asp.net core2에서 JWT를 올바르게 구성하는 방법은 무엇입니까?

Question

내 api 응용 프로그램에 JSON 웹 토큰 기반 인증을 적용하려고합니다. 문제는 토큰을 테스트 할 때마다 유효하지 않은 토큰 서명이 나옵니다. 또한 내 컨트롤러에서 권한을 요청할 수 없으며 후자를 생성하는 것과 관련이있을 수 있습니다.

모든 관련 코드를 게시하고 누군가 도움을 주시면 감사하겠습니다. 소스 코드에서 GitHub의 ASPNETCore2JwtAuthentication

appsettings.json

"BearerTokens": { 
    "Key": "iNivDmHLpUA223sqsfhqGbMRdRj1PVkH", 
    "Issuer": "http://localhost/", 
    "Audience": "http://localhost/", 
    "AccessTokenExpirationMinutes": 2, 
    "RefreshTokenExpirationMinutes": 60 
}, 

Startup.cs/ConfigureServices

을

  services.AddAuthorization(options => 
        { 
         options.AddPolicy(CustomRoles.Admin, policy => policy.RequireRole(CustomRoles.Admin)); 
         options.AddPolicy(CustomRoles.User, policy => policy.RequireRole(CustomRoles.User)); 
         options.AddPolicy(CustomRoles.Editor, policy => policy.RequireRole(CustomRoles.Editor)); 
        }); 


      services.AddAuthentication(options => 
       { 
        options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme; 
        options.DefaultSignInScheme = JwtBearerDefaults.AuthenticationScheme; 
        options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme; 
       }) 
       .AddCookie(cfg => 
       { 
        cfg.SlidingExpiration = true; 
       }) 
       .AddJwtBearer(cfg => 
       { 
        cfg.RequireHttpsMetadata = false; 
        cfg.SaveToken = true; 
        cfg.TokenValidationParameters = new TokenValidationParameters 
        { 
         ValidIssuer = Configuration["BearerTokens:Issuer"], 
         ValidAudience = Configuration["BearerTokens:Audience"], 
         IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration["BearerTokens:Key"])), 
         ValidateIssuerSigningKey = true, 
         ValidateLifetime = true, 
         ClockSkew = TimeSpan.Zero 
        }; 
        cfg.Events = new JwtBearerEvents 
        { 
         OnAuthenticationFailed = context => 
         { 
          var logger = context.HttpContext.RequestServices.GetRequiredService<ILoggerFactory>().CreateLogger(nameof(JwtBearerEvents)); 
          logger.LogError("Authentication failed.", context.Exception); 
          return Task.CompletedTask; 
         }, 
         OnTokenValidated = context => 
         { 
          var tokenValidatorService = context.HttpContext.RequestServices.GetRequiredService<ITokenValidatorService>(); 
          return tokenValidatorService.ValidateAsync(context); 
         }, 
         OnMessageReceived = context => 
         { 
          return Task.CompletedTask; 
         }, 
         OnChallenge = context => 
         { 
          var logger = context.HttpContext.RequestServices.GetRequiredService<ILoggerFactory>().CreateLogger(nameof(JwtBearerEvents)); 
          logger.LogError("OnChallenge error", context.Error, context.ErrorDescription); 
          return Task.CompletedTask; 
         } 
        }; 
       }); 


      services.AddCors(options => 
      { 
       options.AddPolicy("CorsPolicy", 
        builder => builder 
         .WithOrigins("http://localhost:4200") //Note: The URL must be specified without a trailing slash (/). 
         .AllowAnyMethod() 
         .AllowAnyHeader() 
         .AllowCredentials()); 
      }); 
      services.AddMvc(); 



**Startup.cs**/Configure 


app.UseAuthentication(); 
app.UseMvc(); 

