在当前的HttpContext会话中设置新的access_token

Question

Helloes。我正在使用Identity Server 4实现令牌提供程序，并希望将我的客户端应用程序提供给用户刷新令牌。

使用以下代码，我可以成功请求一对新的 access_token 和 refresh_token 并正确调用API

public async Task<IActionResult> CallApiUsingUserRefreshToken()
{
   var oldAccessToken = await HttpContext.GetTokenAsync("access_token");
   var oldRefreshToken = await HttpContext.GetTokenAsync("refresh_token");

   var tokenClient = new TokenClient("http://localhost:5000/connect/token", "mvc", "secret");
   var newToken = await tokenClient.RequestRefreshTokenAsync(oldRefreshToken);

   var client = new HttpClient();
   client.SetBearerToken(newToken.AccessToken);
   var content = await client.GetStringAsync("http://localhost:5001/identity");

   ViewBag.Json = JArray.Parse(content).ToString();
   return View("json");
}

现在问题是，如何在会话cookie中存储这个新对？ 因此，下次我使用此方法时，我会使用await HttpContext.GetTokenAsync("access_token")我获取最新的令牌

实施例

对CallApiUsingUserRefreshToken()

的第一次请求

旧的access_token eyJhbGciOiJSUzI1NiIsImtpZCI6IjY5YTA1ZDE5NTZiNjM1YTI5OTRkN2Q4MmUzOTVlZDNlIiwidHlwIjoiSldUIn0.eyJuYmYiOjE1MTAxNTA4ODIsImV4cCI6MTUxMDE1MDkxMiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo1MDAwIiwiYXVkIjpbImh0dHA6Ly9sb2NhbGhvc3Q6NTAwMC9yZXNvdXJjZXMiLCJhcGkxIl0sImNsaWVudF9pZCI6Im12YyIsInN1YiI6IjY2MzQyOWUzLTIwNTYtNDg1OC1iN2RhLThmYjhiMDI4YTEyZiIsImF1dGhfdGltZSI6MTUxMDE1MDg4MCwiaWRwIjoibG9jYWwiLCJzY29wZSI6WyJvcGVuaWQiLCJwcm9maWxlIiwiYXBpMSIsIm9mZmxpbmVfYWNjZXNzIl0sImFtciI6WyJwd2QiXX0.JJ4LhrEY05Z0CMKp9V81ur2ufZZSCmE2M0ACKsfqIMrq84eFg2IHu5RlbL7Tn4nD6TQj-6aLvhmJ0RunFOp4t1Sx-Qq_tgAsue5d5hEMZH-XK-gdf5wR94uNJX1imMSDsqD4C_IOiebeoAHHxGj39vHQvvQrZMeKsX1_o7h5XteCBfB51PclYycBZsu5iDV-EbbQaXCSjNlmWifYyCN52pwDeLcKLJp6rjEy765SJ50C8Zymuwjj7PHgvway_Sr5W0F-oNkUO-wqy60sFPaK3D62KuUpSIKVUUh4B164jkpUY0NiJefDAHogVTcSBsRbeJj6m6oiBGzKxx5JCCBB2g

旧的refresh_token 981eb24796cf0bf191f0845cb82a708420683de3bc5f7e4c07859287587bc43c

new access_token eyJhbGciOiJSUzI1NiIsImtpZCI6IjY5YTA1ZDE5NTZiNjM1YTI5OTRkN2Q4MmUzOTVlZDNlIiwidHlwIjoiSldUIn0.eyJuYmYiOjE1MTAxNTMwMDUsImV4cCI6MTUxMDE1MzAzNSwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo1MDAwIiwiYXVkIjpbImh0dHA6Ly9sb2NhbGhvc3Q6NTAwMC9yZXNvdXJjZXMiLCJhcGkxIl0sImNsaWVudF9pZCI6Im12YyIsInN1YiI6IjY2MzQyOWUzLTIwNTYtNDg1OC1iN2RhLThmYjhiMDI4YTEyZiIsImF1dGhfdGltZSI6MTUxMDE1MDg4MCwiaWRwIjoibG9jYWwiLCJzY29wZSI6WyJvcGVuaWQiLCJwcm9maWxlIiwiYXBpMSIsIm9mZmxpbmVfYWNjZXNzIl0sImFtciI6WyJwd2QiXX0.N3cKXJSgLip_6TP-c9WIJsR6vsOMthBr7ORgio02KUQe1C6KqF1dBCGTm7T43LY9UpRPFGRMj5o4Wf2NyAkd7PkmHAJio4dh-1L0ivNuXbLo7jbfC5svhN4FszmDQPBMS_uidXRXZ5Cqe47TD-kTgMWGijXkXmPRXYu_rA181tbM8uPWJZtDlagQ_exFC1ZS_0gaNzJ7b6_d7eGV5tI6o31VBZXoPIwA1mT56hL-UO9PvEKs6RhGCAfelo0KKKrZ8eNeozTNPzXwCUYYyW3fsUmuKL8rtDqJIPiyH9gyzxWZeG0xkGlozSsgvPLtLvuA7nB0sqtko7Kpgl_8ECXKRQ

new refres_token 19a81ad1d0a4ef9ebe31a84b2313a1e8c372a3cfb1d2a482e13112576ab5c03a

对CallApiUsingUserRefreshToken()

