在ASP.NET Core中實現一個Token base的身份認證執行個體

以前在web端的身份認證都是基於Cookie | Session的身份認證, 在沒有更多的終端出現之前，這樣做也沒有什麼問題，但在Web API時代，你所需要面對的就不止是瀏覽器了，還有各種用戶端，這樣就有了一個問題，這些用戶端是不知道cookie是什麼鬼的。 (cookie其實是瀏覽器搞出來的小陷阱，用來保持會話的，但HTTP本身是無狀態的, 各種用戶端能提供的無非也就是HTTP操作的API)

而基於Token的身份認證就是應對這種變化而生的，它更開放，安全性也更高。

基於Token的身份認證有很多種實現方式，但我們這裡只使用微軟提供的API。

接下來的例子將帶領大家完成一個使用微軟JwtSecurityTokenHandler完成一個基於beare token的身份認證。

注意：這種文章屬於Step by step教程，跟著做才不至於看暈，下載完整程式碼分析代碼結構才有意義。

建立項目

在VS中建立項目，項目類型選擇ASP.NET Core Web Application(.NET Core), 輸入項目名稱為CSTokenBaseAuth

Coding

建立一些輔助類

在項目根目錄下建立一個檔案夾Auth,並添加RSAKeyHelper.cs以及TokenAuthOption.cs兩個檔案

在RSAKeyHelper.cs中

using System.Security.Cryptography; namespace CSTokenBaseAuth.Auth{  public class RSAKeyHelper  {    public static RSAParameters GenerateKey()    {      using (var key = new RSACryptoServiceProvider(2048))      {        return key.ExportParameters(true);      }    }  }}

在TokenAuthOption.cs中

using System;using Microsoft.IdentityModel.Tokens; namespace CSTokenBaseAuth.Auth{  public class TokenAuthOption  {    public static string Audience { get; } = "ExampleAudience";    public static string Issuer { get; } = "ExampleIssuer";    public static RsaSecurityKey Key { get; } = new RsaSecurityKey(RSAKeyHelper.GenerateKey());    public static SigningCredentials SigningCredentials { get; } = new SigningCredentials(Key, SecurityAlgorithms.RsaSha256Signature);     public static TimeSpan ExpiresSpan { get; } = TimeSpan.FromMinutes(20);  }}

Startup.cs

在ConfigureServices中添加如下代碼：

services.AddAuthorization(auth =>{  auth.AddPolicy("Bearer", new AuthorizationPolicyBuilder()    .AddAuthenticationSchemes(JwtBearerDefaults.AuthenticationScheme)    .RequireAuthenticatedUser().Build());});

完整的代碼應該是這樣

public void ConfigureServices(IServiceCollection services){  // Add framework services.  services.AddApplicationInsightsTelemetry(Configuration);  // Enable the use of an [Authorize("Bearer")] attribute on methods and classes to protect.  services.AddAuthorization(auth =>  {    auth.AddPolicy("Bearer", new AuthorizationPolicyBuilder()      .AddAuthenticationSchemes(JwtBearerDefaults.AuthenticationScheme)      .RequireAuthenticatedUser().Build());  });  services.AddMvc();}

在Configure方法中添加如下代碼

app.UseExceptionHandler(appBuilder => {  appBuilder.Use(async (context, next) => {    var error = context.Features[typeof(IExceptionHandlerFeature)] as IExceptionHandlerFeature;    //when authorization has failed, should retrun a json message to client    if (error != null && error.Error is SecurityTokenExpiredException)    {      context.Response.StatusCode = 401;      context.Response.ContentType = "application/json";      await context.Response.WriteAsync(JsonConvert.SerializeObject(        new { authenticated = false, tokenExpired = true }      ));    }    //when orther error, retrun a error message json to client    else if (error != null && error.Error != null)    {      context.Response.StatusCode = 500;      context.Response.ContentType = "application/json";      await context.Response.WriteAsync(JsonConvert.SerializeObject(        new { success = false, error = error.Error.Message }      ));    }    //when no error, do next.    else await next();  });});

