c# – .net core – 忽略Jwt中间件身份验证签名密钥

我正在使用配置为使用json web令牌的openiddict：

// Add authentication
services.AddAuthentication();

// Add OpenId Connect/OAuth2
services.AddOpenIddict()
    .AddEntityFrameworkCoreStores<ApplicationDbContext>()
    .AddMvcBinders()
    .EnableTokenEndpoint("/connect/token")
    .AllowPasswordFlow()
    .AllowRefreshTokenFlow()
    .UseJsonWebTokens()      // access_token should be jwt
    // You can disable the HTTPS requirement during development or if behind a reverse proxy
    .DisableHttpsRequirement()
    // Register a new ephemeral key, that is discarded when the application
    // shuts down. Tokens signed using this key are automatically invalidated.
    // To be used during development
    .AddEphemeralSigningKey();

我通过以下方式配置JWT中间件：

// Add Jwt middleware for authentication
var secretKey = Configuration.Get<AppOptions>().Jwt.SecretKey;
app.UseJwtBearerAuthentication(new JwtBearerOptions
{
    AutomaticAuthenticate = true,
    AutomaticChallenge = true,
    RequireHttpsMetadata = env.IsProduction(),
    Audience = Configuration.Get<AppOptions>().Jwt.Audience,
    Authority = Configuration.Get<AppOptions>().Jwt.Authority,
    TokenValidationParameters = new TokenValidationParameters
    {
        ValidateIssuerSigningKey = true,
        IssuerSigningKey = new SymmetricSecurityKey(Encoding.ASCII.GetBytes(secretKey)),

        ValidateIssuer = true,
        // makes no difference seemingly being ignored
        //ValidIssuer = Configuration.Get<AppOptions>().Jwt.Authority,

        ValidateAudience = true,
        ValidAudience = Configuration.Get<AppOptions>().Jwt.Audience,

        ValidateLifetime = true,
    }
});

// Add OpedId Connect middleware
app.UseOpenIddict();

如您所见,发行者签名密钥设置为对称密钥：

IssuerSigningKey = new SymmetricSecurityKey(Encoding.ASCII.GetBytes(secretKey)),

但是创建的jwt access_tokens将alg声明设置为RS256,因此似乎忽略了此设置,openiddict使用RSA私钥对从中生成的令牌进行签名

.AddEphemeralSigningKey();

解决方法:

为了强制openiddict使用对称密钥,必须在openiddict中进行配置

 services.AddOpenIddict()
.AddEntityFrameworkCoreStores<ApplicationDbContext>()
.AddMvcBinders()
.EnableTokenEndpoint("/connect/token")
.AllowPasswordFlow()
.AllowRefreshTokenFlow()
.UseJsonWebTokens()
// You can disable the HTTPS requirement during development or if behind a reverse proxy
.DisableHttpsRequirement()

// set your symmetric key

.AddSigningKey(new SymmetricSecurityKey(Encoding.ASCII.GetBytes(Configuration.Get<AppOptions>().Jwt.SecretKey)));

标签：c,net,jwt,openid-connect,openiddict
来源： https://codeday.me/bug/20190522/1154562.html