context.Response.StatusCode = 401;
context.Response.ContentType = "application/json";
await context.Response.WriteAsync(JsonConvert.SerializeObject(
new { authenticated = false, tokenExpired = true }
));
}
//when orther error, retrun a error message json to client
else if (error != null && error.Error != null)
{
context.Response.StatusCode = 500;
context.Response.ContentType = "application/json";
await context.Response.WriteAsync(JsonConvert.SerializeObject(
new { success = false, error = error.Error.Message }
));
}
//when no error, do next.
else await next();
});
});
應(yīng)用JwtBearerAuthentication
app.UseJwtBearerAuthentication(new JwtBearerOptions {
TokenValidationParameters = new TokenValidationParameters {
IssuerSigningKey = TokenAuthOption.Key,
ValidAudience = TokenAuthOption.Audience,
ValidIssuer = TokenAuthOption.Issuer,
ValidateIssuerSigningKey = true,
ValidateLifetime = true,
ClockSkew = TimeSpan.FromMinutes(0)
}
});
完整的代碼應(yīng)該是這樣
using System;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Logging;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Authentication.JwtBearer;
using CSTokenBaseAuth.Auth;
using Microsoft.AspNetCore.Diagnostics;
using Microsoft.IdentityModel.Tokens;
using Microsoft.AspNetCore.Http;
using Newtonsoft.Json;
namespace CSTokenBaseAuth
{
public class Startup
{
public Startup(IHostingEnvironment env)
{
var builder = new ConfigurationBuilder()
.SetBasePath(env.ContentRootPath)
.AddJsonFile("appsettings.json", optional: true, reloadOnChange: true)
.AddJsonFile($"appsettings.{env.EnvironmentName}.json", optional: true);
if (env.IsEnvironment("Development"))
{
// This will push telemetry data through Application Insights pipeline faster, allowing you to view results immediately.
builder.AddApplicationInsightsSettings(developerMode: true);
}
builder.AddEnvironmentVariables();
Configuration = builder.Build();
}
public IConfigurationRoot Configuration { get; }
// This method gets called by the runtime. Use this method to add services to the container
public void ConfigureServices(IServiceCollection services)
{
// Add framework services.
services.AddApplicationInsightsTelemetry(Configuration);
// Enable the use of an [Authorize("Bearer")] attribute on methods and classes to protect.
services.AddAuthorization(auth =>
{
auth.AddPolicy("Bearer", new AuthorizationPolicyBuilder()
.AddAuthenticationSchemes(JwtBearerDefaults.AuthenticationScheme)
.RequireAuthenticatedUser().Build());
});
services.AddMvc();
}
// This method gets called by the runtime. Use this method to configure the HTTP request pipeline
public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
{
loggerFactory.AddConsole(Configuration.GetSection("Logging"));
loggerFactory.AddDebug();
app.UseApplicationInsightsRequestTelemetry();
app.UseApplicationInsightsExceptionTelemetry();
#region Handle Exception
app.UseExceptionHandler(appBuilder => {
appBuilder.Use(async (context, next) => {
var error = context.Features[typeof(IExceptionHandlerFeature)] as IExceptionHandlerFeature;
//when authorization has failed, should retrun a json message to client
if (error != null && error.Error is SecurityTokenExpiredException)
{
context.Response.StatusCode = 401;
context.Response.ContentType = "application/json";
await context.Response.WriteAsync(JsonConvert.SerializeObject(
new { authenticated = false, tokenExpired = true }
));
}
//when orther error, retrun a error message json to client
else if (error != null && error.Error != null)
{
context.Response.StatusCode = 500;
context.Response.ContentType = "application/json";
await context.Response.WriteAsync(JsonConvert.SerializeObject(
new { success = false, error = error.Error.Message }
));
}
//when no error, do next.
