.NET core 3.0如何使用Jwt保护api详解

header = '{"alg":"HS256","typ":"JWT"}'

payload = '{"loggedInAs":"admin","iat":1422779638}'//iat表示令牌生成的时间

key = 'secretkey' 
unsignedToken = encodeBase64(header) + '.' + encodeBase64(payload) 
signature = HMAC-SHA256(key, unsignedToken)

token = encodeBase64(header) + '.' + encodeBase64(payload) + '.' + encodeBase64(signature)

# token看起来像这样: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJsb2dnZWRJbkFzIjoiYWRtaW4iLCJpYXQiOjE0MjI3Nzk2Mzh9.gzSraSYS8EXBxLN_oWnFSRgCzcmJmMjLiuyu5CSpyHI

Authorization: Bearer eyJhbGci...<snip>...yu5CSpyHI

Microsoft.AspNetCore.Authentication.JwtBearer

services.AddAuthentication(options =>
   {
    options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
    options.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
   }).AddJwtBearer(options =>
   {
    options.SaveToken = true;
    options.RequireHttpsMetadata = false;
    options.TokenValidationParameters = new TokenValidationParameters()
    {
     ValidateIssuer = true,
     ValidateAudience = true,
     ValidAudience = "https://.blogs./chengtian",
     ValidIssuer = "https://.blogs./chengtian",
     IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("SecureKeySecureKeySecureKeySecureKeySecureKeySecureKey"))
    };
   });

 app.UseAuthentication();//认证中间件、

public class LoginInput
 {

  public string Username { get; set; }

  public string Password { get; set; }
 }

[Route("api/[controller]")]
 public class AuthenticateController : Controller
 {
  [HttpPost]
  [Route("login")]
  public IActionResult Login([FromBody]LoginInput input)
  {
   //从数据库验证用户名，密码 
   //验证通过 否则 返回Unauthorized

   //创建claim
   var authClaims = new[] {
    new Claim(JwtRegisteredClaimNames.Sub,input.Username),
    new Claim(JwtRegisteredClaimNames.Jti,Guid.NewGuid().ToString())
   };
   IdentityModelEventSource.ShowPII = true;
   //签名秘钥 可以放到json文件中
   var authSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("SecureKeySecureKeySecureKeySecureKeySecureKeySecureKey"));

   var token = new JwtSecurityToken(
     issuer: "https://.blogs./chengtian",
     audience: "https://.blogs./chengtian",
     expires: DateTime.Now.AddHours(2),
     claims: authClaims,
     signingCredentials: new SigningCredentials(authSigningKey, SecurityAlgorithms.HmacSha256)
     );

   //返回token和过期时间
   return Ok(new
   {
    token = new JwtSecurityTokenHandler().WriteToken(token),
    expiration = token.ValidTo
   });
  }
 }

 [Authorize]
 [ApiController]
 [Route("api/[controller]")]
 public class WeatherForecastController : ControllerBase