問題描述

我正在嘗試使用 ASP.NET Core 實現(xiàn)一個非常簡單的 JWT 不記名身份驗證.我從控制器返回的響應有點像這樣:

I'm trying to do a really simple implementation of JWT bearer authentication with ASP.NET Core. I return a response from a controller a bit like this:

    var identity = new ClaimsIdentity();
    identity.AddClaim(new Claim(ClaimTypes.Name, applicationUser.UserName));
        var jwt = new JwtSecurityToken(
             _jwtOptions.Issuer,
             _jwtOptions.Audience,
             identity.Claims,
             _jwtOptions.NotBefore,
             _jwtOptions.Expiration,
             _jwtOptions.SigningCredentials);

       var encodedJwt = new JwtSecurityTokenHandler().WriteToken(jwt);

       return new JObject(
           new JProperty("access_token", encodedJwt),
           new JProperty("token_type", "bearer"),
           new JProperty("expires_in", (int)_jwtOptions.ValidFor.TotalSeconds),
           new JProperty(".issued", DateTimeOffset.UtcNow.ToString())
       );

我有用于傳入請求的 Jwt 中間件:

I have Jwt middleware for incoming requests:

app.UseJwtBearerAuthentication(new JwtBearerOptions
{
     AutomaticAuthenticate = true,
     AutomaticChallenge = true,
     TokenValidationParameters = tokenValidationParameters
});

這似乎可以使用 authorize 屬性保護資源，但聲明從未出現(xiàn).

This seems to work to protect resources with the authorize attribute, but the claims never show up.

    [Authorize]
    public async Task<IActionResult> Get()
    {
        var user = ClaimsPrincipal.Current.Claims; // Nothing here

推薦答案

您不能在 ASP.NET Core 應用程序中使用 ClaimsPricipal.Current，因為它不是由運行時設置的.您可以閱讀 https://github.com/aspnet/Security/issues/322 了解更多信息.

You can't use ClaimsPricipal.Current in an ASP.NET Core application, as it's not set by the runtime. You can read https://github.com/aspnet/Security/issues/322 for more information.

相反，請考慮使用 ControllerBase 公開的 User 屬性.

Instead, consider using the User property, exposed by ControllerBase.

這篇關(guān)于無法使用 ASP.NET Core 從 JWT 令牌獲取聲明的文章就介紹到這了，希望我們推薦的答案對大家有所幫助，也希望大家多多支持html5模板網(wǎng)！