如何加密 JWT 安全令牌? [英] How to encrypt JWT security token?

问题描述

我需要通过签名和加密来保护我的网络令牌.我写了下一行代码:

I need to secure my web-token with signing and encryption. I wrote the next lines of code:

var tokenHandler = new JwtSecurityTokenHandler();
var tokenDescriptor = new SecurityTokenDescriptor
{
      Subject = new ClaimsIdentity(new[]
         {
             new Claim(ClaimTypes.Name, owner.Name),
             new Claim(ClaimTypes.Role, owner.RoleClaimType),
             new Claim("custom claim type", "custom content")
         }),
      TokenIssuerName = "self",
      AppliesToAddress = "http://www.example.com",
      Lifetime = new Lifetime(now, now.AddSeconds(60 * 3)),
      EncryptingCredentials = new X509EncryptingCredentials(new X509Certificate2(cert)),
      SigningCredentials = new X509SigningCredentials(cert1)
};
var token = (JwtSecurityToken)tokenHandler.CreateToken(tokenDescriptor);            
var tokenString = tokenHandler.WriteToken(token);

所以，我使用了一些由 makecert.exe 生成的证书.然后我用另一个 JwtSecurityTokenHandler 读取令牌字符串:

So, I am using some certificates, generated with makecert.exe. Then I read token string with another JwtSecurityTokenHandler:

var tokenHandlerDecr = new JwtSecurityTokenHandler();
var tok = tokenHandlerDecr.ReadToken(tokenString);

并且令牌内容未加密(我可以在调试器下的 tok 变量中看到 json).我究竟做错了什么?如何加密令牌数据?

And token content is not encrypted (I can see json in tok variable under debugger). What am I doing wrong? How to encrypt token data?

推荐答案

我的理解是微软的JWT实现目前不支持加密(只支持签名).

My understanding is that Microsoft's JWT implementation doesn't currently support encryption (only signing).

这篇关于如何加密 JWT 安全令牌?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！