重要对象：
JwtSecurityToken：代表一个jwt token，可以直接用此对象生成token字符串，也可以使用token字符串创建此对象
SecurityToken：JwtSecurityToken的基类，包含基础数据
JwtSecurityTokenHandler：创建、校验token，返回ClaimsPrincipal
CanReadToken()：确定字符串是否是格式良好的Json Web令牌(JWT)
ReadJwtToken(string token)：token字符串转为JwtSecurityToken对象
ValidateToken(string token、TokenValidationParameters parameter，out SecurityToken validatedToken)：校验token，返回ClaimsIdentity，
方式1：
引用NuGet包：System.IdentityModel.Tokens.Jwt
static void Main(string[] args) { //引用System.IdentityModel.Tokens.Jwt DateTime utcNow = DateTime.UtcNow; string key = "f47b558d-7654-458c-99f2-13b190ef0199"; SecurityKey securityKey = new SymmetricSecurityKey(Encoding.ASCII.GetBytes(key)); var claims = new List<Claim>() { new Claim("ID","1"), new Claim("Name","fan") }; JwtSecurityToken jwtToken = new JwtSecurityToken( issuer: "fan", audience: "audi~~!", claims: claims, notBefore: utcNow, expires: utcNow.AddYears(1), signingCredentials: new SigningCredentials(securityKey, SecurityAlgorithms.HmacSha256) ); //生成token方式1 string token1 = new JwtSecurityTokenHandler().WriteToken(jwtToken); //A Microsoft.IdentityModel.Tokens.SecurityTokenDescriptor that contains details of contents of the token. var tokenDescriptor = new SecurityTokenDescriptor // 创建一个 Token 的原始对象 { Issuer = "fan", Audience = "audi", Subject = new ClaimsIdentity(new[] { new Claim(ClaimTypes.Name, "") }), Expires = DateTime.Now.AddMinutes(60), SigningCredentials = new SigningCredentials(new SymmetricSecurityKey(Encoding.ASCII.GetBytes(key)), SecurityAlgorithms.HmacSha256) }; //生成token方式2 SecurityToken securityToken = new JwtSecurityTokenHandler().CreateToken(tokenDescriptor); var token2 = new JwtSecurityTokenHandler().WriteToken(securityToken); //校验token var validateParameter = new TokenValidationParameters() { ValidateLifetime = true, ValidateAudience = true, ValidateIssuer = true, ValidateIssuerSigningKey = true, ValidIssuer = "fan", ValidAudience = "audi~~!", IssuerSigningKey = securityKey, }; //不校验，直接解析token //jwtToken = new JwtSecurityTokenHandler().ReadJwtToken(token1); try { //校验并解析token var claimsPrincipal = new JwtSecurityTokenHandler().ValidateToken(token1, validateParameter, out SecurityToken validatedToken);//validatedToken:解密后的对象 var jwtPayload = ((JwtSecurityToken)validatedToken).Payload.SerializeToJson(); //获取payload中的数据 } catch (SecurityTokenExpiredException) { //表示过期 } catch (SecurityTokenException) { //表示token错误 } }
方式2：
引用Nuget包：JWT
/// <summary> /// 创建token /// </summary> /// <returns></returns> public static string CreateJwtToken(IDictionary<string, object> payload, string secret, IDictionary<string, object> extraHeaders = null) { IJwtAlgorithm algorithm = new HMACSHA256Algorithm(); IJsonSerializer serializer = new JsonNetSerializer(); IBase64UrlEncoder urlEncoder = new JwtBase64UrlEncoder(); IJwtEncoder encoder = new JwtEncoder(algorithm, serializer, urlEncoder); var token = encoder.Encode(payload, secret); return token; } /// <summary> /// 校验解析token /// </summary> /// <returns></returns> public static string ValidateJwtToken(string token, string secret) { try { IJsonSerializer serializer = new JsonNetSerializer(); IDateTimeProvider provider = new UtcDateTimeProvider(); IJwtValidator validator = new JwtValidator(serializer, provider); IBase64UrlEncoder urlEncoder = new JwtBase64UrlEncoder(); IJwtAlgorithm alg = new HMACSHA256Algorithm(); IJwtDecoder decoder = new JwtDecoder(serializer, validator, urlEncoder, alg); var json = decoder.Decode(token, secret, true); //校验通过，返回解密后的字符串 return json; } catch (TokenExpiredException) { //表示过期 return "expired"; } catch (SignatureVerificationException) { //表示验证不通过 return "invalid"; } catch (Exception) { return "error"; } } //-------------客户端调用--------------- public static void Main(string[] args) { var sign = "123"; var extraHeaders = new Dictionary<string, object> { { "myName", "limaru" }, }; //过期时间(可以不设置，下面表示签名后 10秒过期) double exp = (DateTime.UtcNow.AddSeconds(10) - new DateTime(1970, 1, 1)).TotalSeconds; var payload = new Dictionary<string, object> { { "userId", "001" }, { "userAccount", "fan" }, { "exp",exp } }; var token = CreateJwtToken(payload, sign, extraHeaders); var text = ValidateJwtToken(token, sign); Console.ReadKey(); }
方式3：
手写jwt算法：
JWT组成 样式："xxxxxxxxxxxx.xxxxxxxxxxxxx.xxxxxxxxxxxxxxxx"由三部分组成. (1).Header头部：{"alg":"HS256","typ":"JWT"}基本组成,也可以自己添加别的内容,然后对最后的内容进行Base64编码. (2).Payload负载：iss、sub、aud、exp、nbf、iat、jti基本参数,也可以自己添加别的内容,然后对最后的内容进行Base64编码. (3).Signature签名：将Base64后的Header和Payload通过.组合起来，然后利用Hmacsha256+密钥进行加密。 #region Base64编码 2 /// <summary> 3 /// Base64编码 4 /// </summary> 5 /// <param name="text">待编码的文本字符串</param> 6 /// <returns>编码的文本字符串</returns> 7 public string Base64UrlEncode(string text) 8 { 9 var plainTextBytes = Encoding.UTF8.GetBytes(text); 10 var base64 = Convert.ToBase64String(plainTextBytes).Replace('+', '-').Replace('/', '_').TrimEnd('='); 11 return base64; 12 } 13 #endregion 14 15 #region Base64解码 16 /// <summary> 17 /// Base64解码 18 /// </summary> 19 /// <param name="base64UrlStr"></param> 20 /// <returns></returns> 21 22 public string Base64UrlDecode(string base64UrlStr) 23 { 24 base64UrlStr = base64UrlStr.Replace('-', '+').Replace('_', '/'); 25 switch (base64UrlStr.Length % 4) 26 { 27 case 2: 28 base64UrlStr += "=="; 29 break; 30 case 3: 31 base64UrlStr += "="; 32 break; 33 } 34 var bytes = Convert.FromBase64String(base64UrlStr); 35 return Encoding.UTF8.GetString(bytes); 36 } #endregion Base64编码和解码 /// <summary> /// 手写JWT算法 /// </summary> public bool TestJwt1() { string secretKey = Configuration["SecretKey"]; //1.加密 //1.1 表头的处理 string headerBase64Url = this.Base64UrlEncode("{"alg":"HS256","typ":"JWT"}"); //1.2 PayLoad的处理 var jwtPayLoad = new { expire = DateTime.Now.AddMinutes(15), userId = "00000000001", userAccount = "admin" }; string payloadBase64Url = this.Base64UrlEncode(JsonConvert.SerializeObject(jwtPayLoad)); //1.3 Sign的处理 string sign = $"{headerBase64Url}.{payloadBase64Url}".HMACSHA256(secretKey); //1.4 最终的jwt字符串 string jwtStr = $"{headerBase64Url}.{payloadBase64Url}.{sign}"; //2.校验token是否正确 bool result; //True表示通过，False表示未通过 //2.1. 获取token中的PayLoad中的值,并做过期校验 JwtData myData = JsonConvert.DeserializeObject<JwtData>(this.Base64UrlDecode(jwtStr.Split('.')[1])); //这一步已经获取到了payload中的值，并进行转换了 var nowTime = DateTime.Now; if (nowTime > myData.expire) { //表示token过期，校验未通过 result = false; return result; } else { //2.2 做准确性校验 var items = jwtStr.Split('.'); var oldSign = items[2]; string newSign = $"{items[0]}.{items[1]}".HMACSHA256(secretKey); result = oldSign == newSign; //true表示检验通过，false表示检验未通过 return result; } }
参考：