身份验证（authentication）的责任是识别出http请求者的身份，除此之外尽量不要管其它的事。webapi的authentication我用authentication filter技术去解决。

参考资料：

https://docs.microsoft.com/en-us/aspnet/web-api/overview/security/authentication-filters

步骤如下

创建authentication filter

在项目里新建文件夹Security，并在此文件夹里创建IdentityBasicAuthentication类，代码如下

using System; using System.Threading; using System.Threading.Tasks; using System.Web.Http.Filters; namespace webapi.Security { public class IdentityBasicAuthentication:IAuthenticationFilter { public bool AllowMultiple { get; } public Task AuthenticateAsync(HttpAuthenticationContext context, CancellationToken cancellationToken) { throw new NotImplementedException(); } public Task ChallengeAsync(HttpAuthenticationChallengeContext context, CancellationToken cancellationToken) { throw new NotImplementedException(); } } }

继承自IauthenticationFilter，实现自己的业务代码（后面再实现）

注册authentication filter

在webapi的config里加入filter，修改项目代码如下

 /// <summary> /// 返回webapi的httpconfiguration配置 /// 用于webapi应用于owin技术时使用 /// </summary> /// <returns></returns> public static HttpConfiguration OwinWebApiConfiguration(HttpConfiguration config) { config.MapHttpAttributeRoutes();//开启属性路由 config.Routes.MapHttpRoute( name: "DefaultApi", routeTemplate: "api/{controller}/{id}", defaults: new { id = RouteParameter.Optional } ); config.Filters.Add(new WebApiExceptionFilterAttribute()); config.Filters.Add(new IdentityBasicAuthentication()); return config; }

即上一句：config.Filters.Add(new IdentityBasicAuthentication());

现在webapi的authentication机制的结构已经完成，剩下要做的就是在结构里填其它的代码了。

加入JWT机制

其实jwt的代码我们要写的很少，不要自己去实现jwt规范，可以用已经有的jwt的.net包。

在nuget里添加jwt.net包

修改authentication filter代码，加入jwt逻辑

using System.Linq; using System.Net; using System.Net.Http; using System.Security.Claims; using System.Threading; using System.Threading.Tasks; using System.Web.Http.Filters; using System.Web.Http.Results; using webapi.Common; using webapi.Configs; namespace webapi.Security { public class IdentityBasicAuthentication:IAuthenticationFilter { public bool AllowMultiple { get; } /// <summary> /// 请求先经过AuthenticateAsync /// </summary> /// <param name="context"></param> /// <param name="cancellationToken"></param> /// <returns></returns> public Task AuthenticateAsync(HttpAuthenticationContext context, CancellationToken cancellationToken) { // 1、获取token context.Request.Headers.TryGetValues("token", out var tokenHeaders); // 2、如果没有token，不做任何处理 if (tokenHeaders == null || !tokenHeaders.Any()) { return Task.FromResult(0); } // 3、如果token验证通过，则写入到identity，如果未通过则设置错误 var jwtHelper=new JWTHelper(); var payLoadClaims=jwtHelper.DecodeToObject(tokenHeaders.FirstOrDefault(),Config.JWTKey, out bool isValid, out string errMsg); if (isValid) { var identity = new ClaimsIdentity("jwt", "userId", "roles");//只要ClaimsIdentity设置了authenticationType，authenticated就为true，后面的authority根据authenticated=true来做权限 foreach (var keyValuePair in payLoadClaims) { identity.AddClaim(new Claim(keyValuePair.Key, keyValuePair.Value.ToString())); } // 最好是http上下文的principal和进程的currentPrincipal都设置 context.Principal = new ClaimsPrincipal(identity); Thread.CurrentPrincipal = new ClaimsPrincipal(identity); } else { context.ErrorResult = new ResponseMessageResult(new HttpResponseMessage() { StatusCode = HttpStatusCode.ProxyAuthenticationRequired, Content = new StringContent(errMsg) }); } return Task.FromResult(0); } /// <summary> /// 请求后经过AuthenticateAsync /// </summary> /// <param name="context"></param> /// <param name="cancellationToken"></param> /// <returns></returns> public Task ChallengeAsync(HttpAuthenticationChallengeContext context, CancellationToken cancellationToken) { return Task.FromResult(0); } } }

