JSON WEB TOKEN，简单谈谈TOKEN的使用及在C#中的实现

ゝ一世哀愁。 2022-03-30 15:54 614阅读 0赞

十年河东，十年河西，莫欺少年穷。

学无止境，精益求精。

突然发现整个十月份自己还没有写一篇博客......哎，说出来都是泪啊，最近加班实在实在实在是太多了，真的没有多余的时间写博客。这不，今天也在加班中...索性，利用加班的一些时间写篇博客吧！

首先说下什么是 **JWT -- JSON WEB TOKEN**，网上关于它的介绍已经很多很多啦，在此，推荐给大家一篇写的比较好的文章：[什么是 JWT -- JSON WEB TOKEN][JWT -- JSON WEB TOKEN]

以及**Token的组成部分**：[Token存放的信息][Token]

OK，今天我想介绍的不再是理论，而是如何在C\#中应用，说白了就是怎么写程序呗。

借用 [什么是 JWT -- JSON WEB TOKEN][JWT -- JSON WEB TOKEN] 文章中一句话：

基于token的鉴权机制类似于http协议也是无状态的，它不需要在服务端去保留用户的认证信息或者会话信息。这就意味着基于token认证机制的应用不需要去考虑用户在哪一台服务器登录了，这就为应用的扩展提供了便利。

流程上是这样的：

*  用户使用用户名密码来请求服务器
 *  服务器进行验证用户的信息
 *  服务器通过验证发送给用户一个token
 *  客户端存储token，并在每次请求时附送上这个token值
 *  服务端验证token值，并返回数据

这个token必须要在每次请求时传递给服务端，它应该保存在请求头里。

OK，按照上述的流程，首先我们应当拿到登录的账户，密码等信息，验证通过后，生成TOKEN并发送给客户端，之后客户端的每个请求只需带上这个TOKEN，服务器端对这个TOKEN验证，验证通过后即可访问服务器资源，。

具体在C\#中如何模仿这个流程呢？

*  用户使用用户名密码来请求服务器
 *  服务器进行验证用户的信息

上述二个步骤其实是个登录过程，在此不作说明！

*  服务器通过验证发送给用户一个token

发送给客户端一个Token，这个就需要我们生成Token了，那么怎样生成呢？理论模块可参考：**Token的组成部分**：[Token存放的信息][Token]

1、用C\#生成Token：

首先引入JWT.dll

Token生成的具体代码如下：

![ContractedBlock.gif][] ![ExpandedBlockStart.gif][]

using System;
    using System.Collections.Generic;
    using System.Linq;
    using System.Web;
    /*----------------------------------------------------------------
        Copyright (C) 2017 陈卧龙
        
        文件名：TestForToken.CommonCS
        文件功能描述：Token相关操作
    ----------------------------------------------------------------*/
    namespace TestForToken.CommonCS
    {
        public class CommonToken
        {
            public static string SecretKey = "This is a private key for Server";//这个服务端加密秘钥 属于私钥
    
            public static string GenToken(TokenInfo M)
            {
                var jwtcreated =
                   Math.Round((DateTime.UtcNow - new DateTime(1970, 1, 1, 0, 0, 0, DateTimeKind.Utc)).TotalSeconds + 5);
                var jwtcreatedOver =
                Math.Round((DateTime.UtcNow.AddHours(2) - new DateTime(1970, 1, 1, 0, 0, 0, DateTimeKind.Utc)).TotalSeconds + 5);
                var payload = new Dictionary<string, dynamic>
                    {
                        {
           "iss", M.iss},//非必须。issuer 请求实体，可以是发起请求的用户的信息，也可是jwt的签发者。
                        {
          "iat", jwtcreated},//非必须。issued at。 token创建时间，unix时间戳格式
                        {
          "exp", jwtcreatedOver},//非必须。expire 指定token的生命周期。unix时间戳格式
                        {
          "aud", M.aud},//非必须。接收该JWT的一方。
                        {
          "sub", M.sub},//非必须。该JWT所面向的用户
                        {
          "jti", M.jti},//非必须。JWT ID。针对当前token的唯一标识
                        {
          "UserName", M.UserName},//自定义字段 用于存放当前登录人账户信息
                        {
          "UserPwd", M.UserPwd},//自定义字段 用于存放当前登录人登录密码信息
                        {
          "UserRole", M.UserRole},//自定义字段 用于存放当前登录人登录权限信息
                    };
                return JWT.JsonWebToken.Encode(payload, SecretKey,
                    JWT.JwtHashAlgorithm.HS256);
            }
        }
    
        public class TokenInfo
        {
            public TokenInfo()
            {
                iss = "签发者信息";
                aud = "http://example.com";
                sub = "HomeCare.VIP";
                jti = DateTime.Now.ToString("yyyyMMddhhmmss");
                UserName = "jack.chen";
                UserPwd = "jack123456";
                UserRole = "HomeCare.Administrator";
            }
            //
            public string iss { get; set; }
            public string aud { get; set; }
            public string sub { get; set; }
            public string jti { get; set; }
            public string UserName { get; set; }
            public string UserPwd { get; set; }
            public string UserRole { get; set; }
        }
    }

