C#中间件如何集成JWT刷新令牌

在C#中，我们可以使用ASP.NET Core框架来实现JWT（JSON Web Token）的刷新令牌功能。以下是一个简单的示例，展示了如何在C#中间件中集成JWT刷新令牌：

1. 首先，确保已经安装了以下NuGet包：

   • Microsoft.AspNetCore.Authentication.JwtBearer
   • System.IdentityModel.Tokens.Jwt

2. 在Startup.cs文件中，配置JWT认证和授权：

using System.Text;
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.IdentityModel.Tokens;

public class Startup
{
    public IConfiguration Configuration { get; }

    public void ConfigureServices(IServiceCollection services)
    {
        // 从appsettings.json文件中获取JWT相关配置
        var jwtSettings = Configuration.GetSection("JwtSettings");
        var key = Encoding.ASCII.GetBytes(jwtSettings["SecretKey"]);

        // 配置JWT认证
        services.AddAuthentication(x =>
        {
            x.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
            x.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
        })
        .AddJwtBearer(x =>
        {
            x.RequireHttpsMetadata = false;
            x.SaveToken = true;
            x.TokenValidationParameters = new TokenValidationParameters
            {
                ValidateIssuerSigningKey = true,
                IssuerSigningKey = new SymmetricSecurityKey(key),
                ValidateIssuer = false,
                ValidateAudience = false
            };
        });

        // 配置授权
        services.AddAuthorization();
    }
}

3. 创建一个用于生成和验证JWT令牌的服务：

using System;
using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Text;
using Microsoft.Extensions.Configuration;
using Microsoft.IdentityModel.Tokens;

public class JwtService
{
    private readonly IConfiguration _configuration;

    public JwtService(IConfiguration configuration)
    {
        _configuration = configuration;
    }

    public string GenerateToken(string userId)
    {
        var jwtSettings = _configuration.GetSection("JwtSettings");
        var key = Encoding.ASCII.GetBytes(jwtSettings["SecretKey"]);

        var tokenDescriptor = new SecurityTokenDescriptor
        {
            Subject = new ClaimsIdentity(new[]
            {
                new Claim(ClaimTypes.NameIdentifier, userId)
            }),
            Expires = DateTime.UtcNow.AddMinutes(60),
            SigningCredentials = new SigningCredentials(new SymmetricSecurityKey(key), SecurityAlgorithms.HmacSha256Signature)
        };

        var tokenHandler = new JwtSecurityTokenHandler();
        var token = tokenHandler.CreateToken(tokenDescriptor);

        return tokenHandler.WriteToken(token);
    }

    public ClaimsPrincipal ValidateToken(string token)
    {
        try
        {
            var jwtSettings = _configuration.GetSection("JwtSettings");
            var key = Encoding.ASCII.GetBytes(jwtSettings["SecretKey"]);

            var validationParameters = new TokenValidationParameters
            {
                ValidateIssuerSigningKey = true,
                IssuerSigningKey = new SymmetricSecurityKey(key),
                ValidateIssuer = false,
                ValidateAudience = false
            };

            var tokenHandler = new JwtSecurityTokenHandler();
            var principal = tokenHandler.ValidateToken(token, validationParameters, out _);

            return principal;
        }
        catch (Exception)
        {
            return null;
        }
    }
}

4. 在appsettings.json文件中添加JWT相关配置：

{
  "JwtSettings": {
    "SecretKey": "your_secret_key"
  }
}

5. 在需要的地方使用JwtService生成和验证JWT令牌。例如，在登录成功后生成令牌并返回给客户端：

[HttpPost("login")]
public async Task<IActionResult> Login([FromBody] LoginRequest request)
{
    // 验证用户名和密码
    var user = await _userService.Authenticate(request.Username, request.Password);

    if (user == null)
    {
        return Unauthorized();
    }

    // 生成JWT令牌
    var token = _jwtService.GenerateToken(user.Id);

    return Ok(new { token });
}

6. 对于需要刷新令牌的API，可以在控制器或操作方法上添加[Authorize]属性，然后在操作方法中使用JwtService验证令牌。如果令牌有效，生成新的令牌并返回给客户端。

[HttpPost("refresh-token")]
[Authorize]
public IActionResult RefreshToken()
{
    var token = Request.Headers["Authorization"].ToString().Split(' ')[1];
    var principal = _jwtService.ValidateToken(token);

    if (principal == null)
    {
        return Unauthorized();
    }

    var userId = principal.FindFirst(ClaimTypes.NameIdentifier)?.Value;
    var newToken = _jwtService.GenerateToken(userId);

    return Ok(new { token = newToken });
}

这样，你就可以在C#中间件中集成JWT刷新令牌功能了。请注意，这只是一个简单的示例，实际项目中可能需要根据具体需求进行调整。