JWT权限验证，兼容多方式验证

前言

　　许久没写博文了，整合下这段时间所学吧，前进路上总要停下来回顾下学习成果。

　　本篇记录下项目的权限验证，WebApi项目中用权限验证来保证接口安全总是需要的，然而权限验证的方式多种多样，博主在项目中使用的多的也就是JWT了，一般都是写完之后万年不动~~

　　所以，本篇算是对鉴权授权的回顾与总结

JWT

　　至于什么是JWT(https://jwt.io/)，只要不是小白都知道吧，不知道的去看下JWT的结构原理这些，偷偷补下课，JWT(JSON Web Token)名字可看出来这是Json格式的web凭证，也就是一个令牌，只有拿到这个Token才能访问到接口，否则请求接口之后会返回401HTTP状态码，401状态码表示未授权，而想要拿到服务器的Token，必须通过服务器验证，一般这个验证来自登录之后返回出来，如果是开发平台一般是通过AppId和Secrect来获取到Token，获取到Token后将Token添加到请求头中，服务器收到请求后，获取到请求头的Token后一验证，“诶！~是我发布的Token，通过！”，随后才能进入控制器。

引入

　　先把JWT引入到项目中来,目前最新版本为稳定版5.0.2

　　nuget : Microsoft.AspNetCore.Authentication.JwtBearer

　　

鉴权授权

　　首先要知道沃恩需要什么样的鉴权策略，在生成Token时的策略就必须保持一致。在WebApi中我们不知道是谁在访问服务器，当然想要知道还是可以的，这时可以通过Token将用户信息传到服务器，我们知道JWT的负载信息除了已经准备好的"sub"、"name"、"iat"这些信息，我们还能自定义我们需要的字段，比如登录人的UserId，UserName，AppId等……

　　首先需要一个接口  IAuthService

 public interface IAuthService
    {
        /// <summary>
        /// 判断权限
        /// </summary>
        /// <param name="token"></param>
        /// <param name="path"></param>
        /// <returns></returns>
        Task<bool> PermissionAsync(string token, string path);

        /// <summary>
        /// 获取用户
        /// </summary>
        /// <param name="token"></param>
        /// <returns></returns>
        Task SetUserAsync(string token);
    }

　　以后所有的权限类型都可以使用这个接口，先将JWT需要的类包装下，这样就能直接使用了

public static class JwtUtils
    {
        /// <summary>
        /// 生成token
        /// </summary>
        /// <param name="claims"></param>
        /// <returns></returns>
        public static string CreateToken(IEnumerable<Claim> claims, string securityKey)
        {
            var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(securityKey));
            var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha512);
            var securityToken = new JwtSecurityToken(
                issuer: null,
                audience: null,
                claims: claims,
                //expires: DateTime.Now.AddMinutes(settings.ExpMinutes),
                signingCredentials: creds);
            var token = new JwtSecurityTokenHandler().WriteToken(securityToken);
            return token;
        }

        /// <summary>
        /// 生成Jwt
        /// </summary>
        /// <param name="userName"></param>
        /// <param name="roleName"></param>
        /// <param name="userId"></param>
        /// <returns></returns>
        public static string GenerateToken(string userId, string securityKey)
        {
            //声明claim
            var claims = new Claim[] {
                new Claim(JwtRegisteredClaimNames.Typ,"JWT"),
                new Claim(JwtRegisteredClaimNames.Sub, userId),
                new Claim(JwtRegisteredClaimNames.Iat,DateTimeOffset.UtcNow.ToUnixTimeSeconds().ToString(),ClaimValueTypes.Integer64),
                new Claim(JwtRegisteredClaimNames.Exp, DateTimeOffset.UtcNow.AddMonths(2).ToUnixTimeSeconds().ToString(), ClaimValueTypes.Integer64), //过期时间
            };
            return CreateToken(claims, securityKey);
        }

