HttpClient调用受JWT保护的Api

准备工作：

一个Asp.Net Core Api 程序，程序的功能大概有两个：模拟验证用户登录，权限认证模块给用户颁发Jwt，用户带token来调用Api资源。

首先简单介绍一下JWT的数据结构，JWT由头部、载荷与签名这三部分组成，中间以「.」分隔。

头部以 JSON 格式表示，用于指明令牌类型和加密算法。形式如下，表示使用 JWT 格式，加密算法采用 HS256。

{
  "alg": "HS256",
  "typ": "JWT"
}

载荷用来存储服务器需要的数据，比如用户信息，要注意的是重要的机密信息最好不要放到这里，比如密码。

{
    "name": "zhouxieyi",
    "introduce": "a test token"
}

另外，JWT 还规定了 7 个字段供开发者选用。

• iss (issuer)：签发人
• exp (expiration time)：过期时间
• sub (subject)：主题
• aud (audience)：受众
• nbf (Not Before)：生效时间
• iat (Issued At)：签发时间
• jti (JWT ID)：编号

签名使用HMACSHA256算法计算得出，这个方法有两个参数，前一个参数是 （base64 编码的头部 + base64 编码的载荷）用点号相连，后一个参数是自定义的字符串密钥，密钥不要暴露在客户端。

我们在appsettings.json中存放了我们自定义的token信息如下：

"tokenManagement": {
    "issuer": "webapi.cn",
    "name": "zhouxieyi",
    "introduce": "a test token",
    "audience": "WebApi",
    "secret": "qwertyuiopasdfghjklzxcvbnm",
    "accessExpiration": 30,
    "refreshExpiration": 60
  }

下一步配置StartUp.cs，将身份认证中间件加入引用，并引入NuGet：Microsoft.AspNetCore.Authentication.JwtBearer，在Configure中配置好服务。

创建用户User，UserService来模拟用户登录，这里我们假使所有的用户都合法。用户通过校验后，利用AuthenticationService颁发token，根据这两步逻辑，我们编写接口和控制器来完成。

代码如下：

using System.Text;
using authapi.Models;
using authapi.Services;
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Hosting;
using Microsoft.IdentityModel.Tokens;

namespace authapi
{
    public class Startup
    {
        public Startup(IConfiguration configuration)
        {
            Configuration = configuration;
        }

        public IConfiguration Configuration { get; }

        public void ConfigureServices(IServiceCollection services)
        {
            services.AddControllers();
            services.Configure<TokenManagement>(Configuration.GetSection("tokenManagement"));
            var token = Configuration.GetSection("tokenManagement").Get<TokenManagement>();

            services.AddAuthentication(x =>
            {
                x.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                x.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
            }).AddJwtBearer(options =>
            {
                options.RequireHttpsMetadata = false;
                options.SaveToken = true;

                options.TokenValidationParameters = new TokenValidationParameters
                {
                    ValidateIssuerSigningKey = true,
                    IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(token.Secret)),
                    ValidIssuer = token.Issuer,
                    ValidAudience = token.Audience,
                    ValidateIssuer = false,
                    ValidateAudience = false
                };
            });

            services.AddScoped<IUserService, UserService>();
            services.AddScoped<IAuthenticationService, TokenAuthenticateService>();
        }

        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }

            app.UseHttpsRedirection();

            app.UseRouting();

            app.UseAuthentication();
            app.UseAuthorization();

            app.UseEndpoints(endpoints =>
            {
                endpoints.MapControllers();
            });
        }
    }
}

public interface IAuthenticationService
{
    bool IsAuthenticated(User user, out string token);
}

public class TokenAuthenticateService : IAuthenticationService
{
    private readonly IUserService _userService;
    private readonly TokenManagement _tokenManagement;

    public TokenAuthenticateService(IUserService userService,
        IOptions<TokenManagement> tokenManagement)
    {
        _userService = userService;
        _tokenManagement = tokenManagement.Value;
    }

    public bool IsAuthenticated(User user, out string token)
    {
        token = string.Empty;
        if (!_userService.Validate(user))
            return false;
        var claims = new[]
        {
            new Claim(ClaimTypes.Name,user.UserName)
        };

        var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_tokenManagement.Secret));
        var credentials = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);

        var jwtToken = new JwtSecurityToken(
            _tokenManagement.Issuer,
            _tokenManagement.Audience, 
            claims,
            expires: DateTime.Now.AddMinutes(_tokenManagement.AccessExpiration),
            signingCredentials: credentials);

        token = new JwtSecurityTokenHandler().WriteToken(jwtToken);

        return true;
    }
}

public interface IUserService
{
    bool Validate(User user);
}

public class UserService : IUserService
{
    public bool Validate(User user)
    {
        return true;
    }
}

using authapi.Models;
using authapi.Services;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

namespace authapi.Controllers
{
    [ApiController]
    [Route("api/[controller]")]
    public class AuthenticationController : ControllerBase
    {
        private readonly IAuthenticationService _authenticationService;

        public AuthenticationController(IAuthenticationService authenticationService)
        {
            _authenticationService = authenticationService;
        }

