我试图理解MVC 5中Single Page App模板中的OWIN Bearer Token身份验证过程。请纠正我,如果我错了的话,对于OAuth密码客户端认证流程,Bearer Token身份验证的工作方式是通过检查http授权请求头来查找Bearer访问令牌代码,以查看请求是否经过身份验证,它不依赖于cookie来检查特定请求是否经过身份验证。
根据这篇文章:
使用Web API样例进行OWIN Bearer Token身份验证
public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
{
using (IdentityManager identityManager = _identityManagerFactory.CreateStoreManager())
{
if (!await identityManager.Passwords.CheckPasswordAsync(context.UserName, context.Password))
{
context.SetError("invalid_grant", "The user name or password is incorrect.");
return;
}
string userId = await identityManager.Logins.GetUserIdForLocalLoginAsync(context.UserName);
IEnumerable<Claim> claims = await GetClaimsAsync(identityManager, userId);
ClaimsIdentity oAuthIdentity = CreateIdentity(identityManager, claims,
context.Options.AuthenticationType);
ClaimsIdentity cookiesIdentity = CreateIdentity(identityManager, claims,
_cookieOptions.AuthenticationType);
AuthenticationProperties properties = await CreatePropertiesAsync(identityManager, userId);
AuthenticationTicket ticket = new AuthenticationTicket(oAuthIdentity, properties);
context.Validated(ticket);
context.Request.Context.Authentication.SignIn(cookiesIdentity);
}
}
GrantReourceOwnerCredentials函数不仅通过这行代码创建票据: context.Validated(ticket);,而且还组合了一个cookie身份并将其设置为cookie,使用这行代码: context.Request.Context.Authentication.SignIn(cookiesIdentity);
所以我的问题是,这个函数中的cookie确切目的是什么?AuthenticationTicket不应该足以用于认证吗?