在ASP.NET Core中进行身份验证后显示用户信息

Question

I have already implemented Identity with JWT token and secured the routes using [Authorize] attribute. This works well. There are several tutorials on securing a route using JWT and Identity but I couldn't find any on how to let a particular user only access their own stuff after they have been authenticated.

So far, I have done this:

    [Authorize]
    [HttpGet("protected")]
    public async Task<string> ProtectedArea()
    {
        var userName = User.Identity.Name;
        var user = repository.GetUserByEmail(userName);
//var user2 = _userManager.FindByIdAsync(userName); //user2.id gives null reference error
        return User.Bio;

    }

Here, GetUserByEmail is a simple method that returns the User object by querying the database(i couldn't get the UserManager to work here either to return the User using FindByEmailAsync as it would throw a null reference exception)

Here's what my claims looks like:

    var claims = new List<Claim>
    {
        new Claim(JwtRegisteredClaimNames.Sub, email),
        new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString()),
        new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()),
        new Claim(JwtRegisteredClaimNames.UniqueName, user.UserName),
        new Claim(JwtRegisteredClaimNames.NameId, user.Id.ToString())

    };

So what is the standard way for identifying a user from the token and then go on to display that user's info? What I have done above seems a little hacky to me but is it the right approach? Also, do I need to perform a check on every route and get the User Id via a method or is it possible to do so via some attribute as well?

Any help would be greatly appreciated.

Answer 1

The reason using UserManager failed was because you're attempting to get the user by id ( FindByIdAsync ), but supplying the username as the "id". That will never match, so no user is returned and your variable is null. If you simply use FindByNameAsync instead, you'd be fine.

However, there's actually an even easier way:

var user = await _userManager.GetUserAsync(User);