        [AllowAnonymous]
        [HttpPost, Route("requestToken")]
        public ActionResult RequestToken([FromBody] User user)
        {
            if (!ModelState.IsValid)
            {
                return BadRequest("Model Error");
            }

            if (_authenticationService.IsAuthenticated(user, out var token))
            {
                return Ok(token);
            }

            return BadRequest("Invalid Request");
        }
    }
}

using Microsoft.AspNetCore.Mvc;
using System;
using System.Collections.Generic;
using System.Linq;
using Microsoft.AspNetCore.Authorization;

namespace authapi.Controllers
{
    [ApiController]
    [Route("api/[controller]")]
    public class WeatherForecastController : ControllerBase
    {
        private static readonly string[] Summaries = {
            "Freezing", "Bracing", "Chilly", "Cool", "Mild", "Warm", "Balmy", "Hot", "Sweltering", "Scorching"
        };

        [Authorize]
        [HttpGet]
        public IEnumerable<WeatherForecast> Get()
        {
            var rng = new Random();
            return Enumerable.Range(1, 5).Select(index => new WeatherForecast
            {
                Date = DateTime.Now.AddDays(index),
                TemperatureC = rng.Next(-20, 55),
                Summary = Summaries[rng.Next(Summaries.Length)]
            }).ToArray();
        }
    }
}

public class TokenManagement
{
    [JsonPropertyName("secret")]
    public string Secret { get; set; }

    [JsonPropertyName("issuer")]
    public string Issuer { get; set; }

    [JsonPropertyName("audience")]
    public string Audience { get; set; }

    [JsonPropertyName("accessExpiration")]
    public int AccessExpiration { get; set; }

    [JsonPropertyName("refreshExpiration")]
    public int RefreshExpiration { get; set; }

}

public class User
{
    [Required]
    [JsonPropertyName("username")]
    public string UserName { get; set; }

    [Required]
    [JsonPropertyName("password")]
    public string PassWord { get; set; }
}

public class WeatherForecast
{
    public DateTime Date { get; set; }

    public int TemperatureC { get; set; }

    public int TemperatureF => 32 + (int)(TemperatureC / 0.5556);

    public string Summary { get; set; }
}

运行程序，使用PostMan测试：

先利用用户获取Token

 设置Token类型，输入我们刚刚获取的Token，访问Api成功获取数据。

---

HttpClient：

创建一个Console程序，创建HttpClient，HttpClient类实例充当发送 HTTP 请求的会话。每个 HttpClient 实例都使用其自己的连接池，并从其他实例所执行的请求隔离其请求 HttpClient。

利用.NET Json处理拓展包：using System.Net.Http.Json，可以很方便的带Json对象发送请求。具体逻辑流程是使用client带用户信息请求token，获取成功后将token绑定到Header中：Authorization ： Bearer + token即可，在请求Api即可获取资源。

using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.Net.Http;
using System.Net.Http.Json;
using System.Threading.Tasks;

namespace any
{
    public class Program
    {
        static async Task Main(string[] args)
        {
            var client = new HttpClient();
            var uri = new Uri("https://localhost:5001");
            var user = new User
            {
                UserName = "client",
                PassWord = "123321"
            };

            //利用SendAsync发送请求，在Request中设置Content或Header传入。
            //var postRequest = new HttpRequestMessage(
            //    HttpMethod.Post,
            //    uri.AbsoluteUri + "api/Authentication/RequestToken")
            //{
            //    Content = JsonContent.Create(user),
            //};
            //var response = await client.SendAsync(postRequest);

            //使用PostAsJsonAsync传递json
            var response = await client.PostAsJsonAsync(uri.AbsoluteUri + "api/Authentication/RequestToken", user);
            var token = await response.Content.ReadAsStringAsync();

            Console.WriteLine($"token: {token}");

            //设置Header
            client.DefaultRequestHeaders.Add("Authorization", $"Bearer {token}");

            var result = await client.GetStringAsync(uri.AbsoluteUri + "api/WeatherForecast");

            Console.WriteLine($"string result: {result}");

            var jsonResponse = await client.GetAsync(uri.AbsoluteUri + "api/WeatherForecast");

            var jsonObjs = await jsonResponse.Content.ReadFromJsonAsync<List<WeatherForecast>>();

            if (jsonObjs != null)
            {
                foreach (var weatherForecast in jsonObjs)
                {
                    Console.WriteLine($"Date is {weatherForecast.Date}, is {weatherForecast.Summary} day");
                }
            }
            
        }

    }
}

result: