我们正在开发一个带有JWT Bearer认证的.Net Core 2.1 Web API。 应用程序本身将生成并分发令牌,这些令牌将被发送到后端。
虽然我们已经一切就绪,即我们可以从Angular发送Bearer令牌并在Postman中进行测试,但Swagger不会发送Bearer令牌。 我们已经添加了Swagger配置以使用SecurityDefinition,如下所示,我将发布完整的ConfigureServices方法:
虽然我们已经一切就绪,即我们可以从Angular发送Bearer令牌并在Postman中进行测试,但Swagger不会发送Bearer令牌。 我们已经添加了Swagger配置以使用SecurityDefinition,如下所示,我将发布完整的ConfigureServices方法:
public void ConfigureServices(IServiceCollection services)
{
// Add framework services.
services.AddMvc();
services.AddCors(options =>
{
options.AddPolicy("AllowAllOrigins",
policy => policy.WithOrigins("*").AllowAnyOrigin().AllowAnyHeader().AllowAnyMethod());
});
services.Configure<MvcOptions>(options =>
{
options.Filters.Add(new CorsAuthorizationFilterFactory("AllowAllOrigins"));
});
ServiceInstaller.Install(services, Configuration);
// api user claim policy
services.AddAuthorization(options =>
{
var authorizationPolicy = new AuthorizationPolicyBuilder()
.AddAuthenticationSchemes(JwtBearerDefaults.AuthenticationScheme)
.RequireAuthenticatedUser().Build();
options.AddPolicy("Bearer", authorizationPolicy);
});
// add identity
var builder = services.AddIdentityCore<AppUser>(o =>
{
// configure identity options
o.Password.RequireDigit = false;
o.Password.RequireLowercase = false;
o.Password.RequireUppercase = false;
o.Password.RequireNonAlphanumeric = false;
o.Password.RequiredLength = 6;
});
builder = new IdentityBuilder(builder.UserType, typeof(IdentityRole), builder.Services);
builder.AddEntityFrameworkStores<ApplicationDbContext>().AddDefaultTokenProviders();
var keyByteArray = Encoding.ASCII.GetBytes("placekeyhere");
var signingKey = new Microsoft.IdentityModel.Tokens.SymmetricSecurityKey(keyByteArray);
services.AddAuthentication(options => { options.DefaultScheme = JwtBearerDefaults.AuthenticationScheme; }).AddJwtBearer(
options =>
{
options.TokenValidationParameters = new TokenValidationParameters()
{
IssuerSigningKey = signingKey,
ValidAudience = "Audience",
ValidIssuer = "Issuer",
ValidateIssuerSigningKey = true,
ValidateLifetime = true,
ClockSkew = TimeSpan.FromMinutes(0)
};
});
// Configure JwtIssuerOptions
services.Configure<JwtIssuerOptions>(options =>
{
options.Issuer = "Issuer";
options.Audience = "Audience";
options.SigningCredentials = new SigningCredentials(signingKey, SecurityAlgorithms.HmacSha256);
});
// Register the Swagger generator, defining one or more Swagger documents
services.AddSwaggerGen(c =>
{
c.SwaggerDoc("v1", new Info { Title = "AppName", Version = "v1" });
c.OperationFilter<UploadOperation>();
c.AddSecurityDefinition("Authorization", new ApiKeyScheme
{
Description =
"JWT Authorization header using the Bearer scheme. Example: \"Authorization: Bearer {token}\"",
Name = "Authorization",
In = "header",
Type = "apiKey",
});
});
}
这将在屏幕顶部添加“认证”选项。在配置方法中,我们告诉应用程序实际使用身份验证:
public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
app.UseAuthentication();
if (env.IsDevelopment())
{
// Enable middleware to serve generated Swagger as a JSON endpoint.
app.UseCors();
app.UseSwagger();
// Enable middleware to serve swagger-ui (HTML, JS, CSS, etc.), specifying the Swagger JSON endpoint.
app.UseSwaggerUI(c => { c.SwaggerEndpoint("/swagger/v1/swagger.json", "AppName"); });
}
app.UseMvc();
}
然而,当我们使用令牌进行身份验证时,函数的curl不会显示承载令牌。似乎Swagger没有将令牌发送到后端。
我们使用的是.Net Core 2.1和Swagger 2.3。任何帮助都将不胜感激,谢谢。