ASP.NET WebApi 基于JWT实现Token签名认证(发布版)

首先，我们需要安装 Microsoft.AspNet.WebApi 和 Microsoft.Owin.Security.Jwt NuGet 包。
接下来，我们需要在 WebApiConfig.cs 文件中配置 Web API 路由：
public static void Register(HttpConfiguration config)
{
// 配置路由
config.MapHttpAttributeRoutes();

config.Routes.MapHttpRoute(
name: "DefaultApi",
routeTemplate: "api/{controller}/{id}",
defaults: new { id = RouteParameter.Optional }
);

// 配置 JWT 认证
ConfigureJwtAuth(config);
}

然后，我们需要在 Web.config 文件中配置 JWT 令牌的密钥和有效期：
<appSettings>
<add key="jwtSecret" value="my_secret_key" />
<add key="jwtExpireDays" value="7" />
</appSettings>

接下来，我们需要创建一个 JwtAuthManager 类来管理 JWT 认证：
using System;
using System.Collections.Generic;
using System.IdentityModel.Tokens.Jwt;
using System.Linq;
using System.Security.Claims;
using System.Text;
using Microsoft.IdentityModel.Tokens;

public class JwtAuthManager : IJwtAuthManager
{
private readonly string _jwtSecret;
private readonly double _jwtExpireDays;

public JwtAuthManager(string jwtSecret, double jwtExpireDays)
{
_jwtSecret = jwtSecret;
_jwtExpireDays = jwtExpireDays;
}

public string GenerateToken(IEnumerable<Claim> claims)
{
var key = Encoding.ASCII.GetBytes(_jwtSecret);
var jwtToken = new JwtSecurityToken(
claims: claims,
expires: DateTime.Now.AddDays(_jwtExpireDays),
signingCredentials: new SigningCredentials(
new SymmetricSecurityKey(key),
SecurityAlgorithms.HmacSha256Signature)
);
var token = new JwtSecurityTokenHandler().WriteToken(jwtToken);
return token;
}
}

然后，我们需要创建一个 JwtAuthAttribute 特性，用于在控制器或操作方法上应用 JWT 认证：
[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
public class JwtAuthAttribute : AuthorizeAttribute
{
public override void OnAuthorization(HttpActionContext actionContext)
{
try
{
var token = actionContext.Request.Headers.Authorization.Parameter;
var jwtAuthManager = actionContext.ControllerContext.Configuration
.DependencyResolver.GetService(typeof(IJwtAuthManager)) as IJwtAuthManager;
var principal = jwtAuthManager.ValidateToken(token);
Thread.CurrentPrincipal = principal;
HttpContext.Current.User = principal;
}
catch (Exception)
{
actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.Unauthorized);
return;
}

base.OnAuthorization(actionContext);
}
}

最后，我们需要在 ConfigureJwtAuth 方法中注册依赖项并配置 JWT 认证：
private static void ConfigureJwtAuth(HttpConfiguration config)
{
var jwtSecret = ConfigurationManager.AppSettings["jwtSecret"];
var jwtExpireDays = double.Parse(ConfigurationManager.AppSettings["jwtExpireDays"]);

var container = new UnityContainer();
container.RegisterType<IJwtAuthManager, JwtAuthManager>(
new InjectionConstructor(jwtSecret, jwtExpireDays));
config.DependencyResolver = new UnityResolver(container);

config.Filters.Add(new JwtAuthAttribute());
}

现在，我们可以在控制器或操作方法上应用 JwtAuth 特性来启用 JWT 认证：
[RoutePrefix("api/products")]
public class ProductsController : ApiController
{
[HttpGet]
[Route("")]
[JwtAuth]
public IHttpActionResult Get()
{
// ...
}

[HttpGet]
[Route("{id}")]
[JwtAuth]
public IHttpActionResult Get(int id)
{
// ...
}

[HttpPost]
[Route("")]
[JwtAuth]
public IHttpActionResult Post([FromBody] Product product)
{
// ...
}

// ...
}

这样，我们就成功地基于 JWT 实现了 Token 签名认证。