我們目前正在開發(fā)一個(gè)Blazor應(yīng)用程序，該應(yīng)用程序使用帶有刷新令牌的短期（10 分鐘）Jwt 進(jìn)行保護(hù)。目前我們已經(jīng)實(shí)現(xiàn)了 Jwt，通過 Blazor 服務(wù)器端 Web api 可以登錄、生成 Jwt 并生成刷新令牌。從客戶端我使用了以下鏈接；使用客戶端 Blazor 進(jìn)行身份驗(yàn)證并擴(kuò)展ApiAuthenticationStateProvider.cs如下；public class ApiAuthenticationStateProvider : AuthenticationStateProvider{ private readonly HttpClient _httpClient; private readonly ILocalStorageService _localStorage; public ApiAuthenticationStateProvider(HttpClient httpClient, ILocalStorageService localStorage) { _httpClient = httpClient; _localStorage = localStorage; } public override async Task<AuthenticationState> GetAuthenticationStateAsync() { var savedToken = await _localStorage.GetItemAsync<string>("authToken"); var refreshToken = await _localStorage.GetItemAsync<string>("refreshToken"); if (string.IsNullOrWhiteSpace(savedToken) || string.IsNullOrWhiteSpace(refreshToken)) { return new AuthenticationState(new ClaimsPrincipal(new ClaimsIdentity())); } var userResponse = await _httpClient.GetAsync<UserModel>("api/accounts/user", savedToken); if(userResponse.HasError) { var response = await _httpClient.PostAsync<LoginResponse>("api/login/refreshToken", new RefreshTokenModel { RefreshToken = refreshToken }); //check result now if (!response.HasError) { await _localStorage.SetItemAsync("authToken", response.Result.AccessToken); await _localStorage.SetItemAsync("refreshToken", response.Result.RefreshToken); userResponse = await _httpClient.GetAsync<UserModel>("api/accounts/user", response.Result.AccessToken); }但是，我遇到的第二個(gè)問題是，如果 Jwt 在此調(diào)用期間過期，我將需要調(diào)用以使用刷新令牌來獲取新的 Jwt。有沒有辦法可以使用中間件來執(zhí)行此操作，以避免每次調(diào)用時(shí)都檢查 401，然后以這種方式更新令牌？
1 回答
慕后森
TA貢獻(xiàn)1802條經(jīng)驗(yàn) 獲得超5個(gè)贊
我們經(jīng)常將 Blazor 視為 MVC，但事實(shí)并非如此。它更像是在瀏覽器內(nèi)運(yùn)行的桌面應(yīng)用程序。我以這種方式使用 JWT 和更新令牌：登錄后，我有一個(gè)無限循環(huán)，正在 ping 后端并保持會話并更新令牌。簡化：
class JWTAuthenticationStateProvider : AuthenticationStateProvider
{
? ? private bool IsLogedIn = false;
? ? private CustomCredentials credentials = null;
? ? // private ClaimsPrincipal currentClaimsPrincipal = null; (optinally)
? ? public Task Login( string user, string password )
? ? {
? ? ? ? ?credentials = go_backend_login_service( user, password );
? ? ? ? ?// do stuff with credentials and claims
? ? ? ? ?// I raise event here to notify login
? ? ? ? ?keepSession( );
? ? }
? ? public Task Logout(? )
? ? {
? ? ? ? ?go_bakcend_logout_service( credentials );
? ? ? ? ?// do stuff with claims
? ? ? ? ?IsLogedIn = false;
? ? ? ? ?// I raise event here to notify logout
? ? }
? ? public override Task<AuthenticationState> GetAuthenticationStateAsync()
? ? {
? ? ? ? // make a response from credentials or currentClaimsPrincipal
? ? }
? ? private async void KeepSession()
? ? {
? ? ? ? while(IsLogedIn)
? ? ? ? {
? ? ? ? ? ? credentials = go_backend_renewingJWT_service( credentials );
? ? ? ? ? ? // do stuff with new credentials: check are ok, update IsLogedIn, ...
? ? ? ? ? ? // I raise event here if server says logout
? ? ? ? ? ? await Task.Delay(1000);? // sleep for a while.
? ? ? ? }
? ? }
}
記得通過DI注冊組件：
public void ConfigureServices(IServiceCollection services)
{
? ? // ... other services added here ...
? ? // One JWTAuthenticationStateProvider for each connection on server side.
? ? // A singleton for clientside.
? ? services.AddScoped<AuthenticationStateProvider,?
? ? ? ? ? ? ? ? ? ? ? ?JWTAuthenticationStateProvider>();
}
這只是一個(gè)想法，您應(yīng)該考慮它并使其適應(yīng)您自己的解決方案。
- 1 回答
- 0 關(guān)注
- 118 瀏覽
添加回答
舉報(bào)
0/150
提交
取消