asp.net core 2.0 web api基于JWT自定义策略授权

JWT(json web token)是一种基于json的身份验证机制，流程如下：

通过登录，来获取Token，再在之后每次请求的Header中追加Authorization为Token的凭据，服务端验证通过即可能获取想要访问的资源。关于JWT的技术，可参考网络上文章，这里不作详细说明，

这篇博文，主要说明在asp.net core 2.0中，基于jwt的web api的权限设置，即在asp.net core中怎么用JWT，再次就是不同用户或角色因为权限问题，即使援用Token，也不能访问不该访问的资源。

基本思路是我们自定义一个策略，来验证用户，和验证用户授权，PermissionRequirement是验证传输授权的参数。在Startup的ConfigureServices注入验证（Authentication），授权（Authorization），和JWT(JwtBearer)

自定义策略：

已封闭成AuthorizeRolicy.JWT nuget包，并发布到nuget上：

https://www.nuget.org/packages/AuthorizePolicy.JWT/

源码如下：

JwtToken.cs

/// <summary>

/// 获取基于JWT的Token

/// </summary>

/// <param name="username"></param>

/// <returns></returns>

public static dynamic BuildJwtToken(Claim[] claims, PermissionRequirement permissionRequirement)

{

var now = DateTime.UtcNow;

var jwt = new JwtSecurityToken(

issuer: permissionRequirement.Issuer,

audience: permissionRequirement.Audience,

claims: claims,

notBefore: now,

expires: now.Add(permissionRequirement.Expiration),

signingCredentials: permissionRequirement.SigningCredentials

);

var encodedJwt = new JwtSecurityTokenHandler().WriteToken(jwt);

var response = new

{

Status = true ,

access_token = encodedJwt,

expires_in = permissionRequirement.Expiration.TotalMilliseconds,

token_type = "Bearer"

};

return response;

}

Permission.cs

/// <summary>

/// 用户或角色或其他凭据实体

/// </summary>

public class Permission

{

/// <summary>

/// 用户或角色或其他凭据名称

/// </summary>

public virtual string Name

{ get ; set ; }

/// <summary>

/// 请求Url

/// </summary>

public virtual string Url

{ get ; set ; }

}

　　PermissionRequirement.cs

/// <summary>

/// 必要参数类

/// </summary>

public class PermissionRequirement : IAuthorizationRequirement

{

/// <summary>

/// 用户权限集合

/// </summary>

public List<Permission> Permissions { get ; private set ; }

/// <summary>

/// 无权限action

/// </summary>

public string DeniedAction { get ; set ; }

/// <summary>

/// 认证授权类型

/// </summary>

public string ClaimType { internal get ; set ; }

/// <summary>

/// 请求路径

/// </summary>

public string LoginPath { get ; set ; } = "/Api/Login" ;

/// <summary>

/// 发行人

/// </summary>

public string Issuer { get ; set ; }

/// <summary>

/// 订阅人

/// </summary>

public string Audience { get ; set ; }

/// <summary>

/// 过期时间

/// </summary>

public TimeSpan Expiration { get ; set ; } = TimeSpan.FromMinutes(5000);

/// <summary>

/// 签名验证

/// </summary>

public SigningCredentials SigningCredentials { get ; set ; }

/// <summary>

/// 构造

/// </summary>

/// <param name="deniedAction">无权限action</param>

/// <param name="userPermissions">用户权限集合</param>

/// <summary>

/// 构造

/// </summary>

/// <param name="deniedAction">拒约请求的url</param>

/// <param name="permissions">权限集合</param>

/// <param name="claimType">声明类型</param>

/// <param name="issuer">发行人</param>

/// <param name="audience">订阅人</param>

/// <param name="signingCredentials">签名验证实体</param>

public PermissionRequirement( string deniedAction, List<Permission> permissions, string claimType, string issuer, string audience, SigningCredentials signingCredentials)

{

ClaimType = claimType;

DeniedAction = deniedAction;

Permissions = permissions;

Issuer = issuer;

Audience = audience;

SigningCredentials = signingCredentials;

