如何在網絡核心中刷新JWT？

Question

我有一種方法來授權用戶並創建一個具有過期時間的令牌，但如果令牌過期，則用戶無法使用該數據。 怎么辦呢？

這是我的方法：

[AllowAnonymous]
[HttpPost]
[Route("api/token")]
public IActionResult Post([FromBody]Personal personal)
{
  string funcionID = "";
  if (ModelState.IsValid)
  {
    var userId = GetUser(personal);
    if (!userId.HasValue)
    {
      return Unauthorized();
    }
    else if (userId.Equals(2)) {
      return StatusCode(404, "Vuelve a ingresar tu contraseña");
    }

    List<Claim> claims = new List<Claim>();
    foreach (var funcion in Funcion) {
      claims.Add(new Claim(ClaimTypes.Role, funcion.FuncionID.ToString()));
    }

    claims.Add(new Claim(JwtRegisteredClaimNames.Email, personal.CorreoE));
    claims.Add(new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString()));
    var sesionExpira = new DatabaseConfig();
    _configuration.GetSection("Database").Bind(sesionExpira);
  var token = new JwtSecurityToken
    (
        issuer: _configuration["Issuer"],
        audience: _configuration["Audience"],
        claims: claims,
        expires: DateTime.UtcNow.AddMinutes(sesionExpira.Sesion),
        notBefore: DateTime.UtcNow,
        signingCredentials: new SigningCredentials(new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_configuration["SigningKey"])),
             SecurityAlgorithms.HmacSha256)
    );
    var token_email = token.Claims.Where(w => w.Type == "email").Select(s => s.Value).FirstOrDefault();
    var token_rol = claims.Where(x => x.Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/role").Select(s => s.Value).FirstOrDefault();

    var nombre = _context.Personal.Where(x => x.CorreoE == personal.CorreoE).Select(x => x.Nombre).FirstOrDefault();
    return Ok(new { email = personal.CorreoE, token = new JwtSecurityTokenHandler().WriteToken(token), nombre = nombre, funcion = Funcion});

  }
  return BadRequest();
}

首先，在返回int的GetUser（個人個人）方法中，我返回一個用於創建新令牌的數字。 一切正常，但如果時間已過，我需要一些信息來刷新令牌

Answer 1

您可以創建將更新令牌的中間件。 如果您將令牌創建邏輯移動到單獨的服務，那么您可以這樣做：

public class JwtTokenSlidingExpirationMiddleware
{
    private readonly RequestDelegate next;
    private readonly ITokenCreationService tokenCreationService;

    public JwtTokenSlidingExpirationMiddleware(RequestDelegate next, ITokenCreationService tokenCreationService)
    {
        this.next = next;
        this.tokenCreationService= tokenCreationService;
    }

    public Task Invoke(HttpContext context)
    {
        // Preflight check 1: did the request come with a token?
        var authorization = context.Request.Headers["Authorization"].FirstOrDefault();
        if (authorization == null || !authorization.ToLower().StartsWith("bearer") || string.IsNullOrWhiteSpace(authorization.Substring(6)))
        {
            // No token on the request
            return next(context);
        }

        // Preflight check 2: did that token pass authentication?
        var claimsPrincipal = context.Request.HttpContext.User;
        if (claimsPrincipal == null || !claimsPrincipal.Identity.IsAuthenticated)
        {
            // Not an authorized request
            return next(context);
        }

        // Extract the claims and put them into a new JWT
        context.Response.Headers.Add("Set-Authorization", tokenCreationService.CreateToken(claimsPrincipal.Claims));

        // Call the next delegate/middleware in the pipeline
        return next(context);
    }
}

並在Startup.cs中注冊它：

public void Configure(IApplicationBuilder app)
{
    ...
    app.UseMiddleware<JwtTokenSlidingExpirationMiddleware>();
    ...
}

Answer 2

我使用IdentityModel中的RefreshTokenAsync方法做了類似於舊應用程序的操作。

當用戶獲得未經授權時，您可以嘗試這樣的事情：

var identityService = await DiscoveryClient.GetAsync("http://localhost:5000");
// request token
var tokenClient = new TokenClient(identityService.TokenEndpoint, "client", "secret");
var tokenResponse = await tokenClient.RequestRefreshTokenAsync(refreshToken);                     
return Ok(new { success = true, tokenResponse = tokenResponse });

資料來源： https ： //github.com/IdentityModel/IdentityModel.OidcClient.Samples/issues/4

編輯 ：我已經編輯了我的原始答案，根據規則提供更清晰，更好的答案。