附上JWTHelper.cs代码

JWT.net的用法参考：https://github.com/jwt-dotnet/jwt

using JWT; using JWT.Algorithms; using JWT.Serializers; using System; using System.Collections.Generic; namespace webapi.Common { public class JWTHelper { private IJsonSerializer _jsonSerializer; private IDateTimeProvider _dateTimeProvider; private IJwtValidator _jwtValidator; private IBase64UrlEncoder _base64UrlEncoder; private IJwtAlgorithm _jwtAlgorithm; private IJwtDecoder _jwtDecoder; private IJwtEncoder _jwtEncoder; public JWTHelper() { //非fluent写法 this._jsonSerializer = new JsonNetSerializer(); this._dateTimeProvider = new UtcDateTimeProvider(); this._jwtValidator = new JwtValidator(_jsonSerializer, _dateTimeProvider); this._base64UrlEncoder = new JwtBase64UrlEncoder(); this._jwtAlgorithm = new HMACSHA256Algorithm(); this._jwtDecoder = new JwtDecoder(_jsonSerializer, _jwtValidator, _base64UrlEncoder); this._jwtEncoder = new JwtEncoder(_jwtAlgorithm, _jsonSerializer, _base64UrlEncoder); } public string Decode(string token, string key, out bool isValid, out string errMsg) { isValid = false; var result = string.Empty; try { result = _jwtDecoder.Decode(token, key, true); isValid = true; errMsg = "正确的token"; return result; } catch (TokenExpiredException) { errMsg = "token过期"; return result; } catch (SignatureVerificationException) { errMsg = "签名无效"; return result; } catch (Exception) { errMsg = "token无效"; return result; } } public T DecodeToObject<T>(string token, string key, out bool isValid, out string errMsg) { isValid = false; try { var result = _jwtDecoder.DecodeToObject<T>(token, key, true); isValid = true; errMsg = "正确的token"; return result; } catch (TokenExpiredException) { errMsg = "token过期"; return default(T); } catch (SignatureVerificationException) { errMsg = "签名无效"; return default(T); } catch (Exception) { errMsg = "token无效"; return default(T); } } public IDictionary<string, object> DecodeToObject(string token, string key, out bool isValid, out string errMsg) { isValid = false; try { var result = _jwtDecoder.DecodeToObject(token, key, true); isValid = true; errMsg = "正确的token"; return result; } catch (TokenExpiredException) { errMsg = "token过期"; return null; } catch (SignatureVerificationException) { errMsg = "签名无效"; return null; } catch (Exception) { errMsg = "token无效"; return null; } } #region 解密 public string Encode(Dictionary<string, object> payload, string key, int expiredMinute = 30) { if (!payload.ContainsKey("exp")) { var exp = Math.Round((_dateTimeProvider.GetNow().AddMinutes(expiredMinute) - new DateTime(1970, 1, 1)).TotalSeconds); payload.Add("exp", exp); } return _jwtEncoder.Encode(payload, key); } #endregion } }

测试结果

创建SecurityTestController.cs控制器

using System; using System.Collections.Generic; using System.Linq; using System.Net; using System.Net.Http; using System.Security.Claims; using System.Web.Http; using webapi.Common; namespace webapi.example { [RoutePrefix("api/security")] public class SecurityTestController : ApiController { /// <summary> /// 通过get请求里传过来的值生成token /// </summary> /// <returns></returns> [Route("token"),HttpGet] public IHttpActionResult GetToken() { var dic=new Dictionary<string,object>(); foreach (var queryNameValuePair in Request.GetQueryNameValuePairs()) { dic.Add(queryNameValuePair.Key,queryNameValuePair.Value); } var token=new JWTHelper().Encode(dic, "shengyu",30); return Ok(token); } /// <summary> /// 返回token里加密的信息 /// </summary> /// <returns></returns> [Route("GetUserInfoFromToken"),HttpGet] public IHttpActionResult GetUser() { var user = (ClaimsPrincipal)User; var dic=new Dictionary<string,object>(); foreach (var userClaim in user.Claims) { dic.Add(userClaim.Type,userClaim.Value); } return Ok(dic); } } }

获取一个测试token