2、将生成的Token发送给客户端后，随后，客户端的每次请求只需带上这个Token即可

一般都是将Token存放在Http请求的Headers中，也就是：context.Request.Headers，那么如何接收请求头中的Token呢？接收到Token后如何验证呢？

验证TOKEN时就需要构建 MVC Action 过滤器（**AuthorizeAttribute**）了，不过在构建 **AuthorizeAttribute** 之前，有必要对 AuthorizeAttribute 说明下，如下：

首先，**AuthorizeAttribute** 类位于**System.Web.Http** 命名空间下及**System.Web.Mvc**命名空间下,

一般情况下，如果你需要对C\# MVC 控制器的访问作认证与授权，你需要用**System.Web.Mvc**命名空间下的 **AuthorizeAttribute ，**如果你需要对C\# API 控制器的访问作认证与授权，你需要用**System.Web.Http** 命名空间下的 **AuthorizeAttribute !**

OK，知道了上述两种不同命名空间下的 **AuthorizeAttribute** ，下面以范例作为说明：

2.1、自定义MVC ACTION 登录授权验证，（**由于本篇博客主讲 Token 的验证与实现，因此，关于MVC 登录验证只做代码说明：**）

2.1.1、新建一个MVC控制器，命名为BaseController，代码如下：

![ContractedBlock.gif][] ![ExpandedBlockStart.gif][]

using System;
    using System.Collections.Generic;
    using System.Linq;
    using System.Web;
    using System.Web.Mvc;
    using System.Web.Security;
    
    namespace TestForToken.Controllers
    {
        public class BaseController : Controller
        {
            #region 退出登录
            /// <summary>
            /// 退出登录
            /// </summary>
            public void ClearLogin()
            {
                FormsAuthenticationTicket authTicket = new FormsAuthenticationTicket(
                       1,
                       "",
                       DateTime.Now,
                       DateTime.Now.AddMinutes(-30),
                       false,
                       "",
                       "/"
                       );
                //.ASPXAUTH
                string encryptedTicket = FormsAuthentication.Encrypt(authTicket);
                System.Web.HttpCookie authCookie = new System.Web.HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket);
                System.Web.HttpContext.Current.Response.Cookies.Add(authCookie);
    
            }
            #endregion
    
            #region 自定义过滤器
            /// <summary>
            /// 自定义过滤器
            /// </summary>
            /// <param name="filterContext"></param>
            protected override void OnActionExecuting(System.Web.Mvc.ActionExecutingContext filterContext)
            {
                string cookieName = FormsAuthentication.FormsCookieName;
                HttpCookie authCookie = System.Web.HttpContext.Current.Request.Cookies[cookieName];
                FormsAuthenticationTicket authTicket = null;
                try
                {
                    authTicket = FormsAuthentication.Decrypt(authCookie.Value);
                }
                catch (Exception ex)
                {
                    return;
                }
                if (authTicket != null && filterContext.HttpContext.User.Identity.IsAuthenticated)
                {
                    string UserName = authTicket.Name;
                    
                    base.OnActionExecuting(filterContext);
                }
                else
                {
                    Content("<script >top.location.href='/Home/Login';</script >", "text/html");
                    //filterContext.HttpContext.Response.Redirect("/Home/Logins");
                }
            }
            #endregion
    
            #region 读取错误信息
            /// <summary>
            /// 读取错误信息
            /// </summary>
            /// <returns></returns>
            public string GetError()
            {
                var errors = ModelState.Values;
                foreach (var item in errors)
                {
                    foreach (var item2 in item.Errors)
                    {
                        if (!string.IsNullOrEmpty(item2.ErrorMessage))
                        {
                            return item2.ErrorMessage;
                        }
                    }
                }
                return "";
            }
            #endregion
    
        }
    }

2.2.2、新建一个MVC控制器，命名为HomeController，代码如下：

![ContractedBlock.gif][] ![ExpandedBlockStart.gif][]

using System;
    using System.Collections.Generic;
    using System.Linq;
    using System.Web;
    using System.Web.Mvc;
    using TestForToken.Models;
    
    namespace TestForToken.Controllers
    {
        public class HomeController : BaseController
        {
            public ActionResult Login()
            {
                ClearLogin();
                string HX_userName = CommonMethod.getCookie("HX_userName");
                string HX_userPwd = CommonMethod.getCookie("HX_userPwd");
                ViewBag.HX_userName = HX_userName;
                ViewBag.HX_userPwd = HX_userPwd;
                return View();
            }
    
            [HttpPost]
            public object UserLogin(LoginsModel LoginMol)
            {
                if (ModelState.IsValid)//是否通过Model验证
                {
                    return LoginMol.LoginAction();
                }
                else
                {
                    return GetError();
                }
            }
        }
    }

2.2.3、新建一个登录实体类，命名为：LoginsModel，代码如下：

![ContractedBlock.gif][] ![ExpandedBlockStart.gif][]

using System;
    using System.Collections.Generic;
    using System.ComponentModel.DataAnnotations;
    using System.Linq;
    using System.Web;
    using System.Web.Security;
    
    namespace TestForToken.Models
    {
        public class LoginsModel
        {
            private readonly object LOCK = new object();
            [Required(ErrorMessage = "请输入账户号码/手机号")]
            [RegularExpression(@"^1[34578][0-9]{9}$", ErrorMessage = "手机号格式不正确")]
            public string UserName { get; set; }
    
            [Required(ErrorMessage = "请输入账户密码")]
            [DataType(DataType.Password, ErrorMessage = "密码格式不正确")]
            public string UserPwd { get; set; }
    
            public bool remember { get; set; }
    
            public string LoginAction()
            {
                lock (LOCK)
                {
                    string userRole = string.Empty;
                    //数据库操作代码
                    int UserId = 0;
                    if (UserName == "18137070152" && UserPwd == "18137070152")
                    {
                        UserId = 1;
                        userRole = "HomeCare.Administrator";
                    }
                    else if (UserName == "18911695087" && UserPwd == "18911695087")
                    {
                        UserId = 2;
                        userRole = "HomeCare.Vip";
                    }
                    else
                    {
                        UserId = 3;
                        userRole = "HomeCare.User";
                    }
                    if (UserId != 0)
                    {
                        if (remember)
                        {
                            CommonMethod.setCookie("HX_userName", UserName, 7);
                            CommonMethod.setCookie("HX_userPwd", UserPwd, 7);
                        }
                        FormsAuthenticationTicket authTicket = new FormsAuthenticationTicket(
                               1,
                               UserName + "_" + UserId,
                               DateTime.Now,
                               DateTime.Now.AddMinutes(30),
                               false,
                               userRole,
                               "/"
                               );
                        //.ASPXAUTH
                        string encryptedTicket = FormsAuthentication.Encrypt(authTicket);
                        System.Web.HttpCookie authCookie = new System.Web.HttpCookie(FormsAuthentication.FormsCookieName, encryptedTicket);
                        System.Web.HttpContext.Current.Response.Cookies.Add(authCookie);
                        return "HomeCare.Administrator";
                    }
                    else
                    {
                        return "账户密码不存在";
                    }
                }
            }
    
        }
    
    }

2.2.4、修改你的Global.asax文件，修改代码如下：

![ContractedBlock.gif][] ![ExpandedBlockStart.gif][]

using System;
    using System.Collections.Generic;
    using System.Linq;
    using System.Security.Principal;
    using System.Web;
    using System.Web.Http;
    using System.Web.Mvc;
    using System.Web.Optimization;
    using System.Web.Routing;
    using System.Web.Security;
    
    namespace TestForToken
    {
        // 注意: 有关启用 IIS6 或 IIS7 经典模式的说明，
        // 请访问 http://go.microsoft.com/?LinkId=9394801
    
        public class MvcApplication : System.Web.HttpApplication
        {
            protected void Application_Start()
            {
                AreaRegistration.RegisterAllAreas();
    
                WebApiConfig.Register(GlobalConfiguration.Configuration);
                FilterConfig.RegisterGlobalFilters(GlobalFilters.Filters);
                RouteConfig.RegisterRoutes(RouteTable.Routes);
                BundleConfig.RegisterBundles(BundleTable.Bundles);
            }
    
