RuoVea.ExJwtBearer 6.0.11.1

RuoVea.ExJwtBearer

JWT扩展帮助类库

使用示例

注入 Jwt

添加Jwt验证

services.AddJwtAuthorization(enableGlobalAuthorize: true);

添加JWT及鉴权

services.AddJwtAuthorization<JwtHandler>(enableGlobalAuthorize: true);

添加JWT加密

services.AddJwtEncryption();

app添加

app.UseAuthentication();
app.UseAuthorization();

enableGlobalAuthorize=false时候可以只有验证;[Authorize(AuthenticationSchemes = "Bearer")]、[BearerAuthorize]

使用Jwt

声名 IJwtToken _jwtToken

_jwtToken.Encrypt(new Dictionary<string, object>)

登录时使用Jwt

使用方式一、

     // 生成Token令牌
     var accessToken =  LoginToken(UserVo user, Dictionary<string, object> extend);
    
     // 设置Swagger自动登录
     _httpContextAccessor.HttpContext.SigninToSwagger(accessToken);
    
     // 生成刷新Token令牌
     //var refreshToken = _jwtToken.GenerateRefreshToken(accessToken, 30);
    
     // 设置刷新Token令牌
     //_httpContextAccessor.HttpContext.Response.Headers["x-access-token"] = refreshToken;

使用方式二、

     // 生成Token令牌
     var accessToken = _jwtToken.Encrypt(new Dictionary<string, object>
     {
         {ClaimConst.CLAINM_USERID, user.Id},
         {ClaimConst.TENANT_ID, user.TenantId},
         {ClaimConst.CLAINM_ACCOUNT, user.Account},
         {ClaimConst.CLAINM_NAME, user.Name},
         {ClaimConst.CLAINM_SUPERADMIN, user.AdminType},
     });
    
     // 设置Swagger自动登录
     _httpContextAccessor.HttpContext.SigninToSwagger(accessToken);
    
     // 生成刷新Token令牌
     //var refreshToken = _jwtToken.GenerateRefreshToken(accessToken, 30);
    
     // 设置刷新Token令牌
     //_httpContextAccessor.HttpContext.Response.Headers["x-access-token"] = refreshToken;

配置文件

{
  /* Jwt配置 */
  "JWTSettings": {
    "ValidateIssuerSigningKey": true, // 是否验证密钥，bool 类型，默认true
    "IssuerSigningKey": "3c1cbc3f546eda35168c3aa3cb91780fbe703f0996c6d123ea96dc85c70bbc0a", // 密钥，string 类型，必须是复杂密钥，长度大于16
    "ValidateIssuer": true, // 是否验证签发方，bool 类型，默认true
    "ValidIssuer": "SecurityDemo.Authentication.JWT", // 签发方，string 类型
    "ValidateAudience": true, // 是否验证签收方，bool 类型，默认true
    "ValidAudience": "jwtAudience", // 签收方，string 类型
    "ValidateLifetime": true, // 是否验证过期时间，bool 类型，默认true，建议true
    "ExpiredTime": 1440, // 过期时间，long 类型，单位分钟，默认1440分钟(24小时)
    "ClockSkew": 5 // 过期时间容错值，long 类型，单位秒，默认5秒
  }
}

AppAuthorizeHandler 实现类

/// <summary>
/// 实现
/// </summary>
public class JwtHandler : AppAuthorizeHandler 
{
   protected override async Task HandleRequirementAsync(AuthorizationHandlerContext context, PolicyRequirement requirement)
   {
       //// 自动刷新 token
       //if (JWTEncryption.AutoRefreshToken(context, context.GetCurrentHttpContext()))
       //{
       //    await AuthorizeHandleAsync(context);
       //}

       // 判断是否授权
       var isAuthenticated = context.User.Identity.IsAuthenticated;
       if (isAuthenticated)
       {
           await AuthorizeHandleAsync(context);
       }
       else context.GetCurrentHttpContext()?.SignoutToSwagger();    // 退出Swagger登录
   }

   /// <summary>
   /// 授权处理
   /// </summary>
   /// <param name="context"></param>
   /// <returns></returns>
   protected async Task AuthorizeHandleAsync(AuthorizationHandlerContext context)
   {
       // 获取所有未成功验证的需求
       var pendingRequirements = context.PendingRequirements;

       // 获取 HttpContext 上下文
       var httpContext = context.GetCurrentHttpContext();

       // 调用子类管道
       // 此处已经自动验证 Jwt Token的有效性了，无需手动验证
       var pipeline = await CheckAuthorzieAsync(httpContext);
       if (pipeline)
       {
           Task.FromResult(true);
           // 通过授权验证
           foreach (var requirement in pendingRequirements)
           {
               // 验证策略管道
               var policyPipeline = await PolicyPipelineAsync(context, httpContext, requirement);
               if (policyPipeline) context.Succeed(requirement);
           }
       }
       else context.Fail();
   }

   /// <summary>
   /// 检查权限
   /// </summary>
   /// <param name="httpContext"></param>
   /// <returns></returns>
   private static async Task<bool> CheckAuthorzieAsync(DefaultHttpContext httpContext)
   {
       // 管理员跳过判断
       var userManager = App.GetService<IUserManager>();
       if (userManager.SuperAdmin) return true;

       // 路由名称
       var routeName = httpContext.Request.Path.Value.Substring(1).Replace("/", ":");

       var allPermission = await App.GetService<ISysMenuService>().GetAllPermission();

       if (!allPermission.Contains(routeName))
       {
           return true;
       }


       // 默认路由(获取登录用户信息)
       var defalutRoute = new List<string>()
       {
           "Auth:getLoginUser",
           "getLoginUser",
           "sysNotice:unread",
           "codeGenerate:InformationList",
           "sysFileInfo:uploadAvatar",
           "sysFileInfo:preview"
       };

       if (defalutRoute.Contains(routeName)) return true;

       // 获取用户权限集合（按钮或API接口）
       var permissionList = await App.GetService<ISysMenuService>().GetLoginPermissionList(userManager.UserId);

       // 检查授权
       return permissionList.Contains(routeName);
   }

   /// <summary>
   /// 策略验证管道
   /// </summary>
   /// <param name="context"></param>
   /// <param name="httpContext"></param>
   /// <param name="requirement"></param>
   /// <returns></returns>
   public virtual Task<bool> PolicyPipelineAsync(AuthorizationHandlerContext context, DefaultHttpContext httpContext, IAuthorizationRequirement requirement)
   {
       return Task.FromResult(true);
   }
}

总是遇到401问题添加如下代码

    app.UseAuthentication();
    app.UseAuthorization();