TokenStoreService.cs 유래

,536,913,632 생성 된 토큰

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJqdGkiOiJkODFhNTQ4ZS0xOWFlLTRhNDQtODZhMS0zY2ZiNWU0MmE4ZDkiLCJpc3MiOiJodHRwOi8vbG9jYWxob3N0LyIsImlhdCI6MTUxNDAwODYwOCwiaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvd3MvMjAwNS8wNS9pZGVudGl0eS9jbGFpbXMvbmFtZWlkZW50aWZpZXIiOiIwYjk0NWZkZC00ZjViLTRhMmEtODNiZi0yNTA1YjBkNjJiODUiLCJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA1LzA1L2lkZW50aXR5L2NsYWltcy9uYW1lIjoiSlNPTiIsIkRpc3BsYXlOYW1lIjoiQWJ1IE1haXphciIsImh0dHA6Ly9zY2hlbWFzLm1pY3Jvc29mdC5jb20vd3MvMjAwOC8wNi9pZGVudGl0eS9jbGFpbXMvc2VyaWFsbnVtYmVyIjoiNTU0Zjg5ZjMtZjRiMi00ODY0LThiMzctZWNmMGY2OGNlOWM0IiwiaHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS93cy8yMDA4LzA2L2lkZW50aXR5L2NsYWltcy91c2VyZGF0YSI6IjBiOTQ1Zm 10

public async Task<(string accessToken, string refreshToken)> CreateJwtTokens(ApplicationUser user) 
{ 
    var now = DateTimeOffset.UtcNow; 
    var accessTokenExpiresDateTime = now.AddMinutes(_configuration.Value.AccessTokenExpirationMinutes); 
    var refreshTokenExpiresDateTime = now.AddMinutes(_configuration.Value.RefreshTokenExpirationMinutes); 
    var accessToken = await createAccessTokenAsync(user, accessTokenExpiresDateTime.UtcDateTime).ConfigureAwait(false); 
    var refreshToken = Guid.NewGuid().ToString().Replace("-", ""); 

    await AddUserTokenAsync(user, refreshToken, accessToken, refreshTokenExpiresDateTime, accessTokenExpiresDateTime).ConfigureAwait(false); // this method is only to store the generated token in the database, irrelevent to the issue. 
    await this.context.SaveChangesAsync(); 


    return (accessToken, refreshToken); 
} 

private async Task<string> createAccessTokenAsync(ApplicationUser user, DateTime expires) 
     { 
      var claims = new List<Claim> 
      { 
       // Unique Id for all Jwt tokes 
       new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString()), 
       // Issuer 
       new Claim(JwtRegisteredClaimNames.Iss, _configuration.Value.Issuer), 
       // Issued at 
       new Claim(JwtRegisteredClaimNames.Iat, DateTime.UtcNow.ToUnixEpochDate().ToString(), ClaimValueTypes.Integer64), 
       new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()), 
       new Claim(ClaimTypes.Name, user.UserName), 
       new Claim("DisplayName", user.LastName), 
       // to invalidate the cookie 
       new Claim(ClaimTypes.SerialNumber, user.SecurityStamp), 
       // custom data 
       new Claim(ClaimTypes.UserData, user.Id.ToString()) 
      }; 

      // add roles 
      var roles = await _rolesService.FindUserRolesAsync(user.Id).ConfigureAwait(false); 
      foreach (var role in roles) 
      { 
       claims.Add(new Claim(ClaimTypes.Role, role.RoleId)); 
      } 

      var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_configuration.Value.Key)); 
      var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256); 
      var token = new JwtSecurityToken(
       issuer: _configuration.Value.Issuer, 
       audience: _configuration.Value.Audience, 
       claims: claims, 
       notBefore: DateTime.UtcNow, 
       expires: expires, 
       signingCredentials: creds); 

      return new JwtSecurityTokenHandler().WriteToken(token); 
     } 

샘플

RkLTRmNWItNGEyYS04M2JmLTI1MDViMGQ2MmI4NSIsIm5iZiI6MTUxNDAwODYwNywiZXhwIjoxNTE0MDA4NzI3LCJhdWQiOiJodHRwOi8vbG9jYWxob3N0LyJ9.q-IphSwiOhzDT9upOO4XOvGQVp_NxymcuW4WWuERe2U는

validation link

Answer 1

나의 문제는 자신의 토큰의 유효성을 검사 사용자 정의 방법입니다 내 ITokenValidatorService 버그이었다. 는 config 위에서 보여

OnTokenValidated = context => 
         { 
          var tokenValidatorService = context.HttpContext.RequestServices.GetRequiredService<ITokenValidatorService>(); 
          return tokenValidatorService.ValidateAsync(context); 
         }, 

는

잘 작동하지만 난 여전히 JWT validator 어떤이 유효하지 않은 토큰 제출 돌아 유지 이유를 궁금해!