ASP.NET Web API & JWT 使用者身分驗證練習
01 建立 ASP.NET Web API 專案
- 執行這個 Web API 專案，就會看到這個畫面，那就表示您的 Web API 專案已經建立完成
02 ASP.NET Web API 專案之準備工作
安裝 JWT.NET 套件
建立 Web API 回傳資料模型
public class APIResult
{
public bool Success { get; set; } = true;
public string Message { get; set; } = "";
public object Payload { get; set; }
}
建立全域常數類別
public class MainHelper
{
public const string SecretKey = "GQDstcKsx0NHjPOuXOYg5MbeJ1XT0uFiwDVvVBrk";
}
建立登入驗證 Controllers
using AuthToken.Models;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Net;
using System.Net.Http;
using System.Web.Http;
namespace AuthToken.Controllers
{
public class LoginController : ApiController
{
[HttpGet]
public APIResult Get()
{
return new APIResult()
{
Success = true,
Message = "",
Payload = "Access Token"
};
}
}
}
建立無須驗證便可存取的 Controllers
using AuthToken.Models;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Net;
using System.Net.Http;
using System.Web.Http;
namespace AuthToken.Controllers
{
public class NoAuthController : ApiController
{
[HttpGet]
public APIResult Get()
{
return new APIResult()
{
Success = true,
Message = "不需要提供存取權杖 Access Token 就能使用的 API",
Payload = new string[] { "無須存取權杖1", "無須存取權杖2" }
};
}
}
}
建立需要通過身分驗證便可存取的 Controllers
using AuthToken.Models;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Net;
using System.Net.Http;
using System.Web.Http;
namespace AuthToken.Controllers
{
public class NeedAuthController : ApiController
{
[HttpGet]
public APIResult Get()
{
return new APIResult()
{
Success = true,
Message = "需要提供存取權杖 Access Token 才能使用的 API",
Payload = new string[] { "有提供存取權杖1", "有提供存取權杖2" }
};
}
}
}
進行驗證專案可以正常運作
{
"Success": true,
"Message": "",
"Payload": "Access Token"
}
{
"Success": true,
"Message": "不需要提供存取權杖 Access Token 就能使用的 API",
"Payload": [
"無須存取權杖1",
"無須存取權杖2"
]
}
{
"Success": true,
"Message": "需要提供存取權杖 Access Token 才能使用的 API",
"Payload": [
"有提供存取權杖1",
"有提供存取權杖2"
]
}
03 設計HTTP基本認證，並回傳有效存取權杖
- 在 LoginController.cs 檔案中，加入底下命名空間參考
using System.Net.Http.Formatting;
using System.Net.Http.Headers;
using System.Text;
- 將
LoginController 類別，修正成為底下程式碼
public class LoginController : ApiController
{
HttpResponseMessage response;
public string Account { get; set; }
public string Password { get; set; }
[HttpGet]
public HttpResponseMessage Get()
{
if (CanHandleAuthentication(this.Request) == true)
{
#region 檢查帳號與密碼是否正確
var expectAccount = "vulcan";
var expectPassword = "123abc";
if (expectAccount == Account &&
expectPassword == Password)
{
response = this.Request.CreateResponse<APIResult>(HttpStatusCode.OK, new APIResult()
{
Success = true,
Message = $"帳號:{Account} / 密碼:{Password}",
Payload = "Access Token"
});
}
else
{
response = this.Request.CreateResponse<APIResult>(HttpStatusCode.Unauthorized, new APIResult()
{
Success = false,
Message = $"",
Payload = "帳號或密碼不正確"
});
}
#endregion
return response;
}
else
{
response = this.Request.CreateResponse<APIResult>(HttpStatusCode.Unauthorized, new APIResult()