        ///// <summary>
        ///// 刷新token
        ///// </summary>
        ///// <returns></returns>
        //public static string RefreshToken(string oldToken)
        //{
        //    var pl = GetPayload(oldToken);
        //    //声明claim
        //    var claims = new Claim[] {
        //        new Claim(JwtRegisteredClaimNames.Sub, pl?.UserName),
        //        new Claim(JwtRegisteredClaimNames.Jti, pl?.UserId),
        //        new Claim(JwtRegisteredClaimNames.Iat, DateTime.UtcNow.ToUnixDate().ToString(), ClaimValueTypes.Integer64),//签发时间
        //        new Claim(JwtRegisteredClaimNames.Nbf, DateTime.UtcNow.ToUnixDate().ToString(), ClaimValueTypes.Integer64),//生效时间
        //        new Claim(JwtRegisteredClaimNames.Exp, DateTime.Now.AddMinutes(settings.ExpMinutes).ToUnixDate().ToString(), ClaimValueTypes.Integer64), //过期时间
        //        new Claim(JwtRegisteredClaimNames.Iss, settings.Issuer),
        //        new Claim(JwtRegisteredClaimNames.Aud, settings.Audience),
        //        new Claim(ClaimTypes.Name, pl?.UserName),
        //        new Claim(ClaimTypes.Role, pl?.RoleId),
        //        new Claim(ClaimTypes.Sid, pl?.UserId)
        //    };

        //    return IsExp(oldToken) ? CreateToken(claims) : null;
        //}

        /// <summary>
        /// 从token中获取用户身份
        /// </summary>
        /// <param name="token"></param>
        /// <returns></returns>
        public static IEnumerable<Claim> GetClaims(string token)
        {
            var handler = new JwtSecurityTokenHandler();
            var securityToken = handler.ReadJwtToken(token);
            return securityToken?.Claims;
        }

        /// <summary>
        /// 从Token中获取用户身份
        /// </summary>
        /// <param name="token"></param>
        /// <param name="securityKey">securityKey明文,Java加密使用的是Base64</param>
        /// <returns></returns>
        public static ClaimsPrincipal GetPrincipal(string token, string securityKey)
        {
            try
            {
                var handler = new JwtSecurityTokenHandler();
                TokenValidationParameters tokenValidationParameters = new TokenValidationParameters
                {
                    ValidateAudience = false,
                    ValidateIssuer = false,
                    ValidateIssuerSigningKey = true,
                    IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(securityKey)),
                    ValidateLifetime = false
                };
                return handler.ValidateToken(token, tokenValidationParameters, out SecurityToken validatedToken);
            }
            catch (Exception ex)
            {

                return null;
            }
        }

        /// <summary>
        /// 校验Token
        /// </summary>
        /// <param name="token">token</param>
        /// <returns></returns>
        public static bool CheckToken(string token, string securityKey)
        {
            var principal = GetPrincipal(token, securityKey);
            if (principal is null)
            {
                return false;
            }
            return true;
        }

        /// <summary>
        /// 获取Token中的载荷数据
        /// </summary>
        /// <param name="token">token</param>
        /// <returns></returns>
        public static JwtPayload GetPayload(string token)
        {
            var jwtHandler = new JwtSecurityTokenHandler();
            JwtSecurityToken securityToken = jwtHandler.ReadJwtToken(token);
            return new JwtPayload
            {
                sub = securityToken.Payload[JwtRegisteredClaimNames.Sub]?.ToString(),
                exp = DateTimeOffset.FromUnixTimeSeconds(long.Parse(securityToken.Payload[JwtRegisteredClaimNames.Exp].ToString())).ToLocalTime().DateTime,
                iat = securityToken.Payload[JwtRegisteredClaimNames.Iat]?.ToString()
            };
        }

        /// <summary>
        /// 获取Token中的载荷数据
        /// </summary>
        /// <typeparam name="T">泛型</typeparam>
        /// <param name="token">token</param>
        /// <returns></returns>
        public static T GetPayload<T>(string token)
        {
            var jwtHandler = new JwtSecurityTokenHandler();
            JwtSecurityToken jwtToken = jwtHandler.ReadJwtToken(token);
            return JsonConvert.DeserializeObject<T>(jwtToken.Payload.SerializeToJson());
        }