}

　自定义策略类PermissionHandler.cs

/// <summary>

/// 权限授权Handler

/// </summary>

public class PermissionHandler : AuthorizationHandler<PermissionRequirement>

{

/// <summary>

/// 验证方案提供对象

/// </summary>

public IAuthenticationSchemeProvider Schemes { get ; set ; }

/// <summary>

/// 自定义策略参数

/// </summary>

public PermissionRequirement Requirement

{ get ; set ; }

/// <summary>

/// 构造

/// </summary>

/// <param name="schemes"></param>

public PermissionHandler(IAuthenticationSchemeProvider schemes)

{

Schemes = schemes;

}

protected override async Task HandleRequirementAsync(AuthorizationHandlerContext context, PermissionRequirement requirement)

{

赋值用户权限

Requirement = requirement;

//从AuthorizationHandlerContext转成HttpContext，以便取出表求信息

var httpContext = (context.Resource as Microsoft.AspNetCore.Mvc.Filters.AuthorizationFilterContext).HttpContext;

//请求Url

var questUrl = httpContext.Request.Path.Value.ToLower();

//判断请求是否停止

var handlers = httpContext.RequestServices.GetRequiredService<IAuthenticationHandlerProvider>();

foreach ( var scheme in await Schemes.GetRequestHandlerSchemesAsync())

{

var handler = await handlers.GetHandlerAsync(httpContext, scheme.Name) as IAuthenticationRequestHandler;

if (handler != null && await handler.HandleRequestAsync())

{

context.Fail();

return ;

}

//判断请求是否拥有凭据，即有没有登录

var defaultAuthenticate = await Schemes.GetDefaultAuthenticateSchemeAsync();

if (defaultAuthenticate != null )

{

var result = await httpContext.AuthenticateAsync(defaultAuthenticate.Name);

//result?.Principal不为空即登录成功

if (result?.Principal != null )

{

httpContext.User = result.Principal;

//权限中是否存在请求的url

if (Requirement.Permissions.GroupBy(g => g.Url).Where(w => w.Key.ToLower() == questUrl).Count() > 0)

{

var name = httpContext.User.Claims.SingleOrDefault(s => s.Type == requirement.ClaimType).Value;

//验证权限

if (Requirement.Permissions.Where(w => w.Name == name && w.Url.ToLower() == questUrl).Count() <= 0)

{

//无权限跳转到拒绝页面

httpContext.Response.Redirect(requirement.DeniedAction);

}

context.Succeed(requirement);

return ;

}

//判断没有登录时，是否访问登录的url,并且是Post请求，并助是form表单提交类型，否则为失败

if (!questUrl.Equals(Requirement.LoginPath.ToLower(), StringComparison.Ordinal) && (!httpContext.Request.Method.Equals( "POST" )

|| !httpContext.Request.HasFormContentType))

{

context.Fail();

return ;

}

context.Succeed(requirement);

}

新建asp.net core 2.0的web api项目，并在项目添加AuthorizePolicy.JWT如图

先设置配置文件，用户可以定义密匙和发生人，订阅人

"Audience": {

"Secret": "ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890",

"Issuer": "gsw",

"Audience": "everone"

}

在ConfigureServices中注入验证（Authentication），授权（Authorization），和JWT(JwtBearer)

Startup.cs

public void ConfigureServices(IServiceCollection services)

{

//读取配置文件

var audienceConfig = Configuration.GetSection( "Audience" );

var symmetricKeyAsBase64 = audienceConfig[ "Secret" ];

var keyByteArray = Encoding.ASCII.GetBytes(symmetricKeyAsBase64);

var signingKey = new SymmetricSecurityKey(keyByteArray);

var tokenValidationParameters = new TokenValidationParameters

{

ValidateIssuerSigningKey = true ,

IssuerSigningKey = signingKey,

ValidateIssuer = true ,

ValidIssuer = audienceConfig[ "Issuer" ],

ValidateAudience = true ,

ValidAudience = audienceConfig[ "Audience" ],

ValidateLifetime = true ,

ClockSkew = TimeSpan.Zero

};

var signingCredentials = new SigningCredentials(signingKey, SecurityAlgorithms.HmacSha256);

services.AddAuthorization(options =>

{

//这个集合模拟用户权限表,可从数据库中查询出来

var permission = new List<Permission> {

new Permission { Url= "/" , Name= "admin" },

new Permission { Url= "/api/values" , Name= "admin" },

new Permission { Url= "/" , Name= "system" },

new Permission { Url= "/api/values1" , Name= "system" }

};

//如果第三个参数，是ClaimTypes.Role，上面集合的每个元素的Name为角色名称，如果ClaimTypes.Name，即上面集合的每个元素的Name为用户名

var permissionRequirement = new PermissionRequirement( "/api/denied" , permission, ClaimTypes.Role, audienceConfig[ "Issuer" ], audienceConfig[ "Audience" ], signingCredentials);

options.AddPolicy( "Permission" ,

policy => policy.Requirements.Add(permissionRequirement));

}).AddAuthentication(options =>

{

options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;

options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;

})

.AddJwtBearer(o =>

{

//不使用https

o.RequireHttpsMetadata = false ;

o.TokenValidationParameters = tokenValidationParameters;

});

//注入授权Handler

services.AddSingleton<IAuthorizationHandler, PermissionHandler>();

services.AddMvc();

}

在需要授的Controller上添加授权特性

[Authorize("Permission")]

PermissionController类有两个方法，一个是登录，验证用户名和密码是否正确，如果正确就发放Token，如果失败，验证失败，别一个成功登后的无权限导航action。

[Authorize( "Permission" )]

public class PermissionController : Controller

{

/// <summary>

/// 自定义策略参数

/// </summary>

PermissionRequirement _requirement;

public PermissionController(IAuthorizationHandler authorizationHander)

{

_requirement = (authorizationHander as PermissionHandler).Requirement;

}

[AllowAnonymous]

[HttpPost( "/api/login" )]

public IActionResult Login( string username, string password, string role)

{

var isValidated = username == "gsw" && password == "111111" ;

if (!isValidated)

{

return new JsonResult( new

{

Status = false ,

Message = "认证失败"

});

}

else

{

//如果是基于角色的授权策略，这里要添加用户;如果是基于角色的授权策略，这里要添加角色

var claims = new Claim[]{ new Claim(ClaimTypes.Name, username), new Claim(ClaimTypes.Role, role) };

//用户标识

var identity = new ClaimsIdentity(JwtBearerDefaults.AuthenticationScheme);

identity.AddClaims(claims);

//登录

HttpContext.SignInAsync(JwtBearerDefaults.AuthenticationScheme, new ClaimsPrincipal(identity));

var token = JwtToken.BuildJwtToken(claims, _requirement);

return new JsonResult(token);

}

[AllowAnonymous]

[HttpGet( "/api/denied" )]

public IActionResult Denied()

{

return new JsonResult( new

{

Status = false ,

Message = "你无权限访问"

});

}

下面定义一个控制台（.NetFramewrok）程序，用RestSharp来访问我们定义的web api，其中1为admin角色登录，2为system角色登录，3为错误用户密码登录，4是一个查询功能，在startup.cs中，admin角色是具有查询/api/values的权限的，所以用admin登录是能正常访问的，用system登录，能成功登录，但没有权限访问/api/values，用户名密码错误，访问/aip/values，直接是没有授权的

class Program

{

/// <summary>

/// 访问Url

/// </summary>

static string _url = "http://localhost:39286" ;

static void Main( string [] args)

{

dynamic token = null ;

while ( true )

{

Console.WriteLine( "1、登录【admin】 2、登录【system】 3、登录【错误用户名密码】 4、查询数据 " );

var mark = Console.ReadLine();

var stopwatch = new Stopwatch();

stopwatch.Start();

switch (mark)

{

case "1" :

token = AdminLogin();

break ;

case "2" :

token = SystemLogin();

break ;

case "3" :

token = NullLogin();

break ;

case "4" :

AdminInvock(token);

break ;

}

stopwatch.Stop();

TimeSpan timespan = stopwatch.Elapsed;

Console.WriteLine($ "间隔时间：{timespan.TotalSeconds}" );

}

static dynamic NullLogin()

{

var loginClient = new RestClient(_url);

var loginRequest = new RestRequest( "/api/login" , Method.POST);

loginRequest.AddParameter( "username" , "gswaa" );

loginRequest.AddParameter( "password" , "111111" );

//或用用户名密码查询对应角色

loginRequest.AddParameter( "role" , "system" );

IRestResponse loginResponse = loginClient.Execute(loginRequest);

var loginContent = loginResponse.Content;

Console.WriteLine(loginContent);

return Newtonsoft.Json.JsonConvert.DeserializeObject(loginContent);

}

static dynamic SystemLogin()