這段代碼主要是Handle Error用的，比如當身份認證失敗的時候會拋出異常，而這裡就是處理這個異常的。

接下來在相同的方法中添加如下代碼，

app.UseExceptionHandler(appBuilder => {  appBuilder.Use(async (context, next) => {    var error = context.Features[typeof(IExceptionHandlerFeature)] as IExceptionHandlerFeature;     //when authorization has failed, should retrun a json message to client    if (error != null && error.Error is SecurityTokenExpiredException)    {      context.Response.StatusCode = 401;      context.Response.ContentType = "application/json";       await context.Response.WriteAsync(JsonConvert.SerializeObject(        new { authenticated = false, tokenExpired = true }      ));    }    //when orther error, retrun a error message json to client    else if (error != null && error.Error != null)    {      context.Response.StatusCode = 500;      context.Response.ContentType = "application/json";      await context.Response.WriteAsync(JsonConvert.SerializeObject(        new { success = false, error = error.Error.Message }      ));    }    //when no error, do next.    else await next();  });});

應用JwtBearerAuthentication

app.UseJwtBearerAuthentication(new JwtBearerOptions {  TokenValidationParameters = new TokenValidationParameters {    IssuerSigningKey = TokenAuthOption.Key,    ValidAudience = TokenAuthOption.Audience,    ValidIssuer = TokenAuthOption.Issuer,    ValidateIssuerSigningKey = true,    ValidateLifetime = true,    ClockSkew = TimeSpan.FromMinutes(0)  }});

完整的代碼應該是這樣

using System;using Microsoft.AspNetCore.Builder;using Microsoft.AspNetCore.Hosting;using Microsoft.Extensions.Configuration;using Microsoft.Extensions.DependencyInjection;using Microsoft.Extensions.Logging;using Microsoft.AspNetCore.Authorization;using Microsoft.AspNetCore.Authentication.JwtBearer;using CSTokenBaseAuth.Auth;using Microsoft.AspNetCore.Diagnostics;using Microsoft.IdentityModel.Tokens;using Microsoft.AspNetCore.Http;using Newtonsoft.Json; namespace CSTokenBaseAuth{  public class Startup  {    public Startup(IHostingEnvironment env)    {      var builder = new ConfigurationBuilder()        .SetBasePath(env.ContentRootPath)        .AddJsonFile("appsettings.json", optional: true, reloadOnChange: true)        .AddJsonFile($"appsettings.{env.EnvironmentName}.json", optional: true);       if (env.IsEnvironment("Development"))      {        // This will push telemetry data through Application Insights pipeline faster, allowing you to view results immediately.        builder.AddApplicationInsightsSettings(developerMode: true);      }       builder.AddEnvironmentVariables();      Configuration = builder.Build();    }     public IConfigurationRoot Configuration { get; }     // This method gets called by the runtime. Use this method to add services to the container    public void ConfigureServices(IServiceCollection services)    {      // Add framework services.      services.AddApplicationInsightsTelemetry(Configuration);       // Enable the use of an [Authorize("Bearer")] attribute on methods and classes to protect.      services.AddAuthorization(auth =>      {        auth.AddPolicy("Bearer", new AuthorizationPolicyBuilder()          .AddAuthenticationSchemes(JwtBearerDefaults.AuthenticationScheme)          .RequireAuthenticatedUser().Build());      });       services.AddMvc();    }     // This method gets called by the runtime. Use this method to configure the HTTP request pipeline    public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)    {      loggerFactory.AddConsole(Configuration.GetSection("Logging"));      loggerFactory.AddDebug();       app.UseApplicationInsightsRequestTelemetry();       app.UseApplicationInsightsExceptionTelemetry();       #region Handle Exception      app.UseExceptionHandler(appBuilder => {        appBuilder.Use(async (context, next) => {          var error = context.Features[typeof(IExceptionHandlerFeature)] as IExceptionHandlerFeature;           //when authorization has failed, should retrun a json message to client          if (error != null && error.Error is SecurityTokenExpiredException)          {            context.Response.StatusCode = 401;            context.Response.ContentType = "application/json";             await context.Response.WriteAsync(JsonConvert.SerializeObject(              new { authenticated = false, tokenExpired = true }            ));          }          //when orther error, retrun a error message json to client          else if (error != null && error.Error != null)          {            context.Response.StatusCode = 500;            context.Response.ContentType = "application/json";            await context.Response.WriteAsync(JsonConvert.SerializeObject(              new { success = false, error = error.Error.Message }            ));          }          //when no error, do next.          else await next();        });      });      #endregion       #region UseJwtBearerAuthentication      app.UseJwtBearerAuthentication(new JwtBearerOptions {        TokenValidationParameters = new TokenValidationParameters {          IssuerSigningKey = TokenAuthOption.Key,          ValidAudience = TokenAuthOption.Audience,          ValidIssuer = TokenAuthOption.Issuer,          ValidateIssuerSigningKey = true,          ValidateLifetime = true,          ClockSkew = TimeSpan.FromMinutes(0)        }      });      #endregion       app.UseMvc(routes =>      {        routes.MapRoute(          name: "default",          template: "{controller=Login}/{action=Index}");      });    }  }}