{
Success = false,
Message = $"",
Payload = "沒有收到帳號與密碼"
});
return response;
}
}
public bool CanHandleAuthentication(HttpRequestMessage request)
{
bool isSuccess = false;
#region 檢查是否有使用 Authorization: Basic 傳送帳號與密碼到 Web API 伺服器
if ((request.Headers != null
&& request.Headers.Authorization != null
&& request.Headers.Authorization.Scheme.ToLowerInvariant() == "basic"))
{
#region 取出帳號與密碼，帳號與密碼格式為 帳號:密碼
var authHeader = request.Headers.Authorization;
var encodedCredentials = authHeader.Parameter;
var credentialBytes = Convert.FromBase64String(encodedCredentials);
var credentials = Encoding.ASCII.GetString(credentialBytes);
var credentialParts = credentials.Split(':');
if (credentialParts.Length == 2)
{
Account = credentialParts[0];
Password = credentialParts[1];
isSuccess = true;
}
#endregion
}
#endregion
return isSuccess;
}
}
使用 PostMan 來測試登入 API 是否可以正常運作
Authorization: Basic dnVsY2FuOjEyM2FiYw==
- 設定 PostMand 的 Http 方法為
GET，增加一個 Authorization 標頭，其值為 Basic dnVsY2FuOjEyM2FiYw==，如下圖所示，並請點選右上方的 [Send] 按鈕，將會得到底下結果：
{
"Success": true,
"Message": "帳號:vulcan / 密碼:123abc",
"Payload": "Access Token"
}
- 產生出不正確的帳號或密碼的標頭，底下的標頭之帳號為
vulcan / 密碼為 123，如下所示，進行測試
Authorization: Basic dnVsY2FuOjEyMw==
- 設定 PostMand 的 Http 方法為
GET，增加一個 Authorization 標頭，其值為 Basic dnVsY2FuOjEyMw==，如下圖所示，並請點選右上方的 [Send] 按鈕，將會得到底下結果：
{
"Success": false,
"Message": "",
"Payload": "帳號或密碼不正確"
}
- 接著，不要設定 Authorization 標頭，進行測試，將會得到底下結果：
{
"Success": false,
"Message": "",
"Payload": "沒有收到帳號與密碼"
}
產生使用者的存取權杖 Access Token
- 在 LoginController.cs 檔案中，加入底下命名空間參考
using AuthToken.Helpers;
using JWT;
using JWT.Algorithms;
using JWT.Builder;
- 找到這行註解
// 帳號與密碼比對正確，回傳帳密比對正確，在這行註解的上方，加入底下程式碼
#region 產生這次通過身分驗證的存取權杖 Access Token
string secretKey = MainHelper.SecretKey;
#region 設定該存取權杖的有效期限
IDateTimeProvider provider = new UtcDateTimeProvider();
var now = provider.GetNow().AddHours(1);
var unixEpoch = UnixEpoch.Value;
var secondsSinceEpoch = Math.Round((now - unixEpoch).TotalSeconds);
#endregion
var jwtToken = new JwtBuilder()
.WithAlgorithm(new HMACSHA256Algorithm())
.WithSecret(secretKey)
.AddClaim("iss", Account)
.AddClaim("exp", secondsSinceEpoch)
.AddClaim("role", new string[] { "Manager", "People" })
.Build();
#endregion
- 找到這行註解
// 帳號與密碼比對正確，回傳帳密比對正確，在這行註解的下方，將這行程式碼 this.Request.CreateResponse，修改成為底下程式碼，這樣，當使用者傳入一個合法的帳號與密碼，就可以回傳這次身分驗證的存取權杖
response = this.Request.CreateResponse<APIResult>(HttpStatusCode.OK, new APIResult()
{
Success = true,
Message = $"帳號:{Account} / 密碼:{Password}",
Payload = $"{jwtToken}"
});
使用 PostMan 來測試登入 API 是否可以回傳存取權杖 Access Token
Authorization: Basic dnVsY2FuOjEyM2FiYw==
- 設定 PostMand 的 Http 方法為
GET，增加一個 Authorization 標頭，其值為 Basic dnVsY2FuOjEyM2FiYw==，如下圖所示，並請點選右上方的 [Send] 按鈕，將會得到底下結果：
{
"Success": true,
"Message": "帳號:vulcan / 密碼:123abc",
