可以在同一个.Net 6 WebAPI中使用API Key和JWT Token,但需要对API Key和JWT Token进行分别处理。下面是使用API Key和JWT Token的代码示例:
在Startup.cs中添加以下代码:
services.AddAuthentication(options =>
{
options.DefaultAuthenticateScheme = "APIKeyScheme";
options.DefaultChallengeScheme = "APIKeyScheme";
}).AddApiKeySupport(options => {});
services.AddAuthorization(options =>
{
options.AddPolicy("APIKeyPolicy", policy =>
policy.RequireAuthenticatedUser().Build());
});
app.UseAuthentication();
app.UseAuthorization();
// 自定义中间件处理API Key验证
app.UseMiddleware(Configuration.GetValue("APIKey"));
创建ApiKeyMiddleware.cs文件,添加以下代码:
public class ApiKeyMiddleware
{
private readonly RequestDelegate _next;
private readonly string _apiKey;
public ApiKeyMiddleware(RequestDelegate next, string apiKey)
{
_next = next;
_apiKey = apiKey;
}
public async Task InvokeAsync(HttpContext context)
{
if (!context.Request.Headers.TryGetValue("Authorization", out var token)
|| token.ToString() != _apiKey)
{
context.Response.StatusCode = (int)HttpStatusCode.Unauthorized;
await context.Response.WriteAsync("Invalid API Key");
return;
}
await _next(context);
}
}
在Startup.cs中添加以下代码:
services.AddAuthentication(options =>
{
options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
}).AddJwtBearer(options =>
{
options.TokenValidationParameters = new TokenValidationParameters
{
ValidIssuer = Configuration["Jwt:Issuer"],
ValidAudience = Configuration["Jwt:Audience"],
IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration["Jwt:Key"]))
};
});
services.AddAuthorization(options =>
{
options.AddPolicy("JwtPolicy", policy =>
policy.RequireAuthenticatedUser().Build());
});
app.UseAuthentication();
app.UseAuthorization();
在Controller的Action中添加[Authorize(Policy = "JwtPolicy")]属性,