如何在C#WEB API中返回JSON Web令牌? [英] How to return a JSON Web Token in a C# WEB API?
问题描述
我正在尝试使用JWT来保护用C#编写的WEB API的过程，但是却束手无策.据我了解，流应该是这样的:
I am trying to wrap my ahead around using JWT to secure a WEB API written in C#, but am getting hung up on a few things. From my understanding the flow should be something like this:
- 客户端从某些客户端应用程序(Angular，.NET，Mobile等)向Web API提供用户名/密码
- Web API验证用户名/密码是否正确，然后生成一个JWT(JSON Web令牌)，其中包含用户的角色，信息，到期日期和其他相关信息.
- JWT被发送回客户端应用程序.
- 客户端应用程序挂接到JWT并随将来的请求一起发送.
假设以上内容正确(如果不正确，请告知我)，我在理解以下内容时遇到了麻烦.
Assuming the above is correct (and please let me know if it is not), I am having trouble understanding the following things.
- 一旦Web API验证了用户名/密码并创建了JWT，如何将JWT传回?是否以某种方式将其添加到HttpResponseMessage对象?我似乎找不到明确的答案.
- 客户端应用程序应如何将JWT传递回去?这是在附加到URL的JSON数据中添加到标头吗?
- 我看到很多有关OWIN和OAUTH的教程.这些是什么，为什么我需要它们?我在WEB API使用的数据库中保存用户凭据和角色.
推荐答案
一旦Web API验证了用户名/密码并创建了 JWT，JWT如何传递回去?我是否以某种方式将其添加到 HttpResponseMessage对象?
Once the Web API has validated the username/password and created the JWT, how does the JWT get passed back? Do I somehow add it to an HttpResponseMessage object?
成功的惯例是，来自服务的响应在响应标头中具有状态代码200 OK，并且在响应主体中具有与令牌相关的数据
Common practice is on success, the response from the service has the status code 200 OK in the response header, and token related data in the response body
200 OK
Content-Type: application/json;charset=UTF-8
{
"access_token": "NgCXRK...MzYjw",
"token_type": "Bearer",
"expires_at": 1372700873,
"refresh_token": "NgAagA...Um_SHo"
}
客户端应用程序应如何将JWT传递回去?这是在 附加到URL的JSON数据是否添加到标头?
How should the client application pass the JWT back? Is this in the JSON data, appended to the URL, added to headers?
使用访问令牌发出经过身份验证的请求
Using the access token to make authenticated requests
现在有了令牌，您可以向API发出经过身份验证的请求.这可以通过根据服务器的配置方式在请求中设置HTTP Authorization标头或查询字符串来完成.
Now that you have a token, you can make authenticated requests to the API. This is done by either setting the HTTP Authorization header or query string in the request depending on how the server is configured.
标题中
Authorization: Bearer NgCXRK...MzYjw
作为参数
GET http://localhost:35979/v2/endpoint?access_token=NgCXRK...MzYjw
我看到很多有关OWIN和OAUTH的教程.这些是什么 以及为什么我需要它们?
I see plenty of tutorials referencing OWIN and OAUTH. What are these and why do I need them?
OWIN-打开.NET的Web界面 http://owin.org/
OWIN定义了.NET Web服务器和Web之间的标准接口 应用程序. OWIN接口的目的是使服务器与 应用程序，鼓励开发用于.NET Web的简单模块 开发，并通过成为开放标准来刺激开源 .NET Web开发工具的生态系统.
OWIN defines a standard interface between .NET web servers and web applications. The goal of the OWIN interface is to decouple server and application, encourage the development of simple modules for .NET web development, and, by being an open standard, stimulate the open source ecosystem of .NET web development tools.
OAuth 2.0框架使第三方应用程序可以获取受限 访问HTTP服务.而不是使用资源所有者的 访问受保护资源的凭据，客户端将获得 访问令牌(这是表示特定范围，生存期， 和其他访问属性).访问令牌发行给第三方 客户通过授权服务器批准资源 所有者.
The OAuth 2.0 framework enables a third-party app to obtain limited access to an HTTP service. Instead of using the resource owner’s credentials to access a protected resource, the client obtains an access token (which is a string denoting a specific scope, lifetime, and other access attributes). Access tokens are issued to third-party clients by an authorization server with the approval of the resource owner.
这篇关于如何在C#WEB API中返回JSON Web令牌?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