"Payload": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJ2dWxjYW4iLCJleHAiOjE1MTY5NTg4NzUuMCwicm9sZSI6WyJNYW5hZ2VyIiwiUGVvcGxlIl19.cHAktZhijjdbbP5mhb1ICwGdN1GwUrfAyPObq3ZMi-4"
}
04 設計 Web API 需要有存取權杖，才能夠存取這些API服務
如何撰寫用戶端的程式碼，取得存取權杖
using System;
using System.Collections.Generic;
using System.Linq;
using System.Net.Http;
using System.Text;
using System.Threading.Tasks;
namespace GetAccessToken
{
class Program
{
static void Main(string[] args)
{
var TARGETURL = "http://localhost:54891/api/Login";
using (HttpClientHandler handler = new HttpClientHandler())
{
using (HttpClient client = new HttpClient(handler))
{
var byteArray = Encoding.ASCII.GetBytes("vulcan:123abc");
client.DefaultRequestHeaders.Authorization =
new System.Net.Http.Headers.AuthenticationHeaderValue("Basic",
Convert.ToBase64String(byteArray));
HttpResponseMessage response = client.GetAsync(TARGETURL).Result;
HttpContent content = response.Content;
Console.WriteLine("Response StatusCode: " + (int)response.StatusCode);
string result = content.ReadAsStringAsync().Result;
var fooAPIResult = Newtonsoft.Json.JsonConvert.DeserializeObject<APIResult>(result);
Console.WriteLine($"存取權杖為 : {fooAPIResult.Payload}");
Console.WriteLine("Press any key for continuing...");
Console.ReadKey();
}
};
}
}
public class APIResult
{
public bool Success { get; set; } = true;
public string Message { get; set; } = "";
public object Payload { get; set; }
}
}
建立檢查是否存在合法的存取權杖
using AuthToken.Helpers;
using AuthToken.Models;
using JWT;
using JWT.Algorithms;
using JWT.Builder;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Net;
using System.Net.Http;
using System.Net.Http.Formatting;
using System.Security.Principal;
using System.Threading;
using System.Web;
using System.Web.Http;
using System.Web.Http.Controllers;
using System.Web.Http.Filters;
namespace AuthToken.Filters
{
public class JwtAuthAttribute : AuthorizeAttribute
{
public string ErrorMessage { get; set; } = "";
protected override void HandleUnauthorizedRequest(HttpActionContext actionContext)
{
if (string.IsNullOrEmpty(ErrorMessage) == false)
{
setErrorResponse(actionContext, ErrorMessage);
}
else
{
base.HandleUnauthorizedRequest(actionContext);
}
}
public override void OnAuthorization(HttpActionContext actionContext)
{
if (actionContext.Request.Headers.Authorization == null || actionContext.Request.Headers.Authorization.Scheme != "Bearer")
{
setErrorResponse(actionContext, "沒有看到存取權杖錯誤");
}
else
{
try
{
#region 進行存取權杖的解碼
string secretKey = MainHelper.SecretKey;
var json = new JwtBuilder()
.WithAlgorithm(new HMACSHA256Algorithm())
.WithSecret(secretKey)
.MustVerifySignature()
.Decode<Dictionary<string, object>>(actionContext.Request.Headers.Authorization.Parameter);
#endregion
#region 將存取權杖所夾帶的內容取出來
var fooRole = json["role"] as Newtonsoft.Json.Linq.JArray;
var fooRoleList = fooRole.Select(x => (string)x).ToList<string>();
#endregion
#region 將存取權杖的夾帶欄位，儲存到 HTTP 要求的屬性
actionContext.Request.Properties.Add("user", json["iss"] as string);
