.Net Core官方JWT授权验证的全过程

{
 "alg": "HS256",
 "typ": "JWT"
}

HMACSHA256(
 base64UrlEncode(header) + "." +
 base64UrlEncode(payload),
 secret)

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.
eyJpc3MiOiJodHRwOi8vbG9jYWxob3N0OjUyMDAiLCJhdWQiOlsiYXBpIiwiYXBpIl0sIkd1aWQiOiIzM2NhZmJkNS1jZWEyLTRjOWMtYWZlYS01MDYyZjM3YWUyOTAiLCJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dzLzIwMDgvMDYvaWRlbnRpdHkvY2xhaW1zL3JvbGUiOlsic3lzdGVtIiwiYWRtaW4iXSwiZXhwIjoxNjA2NjU2NjI0fQ.
JvDHuowbOnWiyxMIFc9gG5rw1LSSc0xx68L31oRfxS0

Authorization: Bearer <token>

 "Jwt": {
 "Secret": "your-256-bit-secret",
 "Iss": "https://localhost:44355",
 "Aud": "api"
 }

var jwtConfig = Configuration.GetSection("Jwt");
//生成密钥
var symmetricKeyAsBase64 = jwtConfig.GetValue<string>("Secret");
var keyByteArray = Encoding.ASCII.GetBytes(symmetricKeyAsBase64);
var signingKey = new SymmetricSecurityKey(keyByteArray);
//认证参数
services.AddAuthentication("Bearer")
 .AddJwtBearer(o =>
 {
  o.TokenValidationParameters = new TokenValidationParameters
  {
   ValidateIssuerSigningKey = true,//是否验证签名,不验证的画可以篡改数据，不安全
   IssuerSigningKey = signingKey,//解密的密钥
   ValidateIssuer = true,//是否验证发行人，就是验证载荷中的Iss是否对应ValidIssuer参数
   ValidIssuer = jwtConfig.GetValue<string>("Iss"),//发行人
   ValidateAudience = true,//是否验证订阅人，就是验证载荷中的Aud是否对应ValidAudience参数
   ValidAudience = jwtConfig.GetValue<string>("Aud"),//订阅人
   ValidateLifetime = true,//是否验证过期时间，过期了就拒绝访问
   ClockSkew = TimeSpan.Zero,//这个是缓冲过期时间，也就是说，即使我们配置了过期时间，这里也要考虑进去，过期时间+缓冲，默认好像是7分钟，你可以直接设置为0
   RequireExpirationTime = true,
  };
 });

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
 if (env.IsDevelopment()){app.UseDeveloperExceptionPage();}
 app.UseHttpsRedirection();
 app.UseRouting();
 app.UseAuthentication();
 app.UseAuthorization();
 app.UseEndpoints(endpoints =>{ endpoints.MapControllers();});
}

[HttpPost]
public IActionResult Authenticate()
{
 var jwtConfig = Configuration.GetSection("Jwt");
 //秘钥，就是标头，这里用Hmacsha256算法，需要256bit的密钥
 var securityKey = new SigningCredentials(new SymmetricSecurityKey(Encoding.ASCII.GetBytes(jwtConfig.GetValue<string>("Secret"))), SecurityAlgorithms.HmacSha256);
 //Claim，JwtRegisteredClaimNames中预定义了好多种默认的参数名，也可以像下面的Guid一样自己定义键名.
 //ClaimTypes也预定义了好多类型如role、email、name。Role用于赋予权限，不同的角色可以访问不同的接口
 //相当于有效载荷
 var claims = new Claim[] {
    new Claim(JwtRegisteredClaimNames.Iss,jwtConfig.GetValue<string>("Iss")),
    new Claim(JwtRegisteredClaimNames.Aud,jwtConfig.GetValue<string>("Aud")),
    new Claim("Guid",Guid.NewGuid().ToString("D")),
    new Claim(ClaimTypes.Role,"system"),
    new Claim(ClaimTypes.Role,"admin"),
 };
 SecurityToken securityToken = new JwtSecurityToken(
  signingCredentials: securityKey,
  expires: DateTime.Now.AddMinutes(2),//过期时间
  claims: claims
 );
 //生成jwt令牌
 return Content(new JwtSecurityTokenHandler().WriteToken(securityToken));
}

[HttpGet]
[Authorize(Roles = "admin")]
[Authorize(Roles = "system")]
public IEnumerable<WeatherForecast> Get()
{
 var rng = new Random();
 return Enumerable.Range(1, 5).Select(index => new WeatherForecast
 {
  Date = DateTime.Now.AddDays(index),
  TemperatureC = rng.Next(-20, 55),
  Summary = Summaries[rng.Next(Summaries.Length)]
 })
 .ToArray();
}

services.AddAuthentication("Bearer")
 .AddJwtBearer(o =>
 {
  o.Events = new JwtBearerEvents()
  {
   OnMessageReceived = context =>
   {
    context.Token = context.Request.Query["access_token"];
    return Task.CompletedTask;
   },
   OnAuthenticationFailed = context =>
   {
    // 如果过期，则把<是否过期>添加到，返回头信息中
    if (context.Exception.GetType() == typeof(SecurityTokenExpiredException))
    {
     context.Response.Headers.Add("Token-Expired", "true");
    }
    return Task.CompletedTask;
   }
  };
 });