            /// <summary>
            /// 登录验证、s授权
            /// </summary>
            /// <param name="sender"></param>
            /// <param name="e"></param>
            protected void Application_AuthenticateRequest(Object sender, EventArgs e)
            {
                string cookieName = FormsAuthentication.FormsCookieName;
                HttpCookie authCookie = Context.Request.Cookies[cookieName];
                FormsAuthenticationTicket authTicket = null;
                try
                {
                    authTicket = FormsAuthentication.Decrypt(authCookie.Value);
                }
                catch (Exception ex)
                {
                    return;
                }
                string[] roles = authTicket.UserData.Split(',');
                FormsIdentity id = new FormsIdentity(authTicket);
                GenericPrincipal principal = new GenericPrincipal(id, roles);
                Context.User = principal;//存到HttpContext.User中 　 　 
            }
        }
    }

2.2.5、公共访问类CommonCS部分代码如下：

![ContractedBlock.gif][] ![ExpandedBlockStart.gif][]

using System;
    using System.Collections.Generic;
    using System.Web;
    using System.Collections;
    using System.Text;
    using System.Text.RegularExpressions;
    using System.Data;
    using System.Drawing;
    
    
    namespace TestForToken
    {
        public class CommonMethod
        {
            #region cookie操作
            /// <summary>
            /// Cookies赋值
            /// </summary>
            /// <param name="strName">主键</param>
            /// <param name="strValue">键值</param>
            /// <param name="strDay">有效天数</param>
            /// <returns></returns>
            public static bool setCookieForMIn(string strName, string strValue, int Mintius)
            {
                try
                {
                    HttpCookie Cookie = new HttpCookie(strName);
                    //Cookie.Domain = ".xxx.com";//当要跨域名访问的时候,给cookie指定域名即可,格式为.xxx.com
                    Cookie.Expires = DateTime.Now.AddMinutes(Mintius);
                    Cookie.Value = strValue;
                    System.Web.HttpContext.Current.Response.Cookies.Add(Cookie);
                    return true;
                }
                catch
                {
                    return false;
                }
            }
    
            /// <summary>
            /// Cookies赋值
            /// </summary>
            /// <param name="strName">主键</param>
            /// <param name="strValue">键值</param>
            /// <param name="strDay">有效天数</param>
            /// <returns></returns>
            public static bool setCookie(string strName, string strValue, int strDay)
            {
                try
                {
                    HttpCookie Cookie = new HttpCookie(strName);
                    //Cookie.Domain = ".xxx.com";//当要跨域名访问的时候,给cookie指定域名即可,格式为.xxx.com
                    Cookie.Expires = DateTime.Now.AddDays(strDay);
                    Cookie.Value = strValue;
                    System.Web.HttpContext.Current.Response.Cookies.Add(Cookie);
                    return true;
                }
                catch
                {
                    return false;
                }
            }
    
            /// <summary>
            /// 读取Cookies
            /// </summary>
            /// <param name="strName">主键</param>
            /// <returns></returns>
    
            public static string getCookie(string strName)
            {
                HttpCookie Cookie = System.Web.HttpContext.Current.Request.Cookies[strName];
                if (Cookie != null)
                {
                    return Cookie.Value.ToString();
                }
                else
                {
                    return null;
                }
            }
    
            /// <summary>
            /// 删除Cookies
            /// </summary>
            /// <param name="strName">主键</param>
            /// <returns></returns>
            public static bool delCookie(string strName)
            {
                try
                {
                    HttpCookie Cookie = new HttpCookie(strName);
                    //Cookie.Domain = ".xxx.com";//当要跨域名访问的时候,给cookie指定域名即可,格式为.xxx.com
                    Cookie.Expires = DateTime.Now.AddDays(-1);
                    System.Web.HttpContext.Current.Response.Cookies.Add(Cookie);
                    return true;
                }
                catch
                {
                    return false;
                }
            }
            #endregion
        }
    }

2.2.6、公共Token生成类代码如下：

![ContractedBlock.gif][] ![ExpandedBlockStart.gif][]

2.2.7、新建一个登录页面，Login.cshtml代码如下：

![ContractedBlock.gif][] ![ExpandedBlockStart.gif][]

@{
        Layout = null;
    }
    
    <!DOCTYPE html>
    
    <html lang="zh">
    <head>
        <meta charset="UTF-8">
        <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1.0, user-scalable=no">
        
        <title>账户登录</title>
        <link href="~/Content/css/materialize.min.css" rel="stylesheet" />
        <style type="text/css">
        html,
        body {
           
            height: 100%;
        }
        html {
           
            display: table;
            margin: auto;
        }
        body {
           
            display: table-cell;
            vertical-align: middle;
            color:#47c1a8;
    