actionContext.Request.Properties.Add("role", fooRoleList);
#endregion
#region 設定目前 HTTP 要求的安全性資訊
var fooPrincipal =
new GenericPrincipal(new GenericIdentity(json["iss"] as string, "MyPassport"), fooRoleList.ToArray());
if (HttpContext.Current != null)
{
HttpContext.Current.User = fooPrincipal;
}
#endregion
#region 角色權限檢查(檢查控制器或動作之屬性(Attribute上設的 Roles的設定內容)
if (string.IsNullOrEmpty(Roles) == false)
{
bool fooCheckRoleResult = false;
var fooConditionRoles = Roles.Split(',');
foreach (var item in fooConditionRoles)
{
var fooInRole = fooPrincipal.IsInRole(item.Trim());
if (fooInRole == true)
{
fooCheckRoleResult = true;
break;
}
}
if(fooCheckRoleResult == false)
{
setErrorResponse(actionContext, "無效的角色設定，沒有權限使用這個 API");
}
}
#endregion
}
catch (TokenExpiredException)
{
setErrorResponse(actionContext, "權杖已經逾期");
}
catch (SignatureVerificationException)
{
setErrorResponse(actionContext, "權杖似乎不正確，沒有正確的數位簽名");
}
catch (Exception ex)
{
setErrorResponse(actionContext, $"權杖解析發生異常 : {ex.Message}");
}
}
base.OnAuthorization(actionContext);
}
private void setErrorResponse(HttpActionContext actionContext, string message)
{
ErrorMessage = message;
var response = actionContext.Request.CreateErrorResponse(HttpStatusCode.Unauthorized, message);
response.Content = new ObjectContent<APIResult>(new APIResult()
{
Success = false,
Message = ErrorMessage,
Payload = null
}, new JsonMediaTypeFormatter());
actionContext.Response = response;
}
}
}
[JwtAuth]
public class NeedAuthController : ApiController
{
[HttpGet]
public APIResult Get()
{
var fooUser = Request.Properties["user"] as string;
return new APIResult()
{
Success = true,
Message = $"授權使用者為 {fooUser}",
Payload = new string[] { "有提供存取權杖1", "有提供存取權杖2" }
};
}
}
{
"Success": false,
"Message": "沒有看到存取權杖錯誤",
"Payload": null
}
{
"Success": true,
"Message": "帳號:vulcan / 密碼:123abc",
"Payload": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJ2dWxjYW4iLCJleHAiOjE1MTY5Nzk5MzUuMCwicm9sZSI6WyJNYW5hZ2VyIiwiUGVvcGxlIl19.4iGEoBA0SoCiSTBXdAn0J3J_hvVNS1ZeZIP6OeJAPm8"
}
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJ2dWxjYW4iLCJleHAiOjE1MTY5Nzk5MzUuMCwicm9sZSI6WyJNYW5hZ2VyIiwiUGVvcGxlIl19.4iGEoBA0SoCiSTBXdAn0J3J_hvVNS1ZeZIP6OeJAPm8
- 但是，若我們竄改了這個存取權杖，或者權杖的內容被刪去了幾個字元，在這裡，我們把剛剛的權杖刪除最後兩個字元，因此，底下的標題將是我們要送出的內容
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJ2dWxjYW4iLCJleHAiOjE1MTY5Nzk5MzUuMCwicm9sZSI6WyJNYW5hZ2VyIiwiUGVvcGxlIl19.4iGEoBA0SoCiSTBXdAn0J3J_hvVNS1ZeZIP6OeJAP
- 此時，您會得到底下的結果，告訴您的權杖是有問題，並且無法使用這個 Web API
{
"Success": false,
"Message": "權杖解析發生異常 : Illegal base64url string.",
"Payload": null
}
- 由於，發出的存取權杖有效期限為一個小時，若你使用一個小時前發出的權杖，來呼叫這個 Web API，例如，使用底下的標頭。
Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJ2dWxjYW4iLCJleHAiOjE1MTY5Njk0MTUuMCwicm9sZSI6WyJNYW5hZ2VyIiwiUGVvcGxlIl19.8KgvjlRONFIpSnIYD2iTjpY4IWH9vn_ntvI_LwhvBHQ
{
"Success": false,
"Message": "權杖已經逾期",
"Payload": null
}
