Question

我正在使用swagger gen ui，并且正在使用以下设置并关注此GitHub资源。

根据GitHub，这似乎是招摇的已知问题，我使用的是基于jwt barrer的令牌。 https://github.com/domaindrivendev/Swashbuckle.AspNetCore/issues/1425

我已经按照如下所示设置了我的swagger gen

services.AddSwaggerGen(c =>
{

            c.SwaggerDoc("v1", new OpenApiInfo { Title = "App Manager - Running Buddies", Version = "v1" });

            c.AddSecurityDefinition("Bearer", new OpenApiSecurityScheme {
                Description = "JWT Authorization header using the Bearer scheme.",
                Name = "Authorization",
                In = ParameterLocation.Header,
                Type = SecuritySchemeType.ApiKey,
                Scheme = "bearer"
            });

            c.AddSecurityRequirement(new OpenApiSecurityRequirement
            {
            {
                new OpenApiSecurityScheme
                {
                    Reference = new OpenApiReference
                    {
                        Type = ReferenceType.SecurityScheme,
                        Id = "Bearer"
                    }
                }, new List<string>()
            }
        });
   });

curl -X GET“ https://localhost:44396/api/BmiInformations” -H“接受： text / plain“ -H”授权： eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE1OTAxOTMyNzQsImlzcyI6Imh0dHBzOi8vbG9jYWxob3N0OjQ0Mzk2LyIsImF1ZCI6Imh0dHBzOi8vbG9jYWxob3N0OjQ0Mzk2LyJ9.cbePeT9RJprvTWyQECiUCaoqjc25eFKtf7jh5DwOnU0"

但是我仍然得到401未经授权，我使用的是基于JWT的有效令牌。

private string BuildToken(LoginModel login) {
    var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_config["JwtToken:SecretKey"]));
    var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
    JwtSecurityToken token;

    token = new JwtSecurityToken(_config["JwtToken:Issuer"],
    _config["JwtToken:Issuer"], expires: DateTime.Now.AddMinutes(30),
    signingCredentials: creds); 
    return new JwtSecurityTokenHandler().WriteToken(token);
    }

private UserModel Authenticate(LoginModel login) {
    UserModel user = null;
    //var result = await _signInManager.PasswordSignInAsync(, lockoutOnFailure: false);
    if (login.Username == "mario" && login.Password == "secret") {
        user = new UserModel { UserName = "Mario Rossi", Email = "mario.rossi@domain.com" };
    }
     return user;
}

这就是建立我的过滤器的方式。

 public class AddAuthHeaderOperationFilter : IOperationFilter {

    public void Apply(OpenApiOperation operation, OperationFilterContext context) {
        if (operation.Security == null)
            operation.Security = new List<OpenApiSecurityRequirement>();


        var scheme = new OpenApiSecurityScheme { Reference = new OpenApiReference { Type = ReferenceType.SecurityScheme, Id = "bearer" } };
        operation.Security.Add(new OpenApiSecurityRequirement {
            [scheme] = new List<string>()
        });
    }

我在加油之后加入了。但是它仍然没有显示barrer这个词

 services.AddDbContext<AppManagerDL.AppManagerDBContext>
 (options => options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection")));
 services.AddSwaggerGen(c =>
    {              
            c.SwaggerDoc("v1", new OpenApiInfo { Title = "App Manager - Running Buddies", Version = "v1" });
            c.AddSecurityDefinition("Bearer", new OpenApiSecurityScheme
        {
            Description = "JWT Authorization header using the Bearer scheme.",
            Name = "Authorization",
            In = ParameterLocation.Header,
            Type = SecuritySchemeType.ApiKey,
            Scheme = "bearer"
        });

       c.OperationFilter<AddAuthHeaderOperationFilter>();

编辑4 好的，所以现在我可以在卷发中正确显示Barrer了，但是现在它说签名是无效的，即使它从我的appsettings中获得了正确的签名。

curl -X GET“ https://localhost:44396/api/BmiInformations” -H“接受： text / plain“ -H”授权：不记名 eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE1OTAxOTc0MTcsImlzcyI6Imh0dHBzOi8vbG9jYWxob3N0OjQ0Mzk2LyIsImF1ZCI6Imh0dHBzOi8vbG9jYWxob3N0OjQ0Mzk2LyJ9.fLWxG1bRX6yCTqFe8XZbgL6Lh1RNcmVFX-636ZvqhNg“

我的设置如下启动。

 public void ConfigureServices(IServiceCollection services) {

        services.AddDbContext<AppManagerDL.AppManagerDBContext>
          (options => options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection")));

        services.AddSwaggerGen(c => {

            c.SwaggerDoc("v1", new OpenApiInfo { Title = "App Manager - Running Buddies", Version = "v1" });

            c.AddSecurityDefinition("Bearer", new OpenApiSecurityScheme {
                Description = "JWT Authorization header using the Bearer scheme.",
                Name = "Authorization",
                In = ParameterLocation.Header,
                Type = SecuritySchemeType.Http,
                Scheme = "bearer",
                BearerFormat = "JWT"

            });

            c.AddSecurityRequirement(new OpenApiSecurityRequirement{
{
    new OpenApiSecurityScheme{
        Reference = new OpenApiReference{
            Id = "Bearer", //The name of the previously defined security scheme.
            Type = ReferenceType.SecurityScheme
        }
    },new List<string>()
  }
});

我现在遇到的确切错误是

日期：星期六，2020年5月23日01:04:11 GMT服务器：Microsoft-IIS / 10.0
状态：401 www-authenticate：承载错误=“ invalid_token”， error_description =“签名无效” x-powered by：ASP.NET

Answer 1

尝试以此替换您当前的安全性定义：

c.AddSecurityDefinition("Bearer", new OpenApiSecurityScheme
{
    Description = "JWT Authorization header using the Bearer scheme.",
    Name = "Authorization",
    In = ParameterLocation.Header,
    Scheme = "bearer",
    Type = SecuritySchemeType.Http,
    BearerFormat = "JWT"
});

卷曲附加授权标头，但控制器仍为401

1 个答案: