由于某些原因,我的RESTful应用程序在一段时间内允许来自Angular客户端的已过期令牌请求。生成令牌:
private async Task<string> GenerateJwtToken(ApplicationUser user)
{
var claims = new List<Claim>
{
new Claim(JwtRegisteredClaimNames.Sub, user.Email),
new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString()),
new Claim(ClaimTypes.NameIdentifier, user.Id)
};
claims.AddRange(await _userManager.GetClaimsAsync(user));
var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_configuration.GetSection("SigningKey").Value));
var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
var expires =
DateTime.Now.AddSeconds(10);
//DateTime.Now.AddDays(Convert.ToDouble(_configuration["ExpireDays"]));
var token = new JwtSecurityToken(
issuer: _configuration["Issuer"],
audience: _configuration["Audience"],
claims: claims,
expires: expires,
signingCredentials: creds);
return new JwtSecurityTokenHandler().WriteToken(token);
}
在请求之前,我记录了过期时间、当前时间以及当前时间是否超过了过期时间。记录了两次成功的请求日志,但最后一次应该失败。
t: Tue Sep 18 2018 08:53:43 GMT+0300 (Moscow Standard Time) credentials-service.ts:101
now: Tue Sep 18 2018 08:53:41 GMT+0300 (Moscow Standard Time) credentials-service.ts:102
false
true表示已经过期
由于某种原因,我在5-6分钟后才被拒绝,而不是10秒钟。credentials-service.ts:100 t: Tue Sep 18 2018 08:53:43 GMT+0300 (Moscow Standard Time)
credentials-service.ts:101 now: Tue Sep 18 2018 08:58:01 GMT+0300 (Moscow Standard Time)
credentials-service.ts:102
true