asp.net core webapi实现jwt授权认证

Asp.net core WebApi实现JWT授权。首先在Start. cs启动类中，配置服务，代码如下：

//配置授权
services.AddAuthentication(options =>
{
options.DefaultAuthenticateScheme = "JwtBearer";
options.DefaultChallengeScheme = "JwtBearer";

}).AddJwtBearer("JwtBearer",
(jwtBearerOptions) =>
{
jwtBearerOptions.TokenValidationParameters = new TokenValidationParameters
{
ValidateIssuerSigningKey = true,
IssuerSigningKey = new SymmetricSecurityKey(System.Text.Encoding.UTF8.GetBytes(Configuration["JwtSecurityKey"])),//秘钥
ValidateIssuer = true,
ValidIssuer = Configuration["issuer"],
ValidateAudience = true,
ValidAudience = Configuration["audience"],
ValidateLifetime = true,
ClockSkew = TimeSpan.FromMinutes(5)
};
});

在这里，我创建了一个OAuthController控制器，新建一个Token action,用来获取token,具体代码如下：

/// <summary>
///
/// </summary>
/// <returns></returns>
[HttpPost]
public string Token(string user, string password)
{

//验证用户名和密码
var claims = new Claim[] { new Claim(ClaimTypes.Name, "John"), new Claim(JwtRegisteredClaimNames.Email, "john.doe@blinkingcaret.com") };

var key = new SymmetricSecurityKey(System.Text.Encoding.UTF8.GetBytes(Configuration["JwtSecurityKey"]));
var token = new JwtSecurityToken(
issuer: Configuration["issuer"],
audience: Configuration["audience"],
claims: claims,
notBefore: DateTime.Now,
expires: DateTime.Now.AddDays(28),
signingCredentials: new SigningCredentials(key, SecurityAlgorithms.HmacSha256));

string jwtToken = new JwtSecurityTokenHandler().WriteToken(token);//生成Token
return jwtToken;
}

然后，我们再ValuesController中， 添加 [Authorize]特性，要求授权终端才能访问。

接下来，我们通过JS实现领取的获取及数据的获取，具体代码如下：

<script type="text/javascript">
//获取令牌
$.post("/oauth/token", $.param({ user: "lichaoqiang", password: "fdsfds" })).done(function (token) {
localStorage.setItem("token", token);
});

//设置HTTP头
$.ajaxSetup({
beforeSend: function (xhr) {
if (localStorage.getItem("token") !== null) {
xhr.setRequestHeader('Authorization', 'Bearer ' + localStorage.getItem("token"));
}
}
});
$.getJSON("/api/values", function (data) { console.log(data); });
</script>

当客户请求受保护的资源时，通过HTTP header携带上token。这里需要注意的是，请求头必须是Authorization，值是Bearer空格加上token。这样访问资源时，通过HTTP header携带令牌信息，服务端，通过认证中间件，完成授权认证过程。在上面的示例中，通过向全局Ajax注册事件，将token写入请求Header。、