.net code 3.1 一个网站可以同时使用网页登录和使用JWT方式访问API

主要用于网站以.Net Core 3.1 Web MVC网站，其中有部分数据需要建立API通过外部Winform程序使用。

主要代码

Startup中的ConfigureServices：

//增加网页登录方式，直接使用自带的Identity
services.AddIdentity<ApplicationUser, ApplicationRole>(options =>
{
    options.Password.RequireDigit = false;
    options.Password.RequireLowercase = false;
    options.Password.RequireNonAlphanumeric = false;
    options.Password.RequireUppercase = false;
    options.Password.RequiredLength = 4;
    options.Password.RequiredUniqueChars = 1;
    options.User.AllowedUserNameCharacters = "";
})
    .AddEntityFrameworkStores<ApplicationDbContext>()
    .AddDefaultTokenProviders();

//增加API验证方式
services.AddAuthentication()
    .AddJwtBearer("JwtBearerLogin", options=> {//用于AccessToken
        options.TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
        {
            ValidIssuer = JwtSetting.Issuer,
            ValidAudience = JwtSetting.Audience,
            IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(JwtSetting.SecretKey)),

            ValidateLifetime = true
        };
    }).AddJwtBearer("JwtBearerRefreshTokenLogin", options => {//用户RefreshToken
        options.TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
        {
            ValidIssuer = JwtSetting.Issuer,
            ValidAudience = JwtSetting.RefreshTokenAudience,
            IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(JwtSetting.SecretKey)),

            ValidateLifetime = true
        };
    });

API中的AuthorizeController，用户提供JWT的登录和获取新的Token

//API登录
[HttpPost("/api/Token")]
public async Task<IActionResult> TokenAsync([FromBody]Models.AuthorizeViewModels.LoginViewModel viewModel)
{
    if (!ModelState.IsValid)//判断是否合法
    {
        return BadRequest("验证错误！");
    }

    var user = await _userManager.FindByNameAsync(viewModel.UserName);
    if (user == null)
    {
        return BadRequest("输入的用户名或密码错误！");

    }

    if (!await _userManager.CheckPasswordAsync(user, viewModel.Password))
    {
        return BadRequest("输入的用户名或密码错误！");
    }
    _logger.LogInformation("用户" + user.UserName + "通过API Token登录！");

    var th = new TokenHepler(_userManager);
    var res = th.CreateToken(user);
    res.UserName = user.UserName;
    return Ok(res);
}

//使用RefreshToken获取新的AccessToken
//[Authorize(AuthenticationSchemes = "JwtBearerRefreshTokenLogin")]代表使用第二种API验证规则，此规则仅用于验证RefreshToken
[HttpGet("/api/RefreshToken", Name = nameof(RefreshTokenAsync))]
[Authorize(AuthenticationSchemes = "JwtBearerRefreshTokenLogin")]
public async Task<IActionResult> RefreshTokenAsync()
{
    var th = new TokenHepler(_userManager);
    _logger.LogInformation("用户通过API RefreshToken刷新Token！");

    return Ok(await th.RefreshTokenAsync(Request.HttpContext.User));
}

相关辅助代码：

TokenHelper:

public class TokenHepler
{
    private readonly UserManager<ApplicationUser> _userManager;
    public TokenHepler(UserManager<ApplicationUser> options)
    {
        _userManager = options;
    }

    public TokenViewModel CreateAccessToken(ApplicationUser user)
    {
        Claim[] claims = new Claim[] { 
            new Claim(ClaimTypes.NameIdentifier, user.Id), 
            new Claim(ClaimTypes.Name, user.UserName) 
        };

        return CreateToken(claims, TokenType.AccessToken);
    }

    public ComplexTokenViewModel CreateToken(ApplicationUser user)
    {
        Claim[] claims = new Claim[] {
            new Claim(ClaimTypes.NameIdentifier, user.Id),
            new Claim(ClaimTypes.Name, user.UserName)
        };

        return CreateToken(claims);
    }

    public ComplexTokenViewModel CreateToken(Claim[] claims)
    {
        return new ComplexTokenViewModel
        {
            AccessToken = CreateToken(claims, TokenType.AccessToken),
            RefreshToken = CreateToken(claims, TokenType.RefreshToken)
        };
    }

    /// <summary>
    /// 用于创建AccessToken和RefreshToken。
    /// 这里AccessToken和RefreshToken只是过期时间不同，【实际项目】中二者的claims内容可能会不同。
    /// 因为RefreshToken只是用于刷新AccessToken，其内容可以简单一些。
    /// 而AccessToken可能会附加一些其他的Claim。
    /// </summary>
    /// <param name="claims"></param>
    /// <param name="tokenType"></param>
    /// <returns></returns>
    private TokenViewModel CreateToken(Claim[] claims, TokenType tokenType)
    {
        var now = DateTime.Now;
        var expires = now.Add(TimeSpan.FromMinutes(tokenType.Equals(TokenType.AccessToken) ? JwtSetting.ExpiresMinutes : JwtSetting.RefreshTokenExpiresMinutes));
        var token = new JwtSecurityToken(
            issuer: JwtSetting.Issuer,
            audience: tokenType.Equals(TokenType.AccessToken) ? JwtSetting.Audience : JwtSetting.RefreshTokenAudience,
            claims: claims,
            notBefore: now,
            expires: expires,
            signingCredentials: new SigningCredentials(new SymmetricSecurityKey(Encoding.UTF8.GetBytes(JwtSetting.SecretKey)), SecurityAlgorithms.HmacSha256));
        return new TokenViewModel { Token = new JwtSecurityTokenHandler().WriteToken(token), Expires = expires };
    }

    public async Task<TokenViewModel> RefreshTokenAsync(ClaimsPrincipal claimsPrincipal)
    {
        var code = claimsPrincipal.Claims.FirstOrDefault(m => m.Type.Equals(ClaimTypes.NameIdentifier));
        if (null != code)
        {
            return CreateAccessToken(await _userManager.FindByIdAsync(code.Value));
        }
        else
        {
            return null;
        }
    }
}

public enum TokenType
{
    AccessToken = 1,
    RefreshToken = 2
}

TokenModel

    public class TokenViewModel
    {
        public string Token { get; set; }

        public DateTime Expires { get; set; }
    }

    public class ComplexTokenViewModel
    {
        public TokenViewModel AccessToken { get; set; }
        public TokenViewModel RefreshToken { get; set; }

        public string UserName { get; set; }
    }

JwtSetting只是一个简单的用于保存配置文件的静态类

编写需要验证的API时在顶部增加

    [ApiController]
    [Route("/api/DictionaryClasses/{ClassKey}/Dictionarys")]
    [Authorize(AuthenticationSchemes = "JwtBearerLogin")]
    public class DictionaryController : ControllerBase

来选择第一种JWT验证方式

需要网页登录的Controller直接使用 [Authorize] 即可。

Winform中的登录方式：

var model = new LoginViewModel()
{
    UserName = userName,
    Password = password
};
var json = JsonConvert.SerializeObject(model);

var res = await HttpHelper.DoJsonPostAsync(LoginUrl, json);
if (res.IsSuccessStatusCode)
{
                    
    var tokenJson = await res.Content.ReadAsStringAsync();
    var complexToken = JsonConvert.DeserializeObject<ComplexTokenViewModel>(tokenJson);
    var lm = new LoginMessage()
    {
        AccessToken = complexToken.AccessToken.Token,
        AccessTokenExpires = complexToken.AccessToken.Expires,
        RefreshToken = complexToken.RefreshToken.Token,
        RefreshTokenExpires = complexToken.RefreshToken.Expires,
        UserName = complexToken.UserName
    };
    loginMessage = lm;
    MessageBox.Show("登录成功，欢迎您：" + complexToken.UserName);
    this.DialogResult = DialogResult.OK;
    this.Close();
}
else if (res.StatusCode == System.Net.HttpStatusCode.NotFound)
{
    MessageBox.Show("无法找到服务器!", "系统错误", MessageBoxButtons.OK, MessageBoxIcon.Exclamation);
}
else if (res.StatusCode == System.Net.HttpStatusCode.BadRequest)
{
    MessageBox.Show(await res.Content.ReadAsStringAsync());//登录的错误信息API通过BadRequest发送
}
else
{
    MessageBox.Show(res.StatusCode.ToString());
}

主要方法是官方文档的《使用 ASP.NET Core 中的特定方案授权》可以配置多种授权方式