此請求的授權已被拒絕：JWT承載

Question

我正在使用JWT在Asp.net Web Api中處理身份驗證/授權。 我已經用[Authorize]裝飾了我的differents控制器。 每次撥打電話時，此消息均為Send：該請求的授權已被拒絕。

這是我的一個控制器的示例：

    [System.Web.Http.Route("api/MyParticipations")]
    [System.Web.Http.HttpGet]
    [System.Web.Http.ActionName("XAMARIN_SelectMyEvent")]
    [Authorize]
    public HttpResponseMessage Xamarin_SelectMyEvents()
    {
        string token = Request.Headers.Authorization.ToString();
        string resultToken = Utils.Util.ValidateToken(token);
        if (resultToken == null)
        {
            return Request.CreateResponse(HttpStatusCode.NotFound, "Your session has expired");
        }
        int userId = Int32.Parse(resultToken);
        var MyEvents = db.getMyEvents(userId);
        if (MyEvents == null)
        {
            return Request.CreateResponse(HttpStatusCode.NotFound, "No Events available");
        }
        else
        {
            return Request.CreateResponse(HttpStatusCode.Accepted, MyEvents);
        }
    }

這是我的啟動班：

    public IConfiguration _Configuration { get; }

    public Startup(IConfiguration configuration)
    {
        _Configuration = configuration;
    }
    public Startup()
    {

    }
    public void Configuration(IAppBuilder app)
    {
        // For more information on how to configure your application, visit https://go.microsoft.com/fwlink/?LinkID=316888
    }
    public void Configure(IApplicationBuilder app, IHostingEnvironment env)
    {
        app.UseAuthentication();
        app.UseMvc();
    }
    public void ConfigureServices(IServiceCollection services)
    {
        services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
            .AddJwtBearer(options =>
            {
                options.TokenValidationParameters = new TokenValidationParameters
                {
                    ValidateLifetime = true,
                    ValidateIssuerSigningKey = true,
                    IssuerSigningKey = new SymmetricSecurityKey(
                        Encoding.UTF8.GetBytes(_Configuration[System.Web.Configuration.WebConfigurationManager.AppSettings["JWTKEY"]]))
                };
            });
        services.AddMvc();
    }

我沒有成功解決的一個小問題是啟動類中的空構造函數。 如果刪除它，則會收到錯誤消息：“沒有為此對象定義參數的構造函數。”

這是生成並驗證JWT的代碼：

private static string Secret = System.Web.Configuration.WebConfigurationManager.AppSettings["JWTKEY"];

    public static string GenerateToken(int userId)
    {
        byte[] key = Convert.FromBase64String(Secret);
        SymmetricSecurityKey securityKey = new SymmetricSecurityKey(key);
        SecurityTokenDescriptor descriptor = new SecurityTokenDescriptor
        {
            Subject = new ClaimsIdentity(new[] {
                  new Claim(ClaimTypes.PrimarySid, userId.ToString())}),
            Expires = DateTime.UtcNow.AddDays(3),
            SigningCredentials = new SigningCredentials(securityKey,
            SecurityAlgorithms.HmacSha256Signature)
        };

        JwtSecurityTokenHandler handler = new JwtSecurityTokenHandler();
        JwtSecurityToken token = handler.CreateJwtSecurityToken(descriptor);
        return handler.WriteToken(token);
    }

    public static ClaimsPrincipal GetPrincipal(string token)
    {
        try
        {
            JwtSecurityTokenHandler tokenHandler = new JwtSecurityTokenHandler();
            JwtSecurityToken jwtToken = (JwtSecurityToken)tokenHandler.ReadToken(token);
            if (jwtToken == null)
                return null;
            byte[] key = Convert.FromBase64String(Secret);
            TokenValidationParameters parameters = new TokenValidationParameters()
            {
                RequireExpirationTime = true,
                ValidateIssuer = false,
                ValidateAudience = false,
                IssuerSigningKey = new SymmetricSecurityKey(key)
            };
            SecurityToken securityToken;
            ClaimsPrincipal principal = tokenHandler.ValidateToken(token,
                  parameters, out securityToken);
            return principal;
        }
        catch (Exception e)
        {
            return null;
        }
    }
    public static string ValidateToken(string token)
    {
        string userId = null;
        ClaimsPrincipal principal = GetPrincipal(token);
        if (principal == null)
            return null;
        ClaimsIdentity identity = null;
        try
        {
            identity = (ClaimsIdentity)principal.Identity;
        }
        catch (NullReferenceException)
        {
            return null;
        }
        Claim usernameClaim = identity.FindFirst(ClaimTypes.PrimarySid);
        userId = usernameClaim.Value;
        return userId;
    }

誰能看到這段代碼有什么問題嗎？ 我看過其他主題，但沒有一個給我解決方案。

謝謝閱讀，

一個絕望的學生

Answer 1

確保您正在執行以下所有步驟：

1. 用戶提供憑據（客戶端）
2. 憑據被批准（服務器端）
3. 令牌生成（服務器端）
4. 令牌發送到客戶端（服務器端）
5. 客戶端接收令牌，然后將Authorization Header添加到后續請求的標頭中，其值為“ Bearer GeneratedToken”（例如Authorizarion : "Bearer eyJhbGci..." ）（客戶端）