        }
    
        .margin {
           
          margin: 0 !important;
        }
        
        .card-panel{
            min-width:350px;}
        </style>
        
    </head>
    <body class="red">
       
        <div id="login-page" class="row">
            <div class="col s12 z-depth-6 card-panel">
              <form class="login-form">
                <div class="row">
                  <div class="input-field col s12 center">
                    <img src="/content/images/100.png" alt="" class="responsive-img valign profile-image-login">
                    <p class="center login-form-text">账户登录</p>
                  </div>
                </div>
                <div class="row margin">
                  <div class="input-field col s12">
                    <i class="mdi-social-person-outline prefix"></i>
                    <input class="validate" id="UserName" name="UserName" type="tel" value="@ViewBag.HX_userName">
                    <label for="tel" data-error="wrong" data-success="right" class="center-align">手机号码：</label>
                  </div>
                </div>
                <div class="row margin">
                  <div class="input-field col s12">
                    <i class="mdi-action-lock-outline prefix"></i>
                    <input id="UserPwd" name="UserPwd" type="password" value="@ViewBag.HX_userPwd">
                    <label for="password">密码：</label>
                  </div>
                </div>
                <div class="row">          
                  <div class="input-field col s12 m12 l12  login-text">
                      <input type="checkbox" id="remember-me" name="remember-me" />
                      <label for="remember-me">记住我</label>
                  </div>
                </div>
                <div class="row">
                  <div class="input-field col s12">
                    <a href="JavaScript:void(0)" class="btn waves-effect waves-light col s12" onclick="Login()">登　录</a>
                  </div>
                </div>
                <div class="row">
                   <div class="input-field col s6 m6 l6">
                    <p class="margin medium-small"></p>
                  </div>
                  <div class="input-field col s6 m6 l6">
                      <p class="margin right-align medium-small"><a href="/home/forgotpassword">忘记密码?</a></p>
                  </div>          
                    </div>
              </form>
            </div>
          </div>
        
        
        <script src="~/Scripts/js/jquery-2.1.0.js"></script>
        <script src="~/Scripts/js/materialize.min.js"></script>
        <script type="text/javascript">
            function Login() {
                var UserName = $("#UserName").val();
                var UserPwd = $("#UserPwd").val();
                var remember = document.getElementById("remember-me").checked;
    
                $(document).ready(function (data) {
                    $.ajax({
                        url: "/Home/UserLogin",
                        type: "post",
                        contentType: "application/json",
                        dataType: "text",
                        data: JSON.stringify({ UserName: UserName, UserPwd: UserPwd, remember: remember }),
                        success: function (result, status) {
                            if (result == "HomeCare.Administrator") {
                                //登录成功 跳转
                                location.href = "/Manger/Index";//管理员登录
                            }
                            else {
                                alert(result);
                            }
                        },
                        error: function (error) {
                            alert(error);
                        }
                    });
                });
            }
    </script>
          
          
    </body>
    </html>

**2.2.8、新建一个登录验证属性，继承自：System.Web.Mvc.AuthorizeAttribute，代码如下：(千呼万唤始出来啊......~\_~)**

![ContractedBlock.gif][] ![ExpandedBlockStart.gif][]

using System;
    using System.Collections.Generic;
    using System.Linq;
    using System.Security.Principal;
    using System.Web;
    using System.Web.Http.Controllers;
    using System.Web.Mvc;
    using System.Web.Security;
    
    namespace TestForToken.Auth2._0
    {
        public class MvcActionAuth : AuthorizeAttribute
        {
            public string[] AuthorizeRoleAry = new string[] { "HomeCare.User", "HomeCare.Vip", "HomeCare.Administrator" };//本系统允许的角色 普通用户 会员 超级管理员
            /// <summary>
            /// 自定义 MVC 控制前访问权限验证
            /// </summary>
            /// <param name="filterContext"></param>
            public override void OnAuthorization(System.Web.Mvc.AuthorizationContext filterContext)
            {
                string Role = string.Empty;
                string controllerName = filterContext.ActionDescriptor.ControllerDescriptor.ControllerName;
                string actionName = filterContext.ActionDescriptor.ActionName;
                //数据库验证当前Controller及Action允许访问的权限
                //简单模拟 读取数据库
                if (controllerName == "Manger" && actionName == "Index")
                {
                    //得到允许访问 Manger/Index 的权限值
                    Role = "HomeCare.Administrator,HomeCare.Vip";
                }
    
                //
                string cookieName = FormsAuthentication.FormsCookieName;
                HttpCookie authCookie = System.Web.HttpContext.Current.Request.Cookies[cookieName];
                FormsAuthenticationTicket authTicket = null;
                try
                {
                    authTicket = FormsAuthentication.Decrypt(authCookie.Value);
                }
                catch (Exception ex)
                {
                    return;
                }
                string[] roles = authTicket.UserData.Split(',');
                string NowRole = string.Empty;
                foreach (var item in roles)
                {
                    NowRole += item;
                }
                if (!Role.Contains(NowRole)) //没有权限访问当前控制器 ACtion
                {
                    System.Web.HttpContext.Current.Response.Redirect("/Home/Login");
                } 
                base.OnAuthorization(filterContext);
            }
        }
    }