{

var loginClient = new RestClient(_url);

var loginRequest = new RestRequest( "/api/login" , Method.POST);

loginRequest.AddParameter( "username" , "gsw" );

loginRequest.AddParameter( "password" , "111111" );

//或用用户名密码查询对应角色

loginRequest.AddParameter( "role" , "system" );

IRestResponse loginResponse = loginClient.Execute(loginRequest);

var loginContent = loginResponse.Content;

Console.WriteLine(loginContent);

return Newtonsoft.Json.JsonConvert.DeserializeObject(loginContent);

}

static dynamic AdminLogin()

{

var loginClient = new RestClient(_url);

var loginRequest = new RestRequest( "/api/login" , Method.POST);

loginRequest.AddParameter( "username" , "gsw" );

loginRequest.AddParameter( "password" , "111111" );

//或用用户名密码查询对应角色

loginRequest.AddParameter( "role" , "admin" );

IRestResponse loginResponse = loginClient.Execute(loginRequest);

var loginContent = loginResponse.Content;

Console.WriteLine(loginContent);

return Newtonsoft.Json.JsonConvert.DeserializeObject(loginContent);

}

static void AdminInvock(dynamic token)

{

var client = new RestClient(_url);

//这里要在获取的令牌字符串前加Bearer

string tk = "Bearer " + Convert.ToString(token?.access_token);

client.AddDefaultHeader( "Authorization" , tk);

var request = new RestRequest( "/api/values" , Method.GET);

IRestResponse response = client.Execute(request);

var content = response.Content;

Console.WriteLine($ "状态：{response.StatusCode} 返回结果：{content}" );

}

运行结果：

源码：https://github.com/axzxs2001/AuthorizePolicy.JWT

原文地址：http://www.cnblogs.com/axzxs2001/p/7530929.html

.NET社区新闻，深度好文，微信中搜索dotNET跨平台或扫描二维码关注

asp.net core 2.0 web api基于JWT自定义策略授权相关推荐

【转载】从头编写 asp.net core 2.0 web api 基础框架 (1)
工具: 1.Visual Studio 2017 V15.3.5+ 2.Postman (Chrome的App) 3.Chrome (最好是) 关于.net core或者.net core 2.0的相 ...
从头编写 asp.net core 2.0 web api 基础框架 (1)
工具: 1.Visual Studio 2017 V15.3.5+ 2.Postman (Chrome的App) 3.Chrome (最好是) 关于.net core或者.net core 2.0的相 ...
ASP.NET Core 5.0 Web API 自动集成Swashbuckle
ASP.NET Core 5.0 Web API与开放源代码项目 Swashbuckle.AspNetCore 的维护人员合作,ASP.NET Core API 模板包含对 Swashbuckle 的 ...
从头编写 asp.net core 2.0 web api 基础框架 (2)
上一篇是: 从头编写 asp.net core 2.0 web api 基础框架 (1) Github源码地址是: https://github.com/solenovex/Building-asp. ...
asp.net core 2.0 web api + Identity Server 4 + angular 5 可运行前后台源码
前台使用angular 5, 后台是asp.net core 2.0 web api + identity server 4. 从头编写asp.net core 2.0 web api 基础框架: 第 ...
从头编写 asp.net core 2.0 web api 基础框架 (4) EF配置
第一部分: https://www.cnblogs.com/frank0812/p/11165940.html 第二部分:https://www.cnblogs.com/frank0812/p/111 ...
ASP.NET Core 2.0 Web API项目升级到ASP.NET Core 3.0概要笔记
本文结构先决条件升级目标框架(Target Framework)的版本过时的IHostingEnvironment与IApplicationLifetime对象 Endpoint Routing ...
用VSCode开发一个asp.net core2.0+angular5项目(5): Angular5+asp.net core 2.0 web api文件上传...
第一部分: http://www.cnblogs.com/cgzl/p/8478993.html 第二部分: http://www.cnblogs.com/cgzl/p/8481825.html 第三 ...
从头编写 asp.net core 2.0 web api 基础框架 (5) EF CRUD
第1部分:http://www.cnblogs.com/cgzl/p/7637250.html 第2部分:http://www.cnblogs.com/cgzl/p/7640077.html 第3部分 ...

asp.net core 2.0 web api基于JWT自定义策略授权

asp.net core 2.0 web api基于JWT自定义策略授权相关推荐

最新文章

热门文章