C#中間件如何集成JWT刷新令牌

在C#中，我們可以使用ASP.NET Core框架來實現JWT（JSON Web Token）的刷新令牌功能。以下是一個簡單的示例，展示了如何在C#中間件中集成JWT刷新令牌：

1. 首先，確保已經安裝了以下NuGet包：

   • Microsoft.AspNetCore.Authentication.JwtBearer
   • System.IdentityModel.Tokens.Jwt

2. 在Startup.cs文件中，配置JWT認證和授權：

using System.Text;
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.IdentityModel.Tokens;

public class Startup
{
    public IConfiguration Configuration { get; }

    public void ConfigureServices(IServiceCollection services)
    {
        // 從appsettings.json文件中獲取JWT相關配置
        var jwtSettings = Configuration.GetSection("JwtSettings");
        var key = Encoding.ASCII.GetBytes(jwtSettings["SecretKey"]);

        // 配置JWT認證
        services.AddAuthentication(x =>
        {
            x.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
            x.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
        })
        .AddJwtBearer(x =>
        {
            x.RequireHttpsMetadata = false;
            x.SaveToken = true;
            x.TokenValidationParameters = new TokenValidationParameters
            {
                ValidateIssuerSigningKey = true,
                IssuerSigningKey = new SymmetricSecurityKey(key),
                ValidateIssuer = false,
                ValidateAudience = false
            };
        });

        // 配置授權
        services.AddAuthorization();
    }
}

3. 創建一個用于生成和驗證JWT令牌的服務：

using System;
using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Text;
using Microsoft.Extensions.Configuration;
using Microsoft.IdentityModel.Tokens;

public class JwtService
{
    private readonly IConfiguration _configuration;

    public JwtService(IConfiguration configuration)
    {
        _configuration = configuration;
    }

    public string GenerateToken(string userId)
    {
        var jwtSettings = _configuration.GetSection("JwtSettings");
        var key = Encoding.ASCII.GetBytes(jwtSettings["SecretKey"]);

        var tokenDescriptor = new SecurityTokenDescriptor
        {
            Subject = new ClaimsIdentity(new[]
            {
                new Claim(ClaimTypes.NameIdentifier, userId)
            }),
            Expires = DateTime.UtcNow.AddMinutes(60),
            SigningCredentials = new SigningCredentials(new SymmetricSecurityKey(key), SecurityAlgorithms.HmacSha256Signature)
        };

        var tokenHandler = new JwtSecurityTokenHandler();
        var token = tokenHandler.CreateToken(tokenDescriptor);

        return tokenHandler.WriteToken(token);
    }

    public ClaimsPrincipal ValidateToken(string token)
    {
        try
        {
            var jwtSettings = _configuration.GetSection("JwtSettings");
            var key = Encoding.ASCII.GetBytes(jwtSettings["SecretKey"]);

            var validationParameters = new TokenValidationParameters
            {
                ValidateIssuerSigningKey = true,
                IssuerSigningKey = new SymmetricSecurityKey(key),
                ValidateIssuer = false,
                ValidateAudience = false
            };

            var tokenHandler = new JwtSecurityTokenHandler();
            var principal = tokenHandler.ValidateToken(token, validationParameters, out _);

            return principal;
        }
        catch (Exception)
        {
            return null;
        }
    }
}

4. 在appsettings.json文件中添加JWT相關配置：

{
  "JwtSettings": {
    "SecretKey": "your_secret_key"
  }
}

5. 在需要的地方使用JwtService生成和驗證JWT令牌。例如，在登錄成功后生成令牌并返回給客戶端：

[HttpPost("login")]
public async Task<IActionResult> Login([FromBody] LoginRequest request)
{
    // 驗證用戶名和密碼
    var user = await _userService.Authenticate(request.Username, request.Password);

    if (user == null)
    {
        return Unauthorized();
    }

    // 生成JWT令牌
    var token = _jwtService.GenerateToken(user.Id);

    return Ok(new { token });
}

6. 對于需要刷新令牌的API，可以在控制器或操作方法上添加[Authorize]屬性，然后在操作方法中使用JwtService驗證令牌。如果令牌有效，生成新的令牌并返回給客戶端。

[HttpPost("refresh-token")]
[Authorize]
public IActionResult RefreshToken()
{
    var token = Request.Headers["Authorization"].ToString().Split(' ')[1];
    var principal = _jwtService.ValidateToken(token);

    if (principal == null)
    {
        return Unauthorized();
    }

    var userId = principal.FindFirst(ClaimTypes.NameIdentifier)?.Value;
    var newToken = _jwtService.GenerateToken(userId);

    return Ok(new { token = newToken });
}

這樣，你就可以在C#中間件中集成JWT刷新令牌功能了。請注意，這只是一個簡單的示例，實際項目中可能需要根據具體需求進行調整。