else await next();
});
});
#endregion
#region UseJwtBearerAuthentication
app.UseJwtBearerAuthentication(new JwtBearerOptions {
TokenValidationParameters = new TokenValidationParameters {
IssuerSigningKey = TokenAuthOption.Key,
ValidAudience = TokenAuthOption.Audience,
ValidIssuer = TokenAuthOption.Issuer,
ValidateIssuerSigningKey = true,
ValidateLifetime = true,
ClockSkew = TimeSpan.FromMinutes(0)
}
});
#endregion
app.UseMvc(routes =>
{
routes.MapRoute(
name: "default",
template: "{controller=Login}/{action=Index}");
});
}
}
}
在Controllers中新建一個(gè)Web API Controller Class,命名為TokenAuthController.cs。我們將在這里完成登錄授權(quán)
在同文件下添加兩個(gè)類,分別用來模擬用戶模型,以及用戶存儲,代碼應(yīng)該是這樣
public class User
{
public Guid ID { get; set; }
public string Username { get; set; }
public string Password { get; set; }
}
public static class UserStorage
{
public static List<User> Users { get; set; } = new List<User> {
new User {ID=Guid.NewGuid(),Username="user1",Password = "user1psd" },
new User {ID=Guid.NewGuid(),Username="user2",Password = "user2psd" },
new User {ID=Guid.NewGuid(),Username="user3",Password = "user3psd" }
};
}
接下來在TokenAuthController.cs中添加如下方法
private string GenerateToken(User user, DateTime expires)
{
var handler = new JwtSecurityTokenHandler();
ClaimsIdentity identity = new ClaimsIdentity(
new GenericIdentity(user.Username, "TokenAuth"),
new[] {
new Claim("ID", user.ID.ToString())
}
);
var securityToken = handler.CreateToken(new SecurityTokenDescriptor
{
Issuer = TokenAuthOption.Issuer,
Audience = TokenAuthOption.Audience,
SigningCredentials = TokenAuthOption.SigningCredentials,
Subject = identity,
Expires = expires
});
return handler.WriteToken(securityToken);
}
該方法僅僅只是生成一個(gè)Auth Token,接下來我們來添加另外一個(gè)方法來調(diào)用它
在相同文件中添加如下代碼
[HttpPost]
public string GetAuthToken(User user)
{
var existUser = UserStorage.Users.FirstOrDefault(u => u.Username == user.Username && u.Password == user.Password);
if (existUser != null)
{
var requestAt = DateTime.Now;
var expiresIn = requestAt + TokenAuthOption.ExpiresSpan;
var token = GenerateToken(existUser, expiresIn);
return JsonConvert.SerializeObject(new {
stateCode = 1,
requertAt = requestAt,
expiresIn = TokenAuthOption.ExpiresSpan.TotalSeconds,
accessToken = token
});
}
else
{
return JsonConvert.SerializeObject(new { stateCode = -1, errors = "Username or password is invalid" });
}
}
該文件完整的代碼應(yīng)該是這樣
using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Mvc;
using Newtonsoft.Json;
using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Security.Principal;
using Microsoft.IdentityModel.Tokens;
using CSTokenBaseAuth.Auth;
namespace CSTokenBaseAuth.Controllers
{
[Route("api/[controller]")]
public class TokenAuthController : Controller
{
[HttpPost]
public string GetAuthToken(User user)
{
var existUser = UserStorage.Users.FirstOrDefault(u => u.Username == user.Username && u.Password == user.Password);
if (existUser != null)
{
var requestAt = DateTime.Now;
var expiresIn = requestAt + TokenAuthOption.ExpiresSpan;
var token = GenerateToken(existUser, expiresIn);
return JsonConvert.SerializeObject(new {
stateCode = 1,
requertAt = requestAt,
expiresIn = TokenAuthOption.ExpiresSpan.TotalSeconds,
accessToken = token
});
}
else
{
return JsonConvert.SerializeObject(new { stateCode = -1, errors = "Username or password is invalid" });
}
}
private string GenerateToken(User user, DateTime expires)
{
var handler = new JwtSecurityTokenHandler();
ClaimsIdentity identity = new ClaimsIdentity(
new GenericIdentity(user.Username, "TokenAuth"),
new[] {
new Claim("ID", user.ID.ToString())
}
);
