ASP.NET Core JWT认证与授权
1.JWT结构
JSON Web Token（JWT）是一种用于在网络应用之间安全传输声明的开放标准（RFC 7519）。它通常由三部分组成，以紧凑的字符串形式表示，在身份验证、信息交换等场景中广泛应用。
2.JWT权限认证
2.1添加认证服务类
在Program类中添加认证服务、Jwt处理类以及JWT配置项。
// 配置 JWT 身份验证
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme).AddJwtBearer(options =>{options.TokenValidationParameters = new TokenValidationParameters{ValidateIssuer = true,ValidateAudience = true,ValidateLifetime = true,ValidateIssuerSigningKey = true,ValidIssuer = builder.Configuration["JwtOptions:Issuer"],ValidAudience = builder.Configuration["JwtOptions:Audience"],IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(builder.Configuration["JwtOptions:SecurityKey"]))};});
2.2配置认证中间件
当前端发送请求到后端时，会通过Authentication中间件解析前端发送过来的Bearer,并把解析的数据填充到HttpContext.User中。
app.UseAuthentication();
2.3生成Token
public string IssueToken(){var signinCredentials = new SigningCredentials(new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwtOptions.SecurityKey)), SecurityAlgorithms.HmacSha256);var cls = new List<Claim>(){new Claim(ClaimTypes.Name, "admin"),new Claim("org", "001")};var tokeOptions = new JwtSecurityToken(issuer: jwtOptions.Issuer,audience: jwtOptions.Audience,claims: cls,expires: DateTime.UtcNow.AddSeconds(6400),signingCredentials: signinCredentials);var token = new JwtSecurityTokenHandler().WriteToken(tokeOptions);return token;}
2.4 appsettings中jwt配置
"JwtOptions": {"Issuer": "http://localhost","Audience": "http://localhost","Expires": 3600,"SecurityKey": "ThisIsASecretKeyThatIsAtLeast32BytesLongForHS256Algorithm"
}
配置项注入
builder.Services.Configure<JwtOptions>(builder.Configuration.GetSection("JwtOptions"));
2.5 获取认证信息
如果验证成功，就可以从HttContext.User中获取到相关信息。如：HttpContext.User.Identity.IsAuthenticated、HttpContext.User.Identity.Name等。
var user = HttpContext.User;
3.Authentication源代码分析
3.1 JWT认证主要涉及以下类
3.2 业务流程
3.3 业务分析
- 执行AddJwtBearer(options =>{…})方法，往AuthenticationOptions添加AuthenticationSchemeBuilder。
- 执行AuthenticationMiddleware时，先注入IAuthenticationSchemeProvider对象，IAuthenticationSchemeProvider会通过注入AuthenticationOptions,生成AuthenticationScheme列表。
- 遍历AuthenticationScheme列表，通过IAuthenticationHandlerProvider对象构建IAuthenicationRequestHandler实例。(IAuthenticationHandlerProvider通过注入IAuthenticationSchemeProvider对象，根据scheme名称找到AuthneticationScheme实例，再找到HandlerType,根据HandlerType生成实例)。
- 调用JwtBearerHandler解析Bearder，只要有一个Handler处理成功，就结束。
4.授权
4.1授权配置
可以通过配置[Authorize]特性，使得方法的调用必须验证授权。
- [Authorize]不带任何参数，只验证用户是否登录
[Authorize]
public IActionResult Privacy()
- [Authorize(Roles =“admin”)]配置角色，验证用户是否属于要求的角色。角色是或者的关系，只需要满足一个就验证通过。
[Authorize(Roles ="admin,operate")]
public IActionResult Privacy()
- 自定义配置策略
[Authorize("MinimumAgePolicy")]
public string Test()
// 添加验证策略，策略是且的关系，必须全部满足才验证通过builder.Services.AddAuthorization(options =>{options.AddPolicy("MinimumAgePolicy", policy => policy.Requirements.Add(new MinimumAgeRequirement(18)));});public class MinimumAgeHandler : AuthorizationHandler<MinimumAgeRequirement>{protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, MinimumAgeRequirement requirement){if (context.User.HasClaim(c => c.Type == ClaimTypes.DateOfBirth)){var dateOfBirth = Convert.ToDateTime(context.User.FindFirst(c => c.Type == ClaimTypes.DateOfBirth).Value);var age = DateTime.Today.Year - dateOfBirth.Year;if (dateOfBirth > DateTime.Today.AddYears(-age)){age--;}if (age >= requirement.MinimumAge){context.Succeed(requirement);}}return Task.CompletedTask;}}public class MinimumAgeRequirement : IAuthorizationRequirement{public int MinimumAge { get; set; }public MinimumAgeRequirement(int minimumAge){MinimumAge = minimumAge;}}
5. Authorization源码分析
5.1类图
5.2代码分析
以下代码在AuthorizationOptions类中添加AuthorizationPolicy,每个AuthorizationPolicy包含多个IAuthorizationRequirement。每个IAuthorizationRequirement代表一个验证项。
builder.Services.AddAuthorization(options =>{options.AddPolicy("MinimumAgePolicy", policy => policy.Requirements.Add(new MinimumAgeRequirement(18)));});
-
注入中间件AuthorizationMiddleware，当请求到达时，中间件会获取当前EndPoint信息(IAuthorizeData),如根据[Authorize(“MinimumAgePolicy”)]获取AuthorizationPolicy。
-
获取AuthorizationPolicy会判断是否有配置Roles,如果有配置，则会在Policy对象中添加RolesAuthorizationRequirement对象。(policy = await AuthorizationPolicy.CombineAsync(_policyProvider, authorizeData, policies)😉
-
调用DefaultAuthorizationService,验证AuthorizationPolicy。
-
DefaultAuthorizationService会获取所有注入的IAuthorizationHandler，遍历所有的Handler，根据Handler所要求的Requirement，从AuthorizationPolicy中获取实例传入Handler中。Handler验证成功，会删除对应的Requirement。所有Requirement都删除了才算验证成功。
app.UseAuthorization();
针对系统自带Requirement,比如配置Roles添加RolesAuthorizationRequirement对象。在AddAuthorization->AddAuthorizationCore中会注入PassThroughAuthorizationHandler。该Handler会遍历系统自带的Requirement(系统自带的Requirement会继承AuthorizationHandler并实现IAuthorizationRequirement)，直接调用HandleAsync方法。
services.TryAddEnumerable(ServiceDescriptor.Transient<IAuthorizationHandler, PassThroughAuthorizationHandler>());