在Controllers中建立一個Web API Controller Class，命名為TokenAuthController.cs。我們將在這裡完成登入授權

在同檔案下添加兩個類，分別用來類比使用者模型，以及使用者儲存，代碼應該是這樣

public class User{  public Guid ID { get; set; }  public string Username { get; set; }  public string Password { get; set; }} public static class UserStorage{  public static List<User> Users { get; set; } = new List<User> {    new User {ID=Guid.NewGuid(),Username="user1",Password = "user1psd" },    new User {ID=Guid.NewGuid(),Username="user2",Password = "user2psd" },    new User {ID=Guid.NewGuid(),Username="user3",Password = "user3psd" }  };}

接下來在TokenAuthController.cs中添加如下方法

private string GenerateToken(User user, DateTime expires){  var handler = new JwtSecurityTokenHandler();     ClaimsIdentity identity = new ClaimsIdentity(    new GenericIdentity(user.Username, "TokenAuth"),    new[] {      new Claim("ID", user.ID.ToString())    }  );   var securityToken = handler.CreateToken(new SecurityTokenDescriptor  {    Issuer = TokenAuthOption.Issuer,    Audience = TokenAuthOption.Audience,    SigningCredentials = TokenAuthOption.SigningCredentials,    Subject = identity,    Expires = expires  });  return handler.WriteToken(securityToken);}

該方法僅僅只是產生一個Auth Token,接下來我們來添加另外一個方法來調用它

在相同檔案中添加如下代碼

[HttpPost]public string GetAuthToken(User user){  var existUser = UserStorage.Users.FirstOrDefault(u => u.Username == user.Username && u.Password == user.Password);   if (existUser != null)  {    var requestAt = DateTime.Now;    var expiresIn = requestAt + TokenAuthOption.ExpiresSpan;    var token = GenerateToken(existUser, expiresIn);     return JsonConvert.SerializeObject(new {      stateCode = 1,      requertAt = requestAt,      expiresIn = TokenAuthOption.ExpiresSpan.TotalSeconds,      accessToken = token    });  }  else  {    return JsonConvert.SerializeObject(new { stateCode = -1, errors = "Username or password is invalid" });  }}

