Question

从这个很棒的教程我已经能够在服务器上生成一个令牌并将其保存为本地存储。 https://stormpath.com/blog/token-authentication-asp-net-core

但是当将令牌发送到具有[Authorize]属性的控制器方法时，我得到401

我的startup.cs看起来像这样

    //ConfigureTokenSecurity(app, env);
    var signingKey = new SymmetricSecurityKey(Encoding.ASCII.GetBytes(secretKey));

    var options = new TokenProviderOptions
    {
        //Audience = "ExampleAudience",
        //Issuer = "ExampleIssuer",
        SigningCredentials = new SigningCredentials(signingKey, SecurityAlgorithms.HmacSha256),
    };

    app.UseMiddleware<TokenProviderMiddleware>(Options.Create(options));

    var tokenValidationParameters = new TokenValidationParameters
    {
        // The signing key must match!
        ValidateIssuerSigningKey = true,
        IssuerSigningKey = signingKey,

        // Validate the JWT Issuer (iss) claim
        ValidateIssuer = false,
        //ValidIssuer = "ExampleIssuer",

        // Validate the JWT Audience (aud) claim
        ValidateAudience = false,
        //ValidAudience = "ExampleAudience",

        // Validate the token expiry
        ValidateLifetime = false,

        // If you want to allow a certain amount of clock drift, set that here:
        ClockSkew = TimeSpan.Zero
    };

    app.UseJwtBearerAuthentication(new JwtBearerOptions
    {
        AutomaticAuthenticate = true,
        AutomaticChallenge = true,
        TokenValidationParameters = tokenValidationParameters
    });

并且打字稿请求看起来像这样

 public getValuesHandler(
        onSuccess: (values: string[]) => void,
        onError: (error: any) => void = undefined
    ): void {
        debugger;
        let headers = new Headers({ 'Authorization': 'Bearer ' + this.authorisationService.token, 'Expires': this.authorisationService.tokenExpires, 'Content-Type': 'application/json'  });
        let options = new RequestOptions({ headers: headers });

        const url = "/api/sandbox/get";
        this.http.get(url, options)
            .map(response => <string[]>response.json())
            .subscribe(onSuccess, error => {
                this.recordError(url, error);
                if (onError) onError(error);
            });
    }

奇怪的是，如果我通过

运行令牌

TokenHandler.ValidateToken(t, tokenValidationParameters, out validatedToken);

没有承载者，它会返回一个有效的令牌，但是如果该令牌有一个“持有者”。在开始的时候，我得到了一个＆＃34; JWT没有很好的例外＆＃34;

授权属性拒绝有效JwtSecurityToken的请求

0 个答案: