JWT令牌未正确验证

Question

我有一个使用JWT进行验证的ASP.NET Core MVC应用程序

我在启动类中添加身份验证，使用我们在appsettings文件中的令牌密钥来验证令牌。

services.Configure<ApplicationSettings>(Configuration.GetSection("AppSettings"));

var key = System.Text.Encoding.UTF8
            .GetBytes(Configuration.GetSection("AppSettings:Token").Value);

services.AddAuthentication(x => {
    x.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    x.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
    x.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
}).AddJwtBearer(x => {
    x.RequireHttpsMetadata = false;
    x.SaveToken = false;
    x.TokenValidationParameters = new TokenValidationParameters
    {
        ValidateIssuerSigningKey = true,
        IssuerSigningKey = new SymmetricSecurityKey(key),
        ValidateIssuer = false,
        ValidateAudience = false,
        ClockSkew =  TimeSpan.Zero
    };
});

并添加授权中间件

    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }
        app.UseCors("MyPolicy");

        app.UseHttpsRedirection();

        app.UseRouting();

        app.UseAuthorization();

        app.UseAuthentication();

        app.UseEndpoints(endpoints =>
        {
            endpoints.MapControllers();
        });
    }

现在，当用户尝试登录时，将运行以下控制器方法，并使用相同的令牌密钥生成令牌。

    [HttpPost("login")]
    public async Task<IActionResult> Login([FromBody] UserForLoginDto userForLoginDto)
    {
        var user = await _userManager.FindByNameAsync(userForLoginDto.Username);

        var result = await _signInManager
            .CheckPasswordSignInAsync(user, userForLoginDto.Password, false);



        if (result.Succeeded)
        {
            var tokenDescriptor = new SecurityTokenDescriptor
            {
                Subject = new ClaimsIdentity(new Claim[]
                {
                    new Claim("UserID",user.Id.ToString())
                }),
                Expires = DateTime.UtcNow.AddDays(1),
                SigningCredentials = new Microsoft.IdentityModel.Tokens.SigningCredentials(new SymmetricSecurityKey(Encoding.UTF8
                    .GetBytes(appSettings.Token)), SecurityAlgorithms.HmacSha256Signature)
            };

            var tokenHandler = new JwtSecurityTokenHandler();
            var securityToken = tokenHandler.CreateToken(tokenDescriptor);
            var token = tokenHandler.WriteToken(securityToken);

            return Ok(new { token });
        }

        return Unauthorized();
    }

因此，当用户登录时，将生成令牌并将其发送回客户端。

[我希望现在可以将[Authorize]属性添加到控制器方法，然后MVC框架将在http标头中查找有效令牌。所以我创建了一个测试控制器方法

[HttpGet]
[Authorize]
public IActionResult Get()
{
    return Ok("Test");
}

并发送一个与测试控制器方法相对应的请求，并将Authorization标头设置为Bearer <Token>，但我仍然收到未经授权的401。

谁能解释为什么会发生这种情况？请告诉我您是否需要其他信息。