        /// <summary>
        /// 判断token是否过期
        /// </summary>
        /// <param name="token"></param>
        /// <returns></returns>
        public static bool IsExp(string token)
        {
            return false;
            //return  GetPrincipal(token)?.Claims.First(c => c.Type == JwtRegisteredClaimNames.Exp)?.Value?.TimeStampToDate() < DateTime.Now;
            //return GetPayload(token).ExpTime < DateTime.Now;
        }
    }

    /// <summary>
    /// Jwt载荷信息
    /// </summary>
    public class JwtPayload
    {
        public string sub { get; set; }

        public string iat { get; set; }

        public DateTime exp { get; set; }
    }

　　JWT服务实现

　　

public class AuthSettings
    {
        public string Secret { get; set; }
        public string Issuer { get; set; }
        public double Expire { get; set; }
    }

public class AuthServiceImpl : IAuthService
    {
        private readonly AuthSettings _authSettings;
        private readonly LoginUser _currentUser;

        public AuthServiceImpl(IOptions<AuthSettings> authSettings, LoginUser currentUser)
        {
            _authSettings = authSettings.Value;
            _currentUser = currentUser;
        }
        public Task<bool> PermissionAsync(string token)
        {
            return Task.FromResult(JwtUntil.CheckToken(token, _authSettings.Secret));
        }

        public Task SetUserAsync(string token)
        {
            var payload = JwtUntil.GetPayload(token);
            _currentUser.UserId = payload.UserId;
            _currentUser.RoleType = payload.Role;
            return Task.CompletedTask;
        }
    }

　　

　　说到这还没有注册JWT，我们先注册到项目中，验证策略自己定，记得要先注入下服务

services.AddScoped<IAuthService, AuthServiceImpl>();

            services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
                .AddJwtBearer(x =>
                {
                    x.RequireHttpsMetadata = false;//元数据地址或权限是否需要https
                    x.SaveToken = true;//是否将存储信息保存在token中
                    x.TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
                    {
                        ValidateLifetime = true,//是否验证过期时间
                        LifetimeValidator = (notBefore, expire, securityToken, validationparameters) =>
                        {
                            bool t = DateTime.UtcNow < expire;
                            return t;
                        },
                        ValidateAudience = false,//是否验证被发布者

                        ValidateIssuer = true,//是否验证发布者
                        ValidIssuer = configuration["AuthSettings:Issuer"],

                        ValidateIssuerSigningKey = true,//是否验证签名
                        IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(configuration["AuthSettings:Secret"]))
                    };
                });

#region 授权鉴权
/授权
app.UseAuthentication();
//鉴权
app.UseAuthorization();
#endregion

　　接下来就是设置当前登录用户，获取当前登录用户：发布时在 claims中加入自定义的UserId等信息，授权时获取当前Token解析claims中用户信息属性即可获取到当前请求用户。

　　本项目中使用的是一个中间件

public sealed class LoginMiddlerware
    {
        private readonly RequestDelegate _next;

        public LoginMiddlerware(RequestDelegate next)
        {
            _next = next;
        }

        /// <summary>
        /// 设置登录用户
        /// </summary>
        /// <param name="context"></param>
        /// <param name="_authService"></param>
        /// <returns></returns>
        public async Task InvokeAsync(HttpContext context, IEnumerable<IAuthService> _authService)
        {
            string token = GetToken();
            if (!string.IsNullOrEmpty(token))
            {
                if (token.StartsWith("Bearer", StringComparison.OrdinalIgnoreCase) || token.Contains('.'))
                {
                    await _authService.First(a => a.ServiceName == nameof(JwtAuthServiceImpl)).SetUserAsync(token);
                }
                else if (token.StartsWith("App", StringComparison.OrdinalIgnoreCase))
                {
                    await _authService.First(a => a.ServiceName == nameof(AppAuthServiceImpl)).SetUserAsync(token);
                }
                else
                {
                    await _authService.First(a => a.ServiceName == nameof(OauthAuthServiceImpl)).SetUserAsync(token);
                }
            }
            await _next.Invoke(context);
            string GetToken()
            {
                string token = context.Request.Headers["token"];
                if (string.IsNullOrEmpty(token))
                {
                    token = context.Request.Query["token"];
                }
                return token;
            }
        }
    }