2.2.9、新建一个MVC 控制器 ，命名为：MangerController，代码如下：

![451016-20171103111923810-208432754.png][]

上述代码就不做演示了，大致过程是这样的：

Manger/Index的访问权限如下：

![451016-20171103112129998-1041215056.png][]

登录用户：

![451016-20171103112428185-970988180.png][]

上述截图已经很清晰了，不再作重复说明。

OK，上述代码便是整个MVC 控制器 登录验证/授权认证的全部代码。下面我们请出本文终极BOSS，如果接收并解析验证接收的TOKEN。

3、下面介绍**webAPI Controller** 的认证授权

3.1、首先，我们自定义一个继承自**System.Web.Http** 命名空间下的**AuthorizeAttribute** 属性来解析并验证TOKEN

代码如下：

![ContractedBlock.gif][] ![ExpandedBlockStart.gif][]

using System;
    using System.Collections.Generic;
    using System.Linq;
    using System.Net.Http;
    using System.Text;
    using System.Web;
    using System.Web.Http;
    using System.Web.Http.Controllers;
    using TestForToken.CommonCS;
    
    namespace TestForToken.Auth2._0
    {
        public class ApiActionAuth : AuthorizeAttribute
        {
            public override void OnAuthorization(HttpActionContext context)
            {
                var authHeader = context.Request.Headers.FirstOrDefault(a => a.Key == "ApiAuthorization");//获取接收的Token
    
                if (context.Request.Headers == null || !context.Request.Headers.Any() || authHeader.Key == null || string.IsNullOrEmpty(authHeader.Value.FirstOrDefault()))
                {
                    Throw401Exception(context, "NoToken");
                    return;
                }
               
                var sendToken = authHeader.Value.FirstOrDefault();
    
                //url获取token 
                var now = Math.Round((DateTime.UtcNow - new DateTime(1970, 1, 1, 0, 0, 0, DateTimeKind.Utc)).TotalSeconds + 5);//当前的时间戳
                var dictPayload = DecodeToken(sendToken);
    
                if (dictPayload == null)
                {
                    Throw401Exception(context, "InvalidToken");
                }
                double iat = dictPayload["iat"];
                double exp = dictPayload["exp"];
                //检查令牌的有效期
                if (!(iat < now && now < exp))//如果当前时间戳不再Token声明周期范围内，则返回Token过期
                {
                    Throw401Exception(context, "TokenTimeout");
                }
                //获取Token的自定义键值对
                int UserId = dictPayload["UserId"];
                string UserName = dictPayload["UserName"];
                string UserPwd = dictPayload["UserPwd"];
                string UserRole = dictPayload["UserRole"];
    
                //把toke用户数据放到 HttpContext.Current.User 里
                ClientUserData clientUserData = new ClientUserData()
                {
                    UserId = UserId,
                    UserName = UserName,
                    UserPwd = UserPwd,
                    UserRole = UserRole
    
                };
                if (HttpContext.Current != null)
                {
                    HttpContext.Current.User = new UserPrincipal(clientUserData);
                }
    
            }
    
            private static IDictionary<string, dynamic> DecodeToken(string token)
            {
                try
                {
                    var dictPayload = JWT.JsonWebToken.DecodeToObject(token, CommonToken.SecretKey) as IDictionary<string, dynamic>;
                    return dictPayload;
                }
                catch (Exception ex)
                {
                    return null;
                }
            }
    
            private static void Throw401Exception(HttpActionContext actionContext, string exceptionString)
            {
                var response = HttpContext.Current.Response;
                throw new HttpResponseException(
               actionContext.Request.CreateErrorResponse(System.Net.HttpStatusCode.Unauthorized, exceptionString ?? "Unauthorized"));
            }
            private static string RequestToString(HttpRequestMessage request)
            {
                var message = new StringBuilder();
                if (request.Method != null)
                    message.Append(request.Method);
    
                if (request.RequestUri != null)
                    message.Append(" ").Append(request.RequestUri);
                return message.ToString();
            }
        }
    }