該檔案完整的代碼應該是這樣

using System;using System.Collections.Generic;using System.Linq;using System.Threading.Tasks;using Microsoft.AspNetCore.Mvc;using Newtonsoft.Json;using System.IdentityModel.Tokens.Jwt;using System.Security.Claims;using System.Security.Principal;using Microsoft.IdentityModel.Tokens;using CSTokenBaseAuth.Auth; namespace CSTokenBaseAuth.Controllers{  [Route("api/[controller]")]  public class TokenAuthController : Controller  {    [HttpPost]    public string GetAuthToken(User user)    {      var existUser = UserStorage.Users.FirstOrDefault(u => u.Username == user.Username && u.Password == user.Password);       if (existUser != null)      {        var requestAt = DateTime.Now;        var expiresIn = requestAt + TokenAuthOption.ExpiresSpan;        var token = GenerateToken(existUser, expiresIn);         return JsonConvert.SerializeObject(new {          stateCode = 1,          requertAt = requestAt,          expiresIn = TokenAuthOption.ExpiresSpan.TotalSeconds,          accessToken = token        });      }      else      {        return JsonConvert.SerializeObject(new { stateCode = -1, errors = "Username or password is invalid" });      }    }     private string GenerateToken(User user, DateTime expires)    {      var handler = new JwtSecurityTokenHandler();             ClaimsIdentity identity = new ClaimsIdentity(        new GenericIdentity(user.Username, "TokenAuth"),        new[] {          new Claim("ID", user.ID.ToString())        }      );       var securityToken = handler.CreateToken(new SecurityTokenDescriptor      {        Issuer = TokenAuthOption.Issuer,        Audience = TokenAuthOption.Audience,        SigningCredentials = TokenAuthOption.SigningCredentials,        Subject = identity,        Expires = expires      });      return handler.WriteToken(securityToken);    }  }   public class User  {    public Guid ID { get; set; }     public string Username { get; set; }     public string Password { get; set; }  }   public static class UserStorage  {    public static List<User> Users { get; set; } = new List<User> {      new User {ID=Guid.NewGuid(),Username="user1",Password = "user1psd" },      new User {ID=Guid.NewGuid(),Username="user2",Password = "user2psd" },      new User {ID=Guid.NewGuid(),Username="user3",Password = "user3psd" }    };  }}

接下來我們來完成授權驗證部分

在Controllers中建立一個Web API Controller Class，命名為ValuesController.cs

在其中添加如下代碼

public string Get(){  var claimsIdentity = User.Identity as ClaimsIdentity;   var id = claimsIdentity.Claims.FirstOrDefault(c => c.Type == "ID").Value;   return $"Hello! {HttpContext.User.Identity.Name}, your ID is:{id}";}

為方法添加裝飾屬性

[HttpGet][Authorize("Bearer")] 完整的檔案代碼應該是這樣using System.Linq;using Microsoft.AspNetCore.Mvc;using Microsoft.AspNetCore.Authorization;using System.Security.Claims; namespace CSTokenBaseAuth.Controllers{  [Route("api/[controller]")]  public class ValuesController : Controller  {    [HttpGet]    [Authorize("Bearer")]    public string Get()    {      var claimsIdentity = User.Identity as ClaimsIdentity;       var id = claimsIdentity.Claims.FirstOrDefault(c => c.Type == "ID").Value;       return $"Hello! {HttpContext.User.Identity.Name}, your ID is:{id}";    }  }}

最後讓我們來添加視圖

在Controllers中建立一個Web Controller Class，命名為LoginController.cs

其中的代碼應該是這樣

using Microsoft.AspNetCore.Mvc; namespace CSTokenBaseAuth.Controllers{  [Route("[controller]/[action]")]  public class LoginController : Controller  {    public IActionResult Index()    {      return View();    }  }}

在項目Views目錄下建立一個名為Login的目錄，並在其中建立一個Index.cshtml檔案。

代碼應該是這個樣子

<html xmlns="http://www.w3.org/1999/xhtml"><head>  <title></title></head><body>  <button id="getToken">getToken</button>  <button id="requestAPI">requestAPI</button>   <script src="https://code.jquery.com/jquery-3.1.1.min.js"></script>  <script>    $(function () {      var accessToken = undefined;       $("#getToken").click(function () {        $.post(          "/api/TokenAuth",          { Username: "user1", Password: "user1psd" },          function (data) {            console.log(data);            if (data.stateCode == 1)            {              accessToken = data.accessToken;               $.ajaxSetup({                headers: { "Authorization": "Bearer " + accessToken }              });            }          },          "json"        );      })       $("#requestAPI").click(function () {        $.get("/api/Values", {}, function (data) {          alert(data);        }, "text");      })    })  </script></body></html>

以上就是本文的全部內容，希望對大家的學習有所協助，也希望大家多多支援php中文網。