.NET Core中AWS Cognito MFA挑战处理与刷新令牌自动续期实现咨询

一、MFA挑战流程处理 #

1. 初始认证与挑战检测 #

发起基础认证请求后，判断Cognito返回的挑战类型，确认是否需要MFA验证：

var cognitoClient = new AmazonCognitoIdentityProviderClient(RegionEndpoint.YourRegion);
var authRequest = new InitiateAuthRequest
{
    ClientId = "你的Cognito客户端ID",
    AuthFlow = AuthFlowType.USER_PASSWORD_AUTH,
    AuthParameters = new Dictionary<string, string>
    {
        {"USERNAME", username},
        {"PASSWORD", password}
    }
};

var authResponse = await cognitoClient.InitiateAuthAsync(authRequest);

// 检测MFA挑战类型（SMS或TOTP）
if (authResponse.ChallengeName is ChallengeNameType.SMS_MFA or ChallengeNameType.SOFTWARE_TOKEN_MFA)
{
    // 保存Session值，用于后续MFA验证
    var session = authResponse.Session;
    // 前端提示用户输入MFA验证码
}

2. MFA验证码验证 #

用户提交验证码后，发起挑战响应完成认证：

var challengeRequest = new RespondToAuthChallengeRequest
{
    ClientId = "你的Cognito客户端ID",
    ChallengeName = authResponse.ChallengeName,
    Session = session,
    ChallengeResponses = new