3.2、新增一个存储解析Token结果的类，命名为SysHelper.cs，代码如下：

![ContractedBlock.gif][] ![ExpandedBlockStart.gif][]

using System;
    using System.Collections.Generic;
    using System.Linq;
    using System.Security.Principal;
    using System.Web;
    
    namespace TestForToken.Auth2._0
    {
        public class SysHelper
        {
            public static UserPrincipal CurrentPrincipal
            {
                get
                {
                    return HttpContext.Current.User as UserPrincipal;
                }
            }
        }
    
        public class UserPrincipal : ClientUserData, IPrincipal
        {
            public IIdentity Identity { get; private set; }
            public string[] Roles { get; set; }
    
            public UserPrincipal(ClientUserData clientUserData)
            {
                this.Identity = new GenericIdentity(string.Format("{0}", clientUserData.UserId));
                this.UserId = clientUserData.UserId;
                this.UserName = clientUserData.UserName;
                this.UserPwd = clientUserData.UserPwd;
                this.UserRole = clientUserData.UserRole;
            }
    
            public bool IsInRole(string role)
            {
                if (Roles.Any(r => r == role))
                {
                    return true;
                }
                else
                {
                    return false;
                }
            }
        }
    
        public class ClientUserData
        {
            public int UserId { get; set; }
    
            public string UserName { get; set; }
    
            public string UserPwd { get; set; }
    
            public string UserRole { get; set; }
        }
    }

3.3、公共Token生成方法修改如下：

![ContractedBlock.gif][] ![ExpandedBlockStart.gif][]

using System;
    using System.Collections.Generic;
    using System.Linq;
    using System.Web;
    /*----------------------------------------------------------------
        Copyright (C) 2017 陈卧龙
        
        文件名：TestForToken.CommonCS
        文件功能描述：Token相关操作
    ----------------------------------------------------------------*/
    namespace TestForToken.CommonCS
    {
        public class CommonToken
        {
            public static string SecretKey = "This is a private key for Server";//这个服务端加密秘钥 属于私钥
    
            public static string GetToken(TokenInfo M)
            {
                var jwtcreated =
                   Math.Round((DateTime.UtcNow - new DateTime(1970, 1, 1, 0, 0, 0, DateTimeKind.Utc)).TotalSeconds + 5);
                var jwtcreatedOver =
                Math.Round((DateTime.UtcNow.AddHours(2) - new DateTime(1970, 1, 1, 0, 0, 0, DateTimeKind.Utc)).TotalSeconds + 5);//TOKEN声明周期二小时
                var payload = new Dictionary<string, dynamic>
                    {
                        {
           "iss", M.iss},//非必须。issuer 请求实体，可以是发起请求的用户的信息，也可是jwt的签发者。
                        {
          "iat", jwtcreated},//非必须。issued at。 token创建时间，unix时间戳格式
                        {
          "exp", jwtcreatedOver},//非必须。expire 指定token的生命周期。unix时间戳格式
                        {
          "aud", M.aud},//非必须。接收该JWT的一方。
                        {
          "sub", M.sub},//非必须。该JWT所面向的用户
                        {
          "jti", M.jti},//非必须。JWT ID。针对当前token的唯一标识
                        {
          "UserId", M.UserId},//自定义字段 用于存放当前登录人账户信息
                        {
          "UserName", M.UserName},//自定义字段 用于存放当前登录人账户信息
                        {
          "UserPwd", M.UserPwd},//自定义字段 用于存放当前登录人登录密码信息
                        {
          "UserRole", M.UserRole},//自定义字段 用于存放当前登录人登录权限信息
                    };
                return JWT.JsonWebToken.Encode(payload, SecretKey,
                    JWT.JwtHashAlgorithm.HS256);
            }
        }
    
        public class TokenInfo
        {
            public TokenInfo()
            {
                iss = "签发者信息";
                aud = "http://example.com";
                sub = "HomeCare.VIP";
                jti = DateTime.Now.ToString("yyyyMMddhhmmss");
                UserId = 1;
                UserName = "jack.chen";
                UserPwd = "jack123456";
                UserRole = "HomeCare.Administrator";
            }
            //
            public string iss { get; set; }
            public string aud { get; set; }
            public string sub { get; set; }
            public string jti { get; set; }
            public int UserId { get; set; }
            public string UserName { get; set; }
            public string UserPwd { get; set; }
            public string UserRole { get; set; }
        }
    }

