[英]JWT signing requirements for ES256
RFC 7518 定义(在第 3.1 节中)“alg”值和 MAC 算法之间允许的配对。 ES256
必须与ECDSA using P-256 and SHA-256
配对ECDSA using P-256 and SHA-256
作为 MAC 算法。
由于您面临 Apple 要求使用 ES256,这意味着您必须使用 ECDSA。
当使用 ES256 验证授权码时,当您的密钥或“子”有问题时,我们会收到“无效客户端”。 使用下面的代码,您的问题将得到解决,因为我已经解决了我的问题。
代码:
private static CngKey GetPrivateKey()
{
using (var reader = File.OpenText(ConfigurationManager.AppSettings["key2"].ToString())) //put your key's path like C:\ABC.p8
{
var ecPrivateKeyParameters = (ECPrivateKeyParameters)new PemReader(reader).ReadObject();
var x = ecPrivateKeyParameters.Parameters.G.AffineXCoord.GetEncoded();
var y = ecPrivateKeyParameters.Parameters.G.AffineYCoord.GetEncoded();
var d = ecPrivateKeyParameters.D.ToByteArrayUnsigned();
return EccKey.New(x, y, d);
}
}
var utc0 = new DateTime(1970, 1, 1, 0, 0, 0, 0, DateTimeKind.Utc);
var issueTime = DateTime.Now;
var iat = (int)issueTime.Subtract(utc0).TotalSeconds;
var exp = (int)issueTime.AddMinutes(55).Subtract(utc0).TotalSeconds;
var payload = new Dictionary<string, object>()
{
{ "sub", "com.xyzttt" }, // you registered app
{ "aud", "https://appleid.apple.com"},
{ "iss", "ABCDEFGHttt" }, //Team id
{ "exp", exp }, }, //current time + @@@@
{ "iat", iat } } // current time
};
var extraHeader = new Dictionary<string, object>()
{
{ "alg", "ES256" },
{ "kid", "5ABCDEFGH123tt21"}, //key id
};
var sb = GetPrivateKey();
var ecdsa = new ECDsaCng(sb);
byte[] headerBytes = Encoding.UTF8.GetBytes(JsonConvert.SerializeObject(extraHeader, Formatting.None));
byte[] claimsBytes = Encoding.UTF8.GetBytes(JsonConvert.SerializeObject(payload, Formatting.None));
var Rpayload = Base64UrlEncode(headerBytes) + "." + Base64UrlEncode(claimsBytes);
var signature = ecdsa.SignData(Encoding.UTF8.GetBytes(Rpayload), HashAlgorithmName.SHA256);
var data = Base64UrlEncode(signature);
string token = Rpayload + "." + data;
return token;
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.