var securityToken = handler.CreateToken(new SecurityTokenDescriptor
{
Issuer = TokenAuthOption.Issuer,
Audience = TokenAuthOption.Audience,
SigningCredentials = TokenAuthOption.SigningCredentials,
Subject = identity,
Expires = expires
});
return handler.WriteToken(securityToken);
}
}
public class User
{
public Guid ID { get; set; }
public string Username { get; set; }
public string Password { get; set; }
}
public static class UserStorage
{
public static List<User> Users { get; set; } = new List<User> {
new User {ID=Guid.NewGuid(),Username="user1",Password = "user1psd" },
new User {ID=Guid.NewGuid(),Username="user2",Password = "user2psd" },
new User {ID=Guid.NewGuid(),Username="user3",Password = "user3psd" }
};
}
}
接下來我們來完成授權(quán)驗(yàn)證部分
在Controllers中新建一個(gè)Web API Controller Class,命名為ValuesController.cs
在其中添加如下代碼
public string Get()
{
var claimsIdentity = User.Identity as ClaimsIdentity;
var id = claimsIdentity.Claims.FirstOrDefault(c => c.Type == "ID").Value;
return $"Hello! {HttpContext.User.Identity.Name}, your ID is:{id}";
}
為方法添加裝飾屬性
[HttpGet]
[Authorize("Bearer")]
完整的文件代碼應(yīng)該是這樣
using System.Linq;
using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Authorization;
using System.Security.Claims;
namespace CSTokenBaseAuth.Controllers
{
[Route("api/[controller]")]
public class ValuesController : Controller
{
[HttpGet]
[Authorize("Bearer")]
public string Get()
{
var claimsIdentity = User.Identity as ClaimsIdentity;
var id = claimsIdentity.Claims.FirstOrDefault(c => c.Type == "ID").Value;
return $"Hello! {HttpContext.User.Identity.Name}, your ID is:{id}";
}
}
}
最后讓我們來添加視圖
在Controllers中新建一個(gè)Web Controller Class,命名為LoginController.cs
其中的代碼應(yīng)該是這樣
using Microsoft.AspNetCore.Mvc;
namespace CSTokenBaseAuth.Controllers
{
[Route("[controller]/[action]")]
public class LoginController : Controller
{
public IActionResult Index()
{
return View();
}
}
}
在項(xiàng)目Views目錄下新建一個(gè)名為Login的目錄,并在其中新建一個(gè)Index.cshtml文件。
代碼應(yīng)該是這個(gè)樣子
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title></title>
</head>
<body>
<button id="getToken">getToken</button>
<button id="requestAPI">requestAPI</button>
<script src="https://code.jquery.com/jquery-3.1.1.min.js"></script>
<script>
$(function () {
var accessToken = undefined;
$("#getToken").click(function () {
$.post(
"/api/TokenAuth",
{ Username: "user1", Password: "user1psd" },
function (data) {
console.log(data);
if (data.stateCode == 1)
{
accessToken = data.accessToken;
$.ajaxSetup({
headers: { "Authorization": "Bearer " + accessToken }
});
}
},
"json"
);
})
$("#requestAPI").click(function () {
$.get("/api/Values", {}, function (data) {
alert(data);
}, "text");
})
})
</script>
</body>
</html>
以上就是本文的全部內(nèi)容,希望對大家的學(xué)習(xí)有所幫助,也希望大家多多支持腳本之家。
相關(guān)文章
ASP.NET三層架構(gòu)詳解 如何實(shí)現(xiàn)三層架構(gòu)
這篇文章主要為大家詳細(xì)介紹了ASP.NET三層架構(gòu),如何實(shí)現(xiàn)三層架構(gòu),本文為大家揭曉,感興趣的小伙伴們可以參考一下2016-05-05
.Net?Core?使用?TagProvider?與?Enricher?豐富日志的操作代碼
這篇文章主要介紹了.Net?Core?使用?TagProvider?與?Enricher?豐富日志的操作,本文通過示例代碼給大家介紹的非常詳細(xì),需要的朋友可以參考下2024-03-03
ASP.NET MVC3關(guān)于生成純靜態(tài)后如何不再走路由直接訪問靜態(tài)頁面
高訪問量類型的電子商務(wù)網(wǎng)站,需要將一些不是經(jīng)常變化的頁面生成靜態(tài)頁面,然后普通用戶就可以直接訪問這些靜態(tài)頁面而不用再訪問需要連接數(shù)據(jù)庫的動態(tài)頁面。那么ASP.NET MVC3中如何做到這一點(diǎn)呢2011-12-12
asp.net Execl的添加,更新操作實(shí)現(xiàn)代碼
asp.net Execl的添加、修改等實(shí)現(xiàn)代碼。2009-02-02
關(guān)于Asp.net頁面Page_Load被執(zhí)行兩次的問題分享
這篇文章介紹了關(guān)于Asp.net頁面Page_Load被執(zhí)行兩次的問題,有需要的朋友可以參考一下2013-09-09
解決asp.net core在輸出中文時(shí)亂碼的問題
最近在學(xué)習(xí)asp.net core的時(shí)候,嘗試在控制臺,或者頁面上輸出中文,會出現(xiàn)亂碼的問題。那么這該如何解決呢?下面通過這篇文章來一起看看吧,文中給出了詳細(xì)的解決方法,相信對大家有一定的參考價(jià)值。2016-12-12

