ASP.NET Core MVC 6中JWT Decode抛出NullReferenceException问题

我在ASP.NET Core MVC 6中基于JWT实现基础身份验证功能，登录后将Token存入Session，进入仪表盘时通过AJAX请求向控制器发送Token进行验证。目前遇到的问题是，即使硬编码Token，调用JWT.Net包的Decode函数仍持续抛出NullReferenceException异常。

相关代码 #

仪表盘AJAX代码 #

function checkToken() {
    //var token = sessionStorage.getItem("loginSession");
    var data = {
        token: sessionStorage.getItem("loginSession")
    };
    console.log(data)
    $.ajax({
        url: '/Auth/Validate',
        type: 'POST',
        contentType: "application/json",
        data: JSON.stringify(data),
        success: function (result) {
            console.log(result);
        }
    })
}

控制器代码 #

using JWT.Algorithms;
using JWT.Serializers;
using JWT;
using Microsoft.AspNetCore.Mvc;
using FrontEnd.ViewModel;
using NuGet.Common;

namespace FrontEnd.Controllers
{
    public class AuthController : Controller
    {
        public IActionResult Login()
        {
            return View();
        }

        public IActionResult Register()
        {
            return View();
        }
        public IActionResult Forgot()
        {
            return View();
        }
        [HttpPost]
        public string Validate([FromBody]AuthVM authVM)
        {
            //var token = authVM?.token;
            //if (string.IsNullOrEmpty(token))
            //{
            //    throw new ArgumentException("Token is null or empty");
            //}
            var token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJlbWFpbCI6ImFzZEBlbWFpbC5jb20iLCJuYW1lIjoiTGFydWUgTW9ociJ9.l37wEV8ttLXBW5pMa8dMj7iAz6eWnaqiMbG93gpUOzA";

            IJwtAlgorithm algorithm = new HMACSHA256Algorithm();
            IJsonSerializer serializer = new JsonNetSerializer();
            IBase64UrlEncoder urlEncoder = new JwtBase64UrlEncoder();
            
            IDateTimeProvider provider = new UtcDateTimeProvider();
            IJwtValidator validator = new JwtValidator(serializer, provider);
            IJwtDecoder decoder = new JwtDecoder(serializer, validator, urlEncoder, algorithm);

            var payload = decoder.Decode(token);

            return payload;
        }
    }
}

ViewModel代码 #

namespace FrontEnd.ViewModel
{
    public class AuthVM
    {
        public string token { get; set; }
    }
}

异常堆栈信息 #

System.NullReferenceException
  HResult=0x80004003
  Message=Object reference not set to an instance of an object.
  Source=JWT
  StackTrace:
   at JWT.JwtDecoder.<>c.<AllKeysHaveValues>b__20_0(Byte[] key)
   at System.Array.TrueForAll[T](T[] array, Predicate`1 match)
   at JWT.JwtDecoder.ValidSymmetricAlgorithm(Byte[][] keys, String decodedPayload, IJwtAlgorithm algorithm, Byte[] bytesToSign, Byte[] decodedSignature)
   at JWT.JwtDecoder.Validate(JwtParts jwt, Byte[][] keys)
   at JWT.JwtDecoder.Decode(JwtParts jwt, Byte[][] keys, Boolean verify)
   at FrontEnd.Controllers.AuthController.Validate(AuthVM authVM) in C:\Users\Redactedhehe\source\repos\UniversityAPI\FrontEnd\Controllers\AuthController.cs:line 54

问题原因及解决方法 #

从堆栈信息可以看出，异常出现在AllKeysHaveValues方法中，说明验证JWT签名时缺少必要的密钥。你使用的是HMACSHA256对称加密算法，解码时必须提供与签发Token时完全一致的密钥，否则无法完成签名验证，进而引发空引用异常。

修改方案 #

1. 定义与签发端一致的密钥：

var secretKey = "你的实际密钥字符串"; // 替换为生成Token时使用的密钥

2. 调用Decode方法时传入密钥：

var payload = decoder.Decode(token, secretKey, verify: true);

完整修改后的Validate方法：

[HttpPost]
public string Validate([FromBody]AuthVM authVM)
{
    var token = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJlbWFpbCI6ImFzZEBlbWFpbC5jb20iLCJuYW1lIjoiTGFydWUgTW9ociJ9.l37wEV8ttLXBW5pMa8dMj7iAz6eWnaqiMbG93gpUOzA";
    var secretKey = "你的实际密钥"; // 替换为签发Token的密钥

    IJwtAlgorithm algorithm = new HMACSHA256Algorithm();
    IJsonSerializer serializer = new JsonNetSerializer();
    IBase64UrlEncoder urlEncoder = new JwtBase64UrlEncoder();
    IDateTimeProvider provider = new UtcDateTimeProvider();
    IJwtValidator validator = new JwtValidator(serializer, provider);
    IJwtDecoder decoder = new JwtDecoder(serializer, validator, urlEncoder, algorithm);

    var payload = decoder.Decode(token, secretKey, verify: true);

    return payload;
}

可选方案（不推荐生产环境使用） #

如果仅需解码Payload而跳过签名验证，可以调用不带密钥的重载：

var payload = decoder.Decode(token, verify: false);

内容的提问来源于stack exchange，提问作者cherno304