NetCore+Dapper WebApi架構搭建（六）：添加JWT認證

WebApi必須保證安全，現在來添加JWT認證

1、打開appsettings.json添加JWT認證的配置信息

2、在項目根目錄下新建一個Models文件夾，添加一個JwtSettings.cs的實體

namespace Dinner.WebApi.Models
{
    public class JwtSettings
    {
        /// <summary>
        /// 證書頒發者
        /// </summary>
        public string Issuer { get; set; }

        /// <summary>
        /// 允許使用的角色
        /// </summary>
        public string Audience { get; set; }

        /// <summary>
        /// 加密字符串
        /// </summary>
        public string SecretKey { get; set; }
    }
}

3、Startup.cs文件中的ConfigureServices添加Jwt認證的代碼

#region JWT認證

            services.Configure<JwtSettings>(Configuration.GetSection("JwtSettings"));
            JwtSettings setting = new JwtSettings();
            //綁定配置文件信息到實體
            Configuration.Bind("JwtSettings", setting);
            //添加Jwt認證
            services.AddAuthentication(option =>
            {
                option.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                option.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
            }).AddJwtBearer(config =>
            {
                config.TokenValidationParameters = new TokenValidationParameters
                {
                    ValidAudience = setting.Audience,
                    ValidIssuer = setting.Issuer,
                    IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(setting.SecretKey))
                };
                /*
                config.SecurityTokenValidators.Clear();
                config.SecurityTokenValidators.Add(new MyTokenValidate());
                config.Events = new JwtBearerEvents()
                {
                    OnMessageReceived = context =>
                    {
                        var token = context.Request.Headers["myToken"];
                        context.Token = token.FirstOrDefault();
                        return Task.CompletedTask;
                    }
                };
                */
            });

            #endregion

4、Startup.cs文件中的Configure添加Jwt認證的代碼

app.UseAuthentication();

5、基本配置都弄完了，現在是生成JwtToken，在ValuesController中添加一個生成Jwt的Action

using Dinner.WebApi.Models;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Options;
using Microsoft.IdentityModel.Tokens;
using System;
using System.Collections.Generic;
using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Text;

namespace Dinner.WebApi.Controllers
{
    [Route("api/[controller]/[action]")]
    public class ValuesController : Controller
    {
        private readonly JwtSettings setting;
        public ValuesController(IOptions<JwtSettings> _setting)
        {
            setting = _setting.Value;
        }
        // GET api/values
        [HttpGet]
        public IEnumerable<string> Get()
        {
            return new string[] { "value1", "value2" };
        }

        // GET api/values/5
        [HttpGet("{id}")]
        public string Get(int id)
        {
            return "value";
        }

        // POST api/values
        [HttpPost]
        public void Post([FromBody]string value)
        {
        }

        // PUT api/values/5
        [HttpPut("{id}")]
        public void Put(int id, [FromBody]string value)
        {
        }

        // DELETE api/values/5
        [HttpDelete("{id}")]
        public void Delete(int id)
        {
        }

        [HttpGet]
        public IActionResult GetGenerateJWT()
        {
            try
            {
                var claims = new Claim[] 
                {
                    new Claim(ClaimTypes.Name, "wangshibang"),
                    new Claim(ClaimTypes.Role, "admin, Manage")
                };
                var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(setting.SecretKey));
                var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
                var token = new JwtSecurityToken(
                    setting.Issuer,
                    setting.Audience,
                    claims,
                    DateTime.Now,
                    DateTime.Now.AddMinutes(30),
                    creds);
                return Ok(new { Token = new JwtSecurityTokenHandler().WriteToken(token) });
            }
            catch (Exception ex)
            {
                return BadRequest(ex.Message);
            }   
            
        }
    }
}

這樣調用這個方法就會生成一個JwtToken，然后在UsersController上面添加一個[Authorize]的特性

上一篇我們說過SwaggerUI配置的最后一句有一個options.OperationFilter<HttpHeaderOperation>(); 這里我們來看這個HttpHeaderOperation

using Microsoft.AspNetCore.Authorization;
using Swashbuckle.AspNetCore.Swagger;
using Swashbuckle.AspNetCore.SwaggerGen;
using System.Collections.Generic;
using System.Linq;

namespace Dinner.WebApi
{
    public class HttpHeaderOperation : IOperationFilter
    {
        public void Apply(Operation operation, OperationFilterContext context)
        {
            if (operation.Parameters == null)
            {
                operation.Parameters = new List<IParameter>();
            }

            var actionAttrs = context.ApiDescription.ActionAttributes();

            var isAuthorized = actionAttrs.Any(a => a.GetType() == typeof(AuthorizeAttribute));

            if (isAuthorized == false) //提供action都沒有權限特性標記，檢查控制器有沒有
            {
                var controllerAttrs = context.ApiDescription.ControllerAttributes();

                isAuthorized = controllerAttrs.Any(a => a.GetType() == typeof(AuthorizeAttribute));
            }

            var isAllowAnonymous = actionAttrs.Any(a => a.GetType() == typeof(AllowAnonymousAttribute));

            if (isAuthorized && isAllowAnonymous == false)
            {
                operation.Parameters.Add(new NonBodyParameter()
                {
                    Name = "Authorization",  //添加Authorization頭部參數
                    In = "header",
                    Type = "string",
                    Required = false
                });
            }
        }
    }
}

這個代碼主要就是在swagger頁面添加了一個Authorization的頭部輸入框信息，以便來進行驗證

現在我們基本工作都做好了，打開頁面測試吧，注意：傳入的Authorization參數必須是Bearer xxxxxxx的形式（xxxxxxx為生成的Token）

他返回了Http200就是成功了

整個項目的框架基本算是搭建好了，這只是一個雛形而已，其實Authorize這一塊需要建一個BaseController繼承Controller再在BaseController上添加一個Authorize然后所有Controller繼承BaseController就不用一個一個的寫Authorize了，不需要驗證的加個AllowAnonymous就可以了，其他的直接擴展倉儲接口寫倉儲就可以直接調用了

源碼地址： https://github.com/wangyulong0505/Dinner