[TestMethod] public void TokenCustomerValidateTest() { Dictionary<string, object> payLoad = new Dictionary<string, object>(); payLoad.Add("sub", "rober"); payLoad.Add("jti", Guid.NewGuid().ToString()); payLoad.Add("nbf", null); payLoad.Add("exp", null); payLoad.Add("iss", "roberIssuer"); payLoad.Add("aud", "roberAudience"); payLoad.Add("age", 30); var encodeJwt = TokenContext.CreateToken(payLoad, 30); var result = TokenContext.Validate(encodeJwt, (load) => { var success = true; //验证是否包含aud 并等于 roberAudience success = success&& load["aud"]?.ToString() == "roberAudience"; //验证age>20等 int.TryParse(load["age"].ToString(), out int age); Assert.IsTrue(age > 30); //其他验证 jwt的标识 jti是否加入黑名单等 return success; }); Assert.IsTrue(result); }
如上面，我们可以把jwt中的payload解析出来，然后进行各种复杂的想要的验证；
其实，aspnet core中的基于角色，用户、策略，自定义策略的验证就相当这里的自定义验证，一下章将详细说明和对比，这里暂时不讲解
看完上面，是不是觉得jwt很简单就，主要就两部
创建jwt；
验证jwt；
完整代码如下：
/// <summary> /// Token上下文，负责token的创建和验证 /// </summary> public class TokenContext { /// <summary> /// 秘钥，可以从配置文件中获取 /// </summary> public static string securityKey = "GQDstclechengroberbojPOXOYg5MbeJ1XT0uFiwDVvVBrk"; /// <summary> /// 创建jwttoken,源码自定义 /// </summary> /// <param></param> /// <param></param> /// <returns></returns> public static string CreateToken(Dictionary<string, object> payLoad,int expiresMinute, Dictionary<string, object> header = null) { if (header == null) { header = new Dictionary<string, object>(new List<KeyValuePair<string, object>>() { new KeyValuePair<string, object>("alg", "HS256"), new KeyValuePair<string, object>("typ", "JWT") }); } //添加jwt可用时间（应该必须要的） var now = DateTime.UtcNow; payLoad["nbf"] = ToUnixEpochDate( now);//可用时间起始 payLoad["exp"] = ToUnixEpochDate(now.Add(TimeSpan.FromMinutes(expiresMinute)));//可用时间结束 var encodedHeader = Base64UrlEncoder.Encode(JsonConvert.SerializeObject(header)); var encodedPayload = Base64UrlEncoder.Encode(JsonConvert.SerializeObject(payLoad)); var hs256 = new HMACSHA256(Encoding.ASCII.GetBytes(securityKey)); var encodedSignature = Base64UrlEncoder.Encode(hs256.ComputeHash(Encoding.UTF8.GetBytes(string.Concat(encodedHeader, ".", encodedPayload)))); var encodedJwt = string.Concat(encodedHeader, ".", encodedPayload, ".", encodedSignature); return encodedJwt; } /// <summary> /// 创建jwtToken,采用微软内部方法，默认使用HS256加密，如果需要其他加密方式，请更改源码 /// 返回的结果和CreateToken一样 /// </summary> /// <param></param> /// <param>有效分钟</param> /// <returns></returns> public static string CreateTokenByHandler(Dictionary<string, object> payLoad, int expiresMinute) { var now = DateTime.UtcNow; // Specifically add the jti (random nonce), iat (issued timestamp), and sub (subject/user) claims. // You can add other claims here, if you want: var claims = new List<Claim>(); foreach (var key in payLoad.Keys) { var tempClaim = new Claim(key, payLoad[key]?.ToString()); claims.Add(tempClaim); } // Create the JWT and write it to a string var jwt = new JwtSecurityToken( issuer: null, audience: null, claims: claims, notBefore: now, expires: now.Add(TimeSpan.FromMinutes(expiresMinute)), signingCredentials: new SigningCredentials(new SymmetricSecurityKey(Encoding.ASCII.GetBytes(securityKey)), SecurityAlgorithms.HmacSha256)); var encodedJwt = new JwtSecurityTokenHandler().WriteToken(jwt); return encodedJwt; } /// <summary> /// 验证身份 验证签名的有效性, /// </summary> /// <param></param> /// <param>自定义各类验证； 是否包含那种申明，或者申明的值， </param> /// 例如：payLoad["aud"]?.ToString() == "roberAuddience"; /// 例如：验证是否过期 等 /// <returns></returns> public static bool Validate(string encodeJwt,Func<Dictionary<string,object>,bool> validatePayLoad) { var success = true; var jwtArr = encodeJwt.Split('.'); var header = JsonConvert.DeserializeObject<Dictionary<string, object>>(Base64UrlEncoder.Decode(jwtArr[0])); var payLoad = JsonConvert.DeserializeObject<Dictionary<string, object>>(Base64UrlEncoder.Decode(jwtArr[1])); var hs256 = new HMACSHA256(Encoding.ASCII.GetBytes(securityKey)); //首先验证签名是否正确（必须的） success = success && string.Equals(jwtArr[2], Base64UrlEncoder.Encode(hs256.ComputeHash(Encoding.UTF8.GetBytes(string.Concat(jwtArr[0], ".", jwtArr[1]))))); if (!success) { return success;//签名不正确直接返回 } //其次验证是否在有效期内（也应该必须） var now = ToUnixEpochDate(DateTime.UtcNow); success = success && (now >= long.Parse(payLoad["nbf"].ToString()) && now < long.Parse(payLoad["exp"].ToString())); //再其次 进行自定义的验证 success = success && validatePayLoad(payLoad); return success; } /// <summary> /// 获取jwt中的payLoad /// </summary> /// <param></param> /// <returns></returns> public static Dictionary<string ,object> GetPayLoad(string encodeJwt) { var jwtArr = encodeJwt.Split('.'); var payLoad = JsonConvert.DeserializeObject<Dictionary<string, object>>(Base64UrlEncoder.Decode(jwtArr[1])); return payLoad; } public static long ToUnixEpochDate(DateTime date) => (long)Math.Round((date.ToUniversalTime() - new DateTimeOffset(1970, 1, 1, 0, 0, 0, TimeSpan.Zero)).TotalSeconds); }
以上就是jwt的基本内容，它确实很简单，不要被aspnet core中的各种写法给搞晕了，只要是jwt相关的验证都是基于上面这些东西
下一章节将讲述：
在aspnet core中，自定义jwt管道验证；
在aspnet core中,自定义策略验证CommonAuthorizeHandler : AuthorizationHandler<CommonAuthorize>
自定义jwt逻辑验证和原生的角色，用户，策略，等进行对比
总结