的第二次请求

旧的access_token eyJhbGciOiJSUzI1NiIsImtpZCI6IjY5YTA1ZDE5NTZiNjM1YTI5OTRkN2Q4MmUzOTVlZDNlIiwidHlwIjoiSldUIn0.eyJuYmYiOjE1MTAxNTA4ODIsImV4cCI6MTUxMDE1MDkxMiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo1MDAwIiwiYXVkIjpbImh0dHA6Ly9sb2NhbGhvc3Q6NTAwMC9yZXNvdXJjZXMiLCJhcGkxIl0sImNsaWVudF9pZCI6Im12YyIsInN1YiI6IjY2MzQyOWUzLTIwNTYtNDg1OC1iN2RhLThmYjhiMDI4YTEyZiIsImF1dGhfdGltZSI6MTUxMDE1MDg4MCwiaWRwIjoibG9jYWwiLCJzY29wZSI6WyJvcGVuaWQiLCJwcm9maWxlIiwiYXBpMSIsIm9mZmxpbmVfYWNjZXNzIl0sImFtciI6WyJwd2QiXX0.JJ4LhrEY05Z0CMKp9V81ur2ufZZSCmE2M0ACKsfqIMrq84eFg2IHu5RlbL7Tn4nD6TQj-6aLvhmJ0RunFOp4t1Sx-Qq_tgAsue5d5hEMZH-XK-gdf5wR94uNJX1imMSDsqD4C_IOiebeoAHHxGj39vHQvvQrZMeKsX1_o7h5XteCBfB51PclYycBZsu5iDV-EbbQaXCSjNlmWifYyCN52pwDeLcKLJp6rjEy765SJ50C8Zymuwjj7PHgvway_Sr5W0F-oNkUO-wqy60sFPaK3D62KuUpSIKVUUh4B164jkpUY0NiJefDAHogVTcSBsRbeJj6m6oiBGzKxx5JCCBB2g

旧的refresh_token 981eb24796cf0bf191f0845cb82a708420683de3bc5f7e4c07859287587bc43c

new access_token eyJhbGciOiJSUzI1NiIsImtpZCI6IjY5YTA1ZDE5NTZiNjM1YTI5OTRkN2Q4MmUzOTVlZDNlIiwidHlwIjoiSldUIn0.eyJuYmYiOjE1MTAxNTMwMTQsImV4cCI6MTUxMDE1MzA0NCwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo1MDAwIiwiYXVkIjpbImh0dHA6Ly9sb2NhbGhvc3Q6NTAwMC9yZXNvdXJjZXMiLCJhcGkxIl0sImNsaWVudF9pZCI6Im12YyIsInN1YiI6IjY2MzQyOWUzLTIwNTYtNDg1OC1iN2RhLThmYjhiMDI4YTEyZiIsImF1dGhfdGltZSI6MTUxMDE1MDg4MCwiaWRwIjoibG9jYWwiLCJzY29wZSI6WyJvcGVuaWQiLCJwcm9maWxlIiwiYXBpMSIsIm9mZmxpbmVfYWNjZXNzIl0sImFtciI6WyJwd2QiXX0.AMV5DblN48MxvWm4qbMNcAgGYTYGb0Rz-LAMX2-jAGtQhkis8tauWfpugm0aU_tCbwn6ktUQN1UepBCLpVe9qAo1hC4E_YDrhqxEKCrJK3NhWEYloNMAxFUJVak2rRO81gjH7zHZ-HvdxZaSzG2CGpkKOZKbnCuPSkXbUr_dgAulKH7Ul2hunqH9dCbX-BE9X7-ZjO6cXm8tZHOdRJBm7NsEvVo1bbSaTx4uEX0HDEX01uQAiUx6fz2j4Exp5A9CdlQhkqH4h5hSP3D3XvtH9wpRpD-kWlMRMxSwXeJ7P0OQMn04WOM-sGFXQFfUHwKxvSuMxcOx1MzUJF5-1W-KFG

new refres_token 9b0130de391db80b5b7499f18297b84af79a4f6ef423fdd85fb4e7f487611562

我正在查看如何设置第一个请求中的新 access_token 和 refresh_token ，然后在第二个请求中使用

Answer 1

最终想通了。

对于想要在.Net身份验证Cookie中更新其当前令牌的任何人，您应该使用Microsoft身份验证包中提供的TokenStore

var auth = await HttpContext.AuthenticateAsync("Cookies");
auth.Properties.StoreTokens(new List<AuthenticationToken>()
{
    new AuthenticationToken()
    {
        Name = OpenIdConnectParameterNames.AccessToken,
        Value = newToken.AccessToken
    },
    new AuthenticationToken()
    {
        Name = OpenIdConnectParameterNames.RefreshToken,
        Value = newToken.RefreshToken
    }
});

await HttpContext.SignInAsync(auth.Principal, auth.Properties);

当执行 HttpContext.SignInAsync 时，这将覆盖会话中的 access_token 和 refres_token ，这适用于.Net Core 2.0 < / p>

Answer 2

在ASP.NET Core 2.2中，您可以使用以下内容来更新而不是替换令牌。

var auth = await HttpContext.AuthenticateAsync(AuthenticationScheme.Cookie)
                            .ConfigureAwait(false);

auth.Properties.UpdateTokenValue(OpenIdConnectParameterNames.AccessToken,
                                 newToken.AccessToken);
auth.Properties.UpdateTokenValue(OpenIdConnectParameterNames.RefreshToken, 
                                 newToken.RefreshToken);

await HttpContext.SignInAsync(auth.Principal, auth.Properties)
                 .ConfigureAwait(false);

这样，如果cookie包含其他令牌（例如id_token），它将仍然可用。