在 ASP.NET Core WebAPI 中使用 JWT 验证

public void ConfigureServices(IServiceCollection services){    services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_2);    // STEP1: 设定用哪种方式验证 HTTP Request 是否合法    services        // 检查 HTTP Header 的 Authorization 是否有 JWT Bearer Token        .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)        // 设定 JWT Bearer Token 的检查选项        .AddJwtBearer(options =>        {            options.TokenValidationParameters = new TokenValidationParameters            {                ValidateIssuer = true,                ValidIssuer = Configuration["Jwt:Issuer"],                ValidateAudience = true,                ValidAudience = Configuration["Jwt:Issuer"],                ValidateLifetime = true,                ValidateIssuerSigningKey = true,                IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration["Jwt:Key"]))            };        });}

public void Configure(IApplicationBuilder app, IHostingEnvironment env){    // 略...    // STEP2: 使用验证权限的 Middleware    app.UseAuthentication();    app.UseHttpsRedirection();    app.UseMvc();}

[Route("api/[controller]")][ApiController]public class ValuesController : ControllerBase{    // GET api/values/anonymous    /// <summary>使用匿名登入，无视于身分验证</summary>    [AllowAnonymous]    [HttpGet, Route("anonymous")]    public IActionResult Anonymous()    {        return new ContentResult() { Content = $@"For all anonymous." };    }    // GET api/values/authorize    /// <summary>使用身分验证，HTTP 的 Authorization Header 必须设定合法的 JWT Bearer Token 才能使用</summary>    [Authorize]    [HttpGet, Route("authorize")]    public IActionResult All()    {        return new ContentResult() { Content = $@"For all client who authorize." };    }}