下面是一个使用ASP.NET Core身份验证与JWT的代码示例:
public void ConfigureServices(IServiceCollection services)
{
// 配置JWT身份验证
var jwtSettings = Configuration.GetSection("JwtSettings");
var key = Encoding.ASCII.GetBytes(jwtSettings.GetValue("SecretKey"));
services.AddAuthentication(options =>
{
options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddJwtBearer(options =>
{
options.RequireHttpsMetadata = false;
options.SaveToken = true;
options.TokenValidationParameters = new TokenValidationParameters
{
ValidateIssuerSigningKey = true,
IssuerSigningKey = new SymmetricSecurityKey(key),
ValidateIssuer = false,
ValidateAudience = false
};
});
services.AddControllers();
}
public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
// 省略其他配置...
app.UseAuthentication();
app.UseRouting();
app.UseAuthorization();
app.UseEndpoints(endpoints =>
{
endpoints.MapControllers();
});
}
[ApiController]
[Route("[controller]")]
public class AuthController : ControllerBase
{
private readonly IConfiguration _configuration;
public AuthController(IConfiguration configuration)
{
_configuration = configuration;
}
[HttpPost("login")]
public IActionResult Login(LoginModel model)
{
// 从数据库或其他地方验证用户凭据,如果验证成功则生成JWT Token
if (IsValidUser(model.Username, model.Password))
{
var token = GenerateJwtToken();
return Ok(new { token });
}
return Unauthorized();
}
private bool IsValidUser(string username, string password)
{
// 验证用户凭据的逻辑
}
private string GenerateJwtToken()
{
var jwtSettings = _configuration.GetSection("JwtSettings");
var key = Encoding.ASCII.GetBytes(jwtSettings.GetValue("SecretKey"));
var tokenHandler = new JwtSecurityTokenHandler();
var tokenDescriptor = new SecurityTokenDescriptor
{
Expires = DateTime.UtcNow.AddHours(1),
SigningCredentials = new SigningCredentials(new SymmetricSecurityKey(key), SecurityAlgorithms.HmacSha256Signature)
};
var token = tokenHandler.CreateToken(tokenDescriptor);
return tokenHandler.WriteToken(token);
}
}
"JwtSettings": {
"SecretKey": "your-secret-key"
}
以上代码示例演示了使用ASP.NET Core身份验证与JWT的基本原理。你可以根据自己的需求进行进一步调整和扩展。