集成JWT权限认证

为什么要使用JWT,我们先来看看传统的身份校验方式
用户向服务器发送用户名和密码->服务器验证通过后，在当前session对话里保存用户登录信息，比如用户角色，用户名，登录时间等->服务器向用户返回一个session_id，写入用户的cookie->随后的用户每次发送请求都会将session_id传回服务器->服务器搜到session_id，找到前期保存的数据，由此得知用户的身份
这种模式的问题在于，扩展性不好，单机情况下没有问题，如果是服务器集群，要求session数据共享，每台服务器都能够读取session，如果session存储的节点挂了，那么整个服务都会瘫痪，体验相当不好，风险也很高,相比之下，JWT的实现方式是将用户信息存储在客户端，服务端不进行保存，每次请求都把令牌带上来校验用户的登录状态，这样服务器就变成了无状态的，服务器集群也很好扩展。

当用户需要访问带权限验证的API时，应该使用承载模式发送JWT，通常在Authorization标头，格式如下：
Authorization:Bearer <boken>

网站的功能简介
登录成功后将用户信息写入Claim对象生成token返回web端，写入cookie，当用户修改密码时，通过ajax调用Api接口在头部添加Authorization:Bearer <token>发送请求，authorize会验证token是否有效，如果失效则返回401，成功则进行密码修改的操作。

登录API

    /// <summary>
    /// 登录
    /// </summary>
    /// <param name="user"></param>
    /// <returns></returns>
    [HttpPost]
    [Route("Login")]
    public async Task<IActionResult> Login(UserDto user)
    {
        var result = new ResultInclusion();
        if (string.IsNullOrEmpty(user.UserName))
        {
            result.Code = -1;
            result.Msg = "请输入账号";
            return new JsonResult(result);
        }
        if (string.IsNullOrEmpty(user.Password))
        {
            result.Code = -1;
            result.Msg = "请输入密码";
            return new JsonResult(result);
        }
        //dto.LoginIP = ip.ToString();
        ////获取客户端浏览器信息
        //dto.Explorer = _httpContextAccessor.HttpContext.Request.Headers["User-Agent"].ToString();
        ////获取客户端浏览器信息
        //dto.ClientOS = HttpContextHelper.GetOsVersion(dto.Explorer);

        var usermodel = await _service.GetAsync(p=>p.UserName==user.UserName);
        if (usermodel != null)
        {
            if (usermodel.Password == GetMD5.Get_MD5(user.Password, "utf-8"))
            {
                var claims = new List<Claim>()
                {
                    new Claim(JwtRegisteredClaimNames.Nbf,$"{new DateTimeOffset(DateTime.Now).ToUnixTimeSeconds()}"),
                    new Claim(JwtRegisteredClaimNames.Exp,$"{new DateTimeOffset(DateTime.Now.AddMinutes(30)).ToUnixTimeSeconds()}"),
                    new Claim(ClaimTypes.Name,user.UserName)
                };
                 
                var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration["Jwt:SecretKey"]));
                var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
                var token = new JwtSecurityToken(
                    issuer:Configuration["Jwt:Domain"],
                    audience:Configuration["Jwt:Domain"],
                    claims:claims,
                    expires:DateTime.Now.AddMinutes(30),
                    signingCredentials:creds
                    );
              var accesstoken=  new JwtSecurityTokenHandler().WriteToken(token);
                result.Code = 0;
                result.Msg = "登录成功";
                result.Data = new
                {
                    username = user.UserName,
                    token =accesstoken
                };
                return new JsonResult(result);
            }
            else {
                result.Code = -1;
                result.Msg = "密码错误";
                return new JsonResult(result);
            }
        }
        else {
            result.Code = -1;
            result.Msg = "用户名不存在";
            return new JsonResult(result);
        }
    }

appsettings.json配置

  "Jwt": {
"SecretKey": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI2a2EJ7m872v0afyoSDJT2o1+SitIeJSWtLJU8/Wz2m7gStexajkeD+Lka6DSTy8gt9UwfgVQo6uKjVLG5Ex7PiGOODVqAEghBuS7JzIYU5RvI543nNDAPfnJsas96mSA7L/mD7RTE2drj6hf3oZjJpMPZUQI/B1Qjb5H3K3PNwIDAQAB",
"Domain": "http://localhost:5001"

}

startup.cs ConfigureServices方法中添加JWT相关配置

            //添加权限认证+jwt认证
        services.AddAuthentication(b =>
        {
            b.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
            b.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
        })
            .AddJwtBearer(options => {
                options.TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
                {
                    ValidateIssuer = true,//是否验证Issuer
                    ValidateAudience = true,//是否验证Audience
                    ValidateLifetime = true,//是否验证失效时间
                    ClockSkew = TimeSpan.FromMilliseconds(30),
                    ValidateIssuerSigningKey = true,//是否验证SecurityKey
                    ValidAudience = Configuration["Jwt:Domain"],//Audience
                    ValidIssuer = Configuration["Jwt:Domain"],//Issuer，这两项和前面签发jwt的设置一致
                    IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration["Jwt:SecretKey"]))//拿到SecurityKey

                };
            });

Configure方法中添加权限过滤器

public void Configure(IApplicationBuilder app, IHostingEnvironment env)
    {
        app.UseAuthentication();

        app.UseMvc();
    }

Web端：用户登录成功后返回的token写进cookie

    <form class="form-signin form-group" id="AppForm">
    <h2 class="form-signin-heading">欢迎使用我的Blog</h2>
    <label for="inputEmail" >账号</label>
    <input type="text" id="username" name="username" class="form-control" placeholder="请输入账号" value="liulei" required autofocus>
    <label for="inputPassword" >密码</label>
    <input type="password" id="password" name="password" class="form-control" placeholder="请输入密码" value="123456" required>
    <button class="btn btn-lg btn-primary btn-block" id="loginForm" type="submit">登录</button>
    </form>      


                $.ajax({
                type: 'post',
                url: url + "/api/user/Login",
                data:JSON.stringify( { UserName: $("#username").val(), Password: $("#password").val() }),
                contentType:'application/json',
                success: function (data) {
                   //写入cookie
                    $.cookie("access_token", data.data.token, {
                        expires: new Date().getTime() + (30 * 60 * 1000)
                        , path: '/'
                    });
                   console.log(data);
                },
                error: function (xhr) {
                    $('button[type="submit"]').text('登录').removeAttr('disabled');
                },
                beforeSend: function (XHR) {
                    $('button[type="submit"]').text('登录中...').attr('disabled', 'disabled');
                },
                complete: function (XHR, TS) {
                    $('button[type="submit"]').text('登录').removeAttr('disabled');
                }
            });

修改密码

<form class="form-signin form-group" id="AppForm">
    <h2 class="form-signin-heading">修改密码</h2>
    <label for="inputEmail" >旧密码</label>
    <input type="password" id="oldpassword" name="oldpassword" class="form-control" placeholder="请输入旧密码" required>
    <label for="inputPassword" >新密码</label>
    <input type="password" id="newpassword" name="newpassword" class="form-control" placeholder="请输入新密码" required>

    <button class="btn btn-lg btn-primary btn-block" id="loginForm" type="submit">登录</button>
</form>      


      $.ajax({
                type: 'post',
                url: url + "/api/user/UpdatePWD",
                data: JSON.stringify({ OldPassWord: $("#oldpassword").val(), Password: $("#newpassword").val() }),
                contentType: 'application/json',
                beforeSend: function (XHR) {
                    XHR.setRequestHeader("Authorization", "bearer " + $.cookie("access_token"));
                },
               success: function (data) {
                   console.log(data);
                },
                error: function (xhr) {
                    $('button[type="submit"]').text('确定').removeAttr('disabled');
                },
                complete: function (XHR, TS) {
                    $('button[type="submit"]').text('确定').removeAttr('disabled');
                }
            });

修改密码API

    /// <summary>
    /// 修改密码
    /// </summary>
    /// <param name="user"></param>
    /// <returns></returns>
    [HttpPost]
    [Route("UpdatePWD")]
    [Authorize]
    public async Task<IActionResult> UpdatePWD(UserDto user) {
        var result = new ResultInclusion();
        //从claim中获取用户信息
        var schemeProvider = HttpContext.RequestServices.GetService(typeof(IAuthenticationSchemeProvider)) as IAuthenticationSchemeProvider;
        var defaultAuthenticate = await schemeProvider.GetDefaultAuthenticateSchemeAsync();
        if (defaultAuthenticate != null)
        {
            var JWTClaim = await HttpContext.AuthenticateAsync(defaultAuthenticate.Name);
            var ClaimUser = JWTClaim?.Principal;
            if (ClaimUser != null)
            {
                var userPassword = GetMD5.Get_MD5(user.OldPassWord, "utf-8");
                var userinfo = await _service.GetAsync(p => p.UserName == ClaimUser.Identity.Name);
                if (userinfo!=null&&userinfo.Password == userPassword)
                {
                    userinfo.Password = GetMD5.Get_MD5(user.Password, "utf-8");
                    result.Data = await _service.UpdateAsync(userinfo);
                    result.Code = 0;
                    result.Msg = "修改成功";
                }
                else
                {
                    result.Code = -1;
                    result.Msg = "旧密码不正确";
                }
            }
        }
        
        return new JsonResult(result);
    }

若未登录直接修改密码则返回401权限未通过：

image.png