　　

　　到这里JWt就差不多讲完了，接下来是使用，使用时无非就是在控制器或方法上打上标记，如要同时兼容多种授权方式，可以自己写一个Attribute

/// <summary>
    /// 自定义授权验证特性
    /// </summary>
    public class RequiresPermissionsAttribute : TypeFilterAttribute
    {
        public RequiresPermissionsAttribute(ClaimType claimType, string claimValue = "") : base(typeof(ClaimRequirementFilter))
        {
            Arguments = new object[] { new Claim(claimType.ToString(), claimValue) };
        }
    }

    public class ClaimRequirementFilter : IAuthorizationFilter
    {
        readonly Claim _claim;
        readonly IEnumerable<IAuthService> _authService;
        private readonly WinkSignSettings _winkSignSettings;

        public ClaimRequirementFilter(Claim claim, IEnumerable<IAuthService> authService, IOptions<WinkSignSettings> winkSignSettings)
        {
            _claim = claim;
            _authService = authService;
            _winkSignSettings = winkSignSettings.Value;
        }

        public void OnAuthorization(AuthorizationFilterContext context)
        {
            ControllerActionDescriptor controllerActionDescriptor = context.ActionDescriptor as ControllerActionDescriptor;
            if (controllerActionDescriptor != null)
            {
                var skipAuthorization = controllerActionDescriptor.MethodInfo.GetCustomAttributes(inherit: true)
                    .Any(a => a.GetType().Equals(typeof(AllowAnonymousAttribute)));
                if (skipAuthorization)
                {
                    return;
                }
            }

            ClaimType claimType = Enum.Parse<ClaimType>(_claim.Type);
            bool permission = false;

            string token = GetToken();
            if (string.IsNullOrEmpty(token))
            {
                context.Result = new UnauthorizedResult();
                return;
            }
            if (claimType == ClaimType.JwtOrOauth2)
            {
                //根据Token类型选择认证方式
                if (token.Any(t => t == '.'))
                {
                    claimType = ClaimType.JWT;
                }
                else
                {
                    claimType = ClaimType.Oauth2;
                }
            }

            permission = claimType switch
            {
                ClaimType.Oauth2 or ClaimType.Cookie =>
                    _authService.First(a => a.ServiceName == nameof(OauthAuthServiceImpl)).PermissionAsync(token, _claim.Value).Result,
                ClaimType.JWT =>
                    _authService.First(a => a.ServiceName == nameof(JwtAuthServiceImpl)).PermissionAsync(token, _claim.Value).Result,
                ClaimType.Key =>
                    _authService.First(a => a.ServiceName == nameof(KeyAuthServiceImpl)).PermissionAsync(token, _claim.Value).Result,
                ClaimType.App =>
                    _authService.First(a => a.ServiceName == nameof(AppAuthServiceImpl)).PermissionAsync(token, _claim.Value).Result,
            };

            if (!permission)
            {
                context.Result = new UnauthorizedResult();
                return;
            }

            string GetToken()
            {
                string token = context.HttpContext.Request.Headers["token"];
                if (string.IsNullOrEmpty(token))
                {
                    token = context.HttpContext.Request.Query["token"];
                }
                if (string.IsNullOrEmpty(token))
                {
                    context.HttpContext.Request.Cookies.TryGetValue("token", out token);
                }
                return token;
            }
        }
    }

    public enum ClaimType
    {
        Oauth2,
        JWT,
        Cookie,
        Key,
        App,
        JwtOrOauth2
    }

　　

　　这样就能实现多个方式同时存在，想用哪个就用哪个了，只要实现 IAuthService 接口就行