3.4、定义一个MVC API Controller 代码如下：

![ContractedBlock.gif][] ![ExpandedBlockStart.gif][]

using System;
    using System.Collections.Generic;
    using System.Linq;
    using System.Net;
    using System.Net.Http;
    using System.Web.Http;
    using TestForToken.Auth2._0;
    
    namespace TestForToken.Controllers
    {
        public class MangerApiController : ApiController
        {
            [ApiActionAuth]
            [HttpGet]
            public string GetStr()
            {
                int UserId = SysHelper.CurrentPrincipal.UserId;
                string UserName = SysHelper.CurrentPrincipal.UserName;
                string UserPwd = SysHelper.CurrentPrincipal.UserPwd;
                string UserRole = SysHelper.CurrentPrincipal.UserRole;
                return "当前登录的第三方用户信息如下,UserId:" + UserId + ",UserName:" + UserName + ",UserPwd:" + UserPwd + ",UserRole:" + UserRole;
            }
        }
    }

![451016-20171103144454810-827897819.png][]

OK，有了上述代码我们就可以模拟TOKEN验证了，模拟步骤如下：/

3.5、模拟TOKEN验证：

3.5.1、生成TOKEN，代码如下：

![ContractedBlock.gif][] ![ExpandedBlockStart.gif][]

using System;
    using System.Collections.Generic;
    using System.Linq;
    using System.Web;
    using System.Web.UI;
    using System.Web.UI.WebControls;
    using TestForToken.CommonCS;
    
    namespace TestForToken
    {
        public partial class WebForm1 : System.Web.UI.Page
        {
            protected void Page_Load(object sender, EventArgs e)
            {
                Response.Write(CommonToken.GetToken(new TokenInfo()));
            }
        }
    }

生成的TOKEN为：eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiLnrb7lj5HogIXkv6Hmga8iLCJpYXQiOjE1MDk2OTEyODQsImV4cCI6MTUwOTY5ODQ4NCwiYXVkIjoiaHR0cDovL2V4YW1wbGUuY29tIiwic3ViIjoiSG9tZUNhcmUuVklQIiwianRpIjoiMjAxNzExMDMwMjQxMTkiLCJVc2VySWQiOjEsIlVzZXJOYW1lIjoiamFjay5jaGVuIiwiVXNlclB3ZCI6ImphY2sxMjM0NTYiLCJVc2VyUm9sZSI6IkhvbWVDYXJlLkFkbWluaXN0cmF0b3IifQ.IryLo19SSghi34LD1PNIOmzgzavQrnmGBD42pdojXtg

3.5.2、将获取的TOKEN（有效期两个小时）返回至客户端，客户端将获取的TOKEN放在 请求头 Headers 中，模拟请求如下（PostMan）：

![451016-20171103145028451-1828808518.png][]

OK，将上述TOKEN随便去掉一个字母，请求结果如下：

![451016-20171103145137951-1438581071.png][]

过期的TOKEN，请求如下：

![451016-20171103145744420-622519007.png][]

OK，关于TOKEN更详细的验证，还需要大家自行完善，本篇博客我仅仅只验证了TOKEN是否正确，没有作进一步的验证，大家可根据项目需求，主动完善TOKEN验证代码。

例如：读取TOKEN存放的用户名，密码，角色等信息再作数据库验证。或者如同上述的MVC 控制器控制，验证角色等信息，总之，，，，，，，不写了，太累，还有任务没完成呢。

哈！见谅！

**项目源码位置**：[http://download.csdn.net/download/wolongbb/10102574][http_download.csdn.net_download_wolongbb_10102574]

希望大家喜欢....

**@陈卧龙的博客**

[JWT -- JSON WEB TOKEN]: http://www.jianshu.com/p/576dbf44b2ae
[Token]: http://www.cnblogs.com/zjutzz/p/5790180.html
[ContractedBlock.gif]: https://images.cnblogs.com/OutliningIndicators/ContractedBlock.gif
[ExpandedBlockStart.gif]: /images/20220330/95ce1824cb2c458c85e7b4a43f40f8ea.png
[451016-20171103111923810-208432754.png]: /images/20220330/62bbab7330004cff8b2d32b1655e62ef.png
[451016-20171103112129998-1041215056.png]: /images/20220330/9a1173cc4f55419bb6bfb0ce1f507465.png
[451016-20171103112428185-970988180.png]: /images/20220330/ca6da0a3cfdc480ba75e506decebef20.png
[451016-20171103144454810-827897819.png]: /images/20220330/5db87eda7d7244e6b4fe13d628507b49.png
[451016-20171103145028451-1828808518.png]: /images/20220330/7aed1dba8639470bb1af42984551fe7f.png
[451016-20171103145137951-1438581071.png]: /images/20220330/78828412e20d453db9854eeef7704622.png
[451016-20171103145744420-622519007.png]: /images/20220330/4330fe70a4ba482b8dfb2458c4831e9e.png
[http_download.csdn.net_download_wolongbb_10102574]: http://download.csdn.net/download/wolongbb/10102574