JWT 不记名令牌流 [英] JWT Bearer Token Flow

问题描述

我想要的是ASP.NET Core中JWT生成和JWT消费的方法.

What I want is a method of JWT Generation and JWT Consumption in ASP.NET Core.

没有 OAuth2 流程，我确实有 IdentityServerv3 与 OAuth2 一起使用，但是当我拥有双方时，对于访问 API 的单个应用程序来说，这只是矫枉过正.

No OAuth2 flow, I do have the IdentityServerv3 working with OAuth2 but it is just overkill for a single app accessing an API when I own both sides.

我遇到的主要困难是在 ASP.NET Core 中找到 Microsoft.Owin.Security.Jwt 的等价物.此列表中的任何内容 https://www.myget.org/gallery/aspnetvnext 似乎都没有关联.还是该软件包实际上与 ASP.NET Core 保持相关?

The main source of difficulty I am having is finding out the equivalent of Microsoft.Owin.Security.Jwt in ASP.NET Core. Nothing in this list https://www.myget.org/gallery/aspnetvnext seems to relate. Or is that package actually to stay relevant in with ASP.NET Core?

推荐答案

如果您正在寻找一种(简单的)方法来生成自己的 JWT 令牌，您应该直接使用 JwtSecurityTokenHandler.您可以在您提到的 MyGet 存储库(但现在版本有点旧)的 System.IdentityModel.Tokens 包中找到它，也可以直接在 System 中的 Azure AD 存储库中找到它.IdentityModel.Tokens.Jwt 包:https://www.myget.org/gallery/azureadwebstacknightly

If you're looking for a (simple) way to generate your own JWT tokens, you should directly use the JwtSecurityTokenHandler. You can find it in the System.IdentityModel.Tokens package on the MyGet repository you mentioned (but the version is a bit old now) or directly on the Azure AD repository, in the System.IdentityModel.Tokens.Jwt package: https://www.myget.org/gallery/azureadwebstacknightly

当然，使用标准协议来颁发和检索您的 JWT 令牌是非常值得推荐的，OAuth2 和 OpenID Connect 可能是最好的选择.

Of course, using a standard protocol to issue and retrieve your JWT tokens is more than recommended and OAuth2 and OpenID Connect are probably the best candidates for that.

请注意，IdentityServer 不是唯一适用于 ASP.NET 5 的服务器.我个人正在开发 Katana 3 附带的 OAuth2 授权服务器中间件的高级分支，它提供了一个不同的方法:https://github.com/aspnet-contrib/AspNet.Security.OpenIdConnect.Server

Note that IdentityServer is not the only server that works on ASP.NET 5. I'm personally working on an advanced fork of the OAuth2 authorization server middleware that comes with Katana 3 and that offers a different approach: https://github.com/aspnet-contrib/AspNet.Security.OpenIdConnect.Server

app.UseOAuthBearerAuthentication(new JwtBearerOptions
{
    AutomaticAuthenticate = true,
    AutomaticChallenge = true,
    Audience = "http://localhost:54540/",
    Authority = "http://localhost:54540/"
});

app.UseOpenIdConnectServer(options =>
{
    options.Provider = new AuthorizationProvider();
});

要了解有关此项目的更多信息，我建议阅读 http://kevinchalet.com/2016/07/13/creating-your-own-openid-connect-server-with-asos-introduction/.

To learn more about this project, I'd recommend reading http://kevinchalet.com/2016/07/13/creating-your-own-openid-connect-server-with-asos-introduction/.

请随时在 https://jabbr.net/#/rooms/AspNetCore 如果您需要更多信息.

Feel free to ping me on https://jabbr.net/#/rooms/AspNetCore if you need more information.

这篇关于JWT 不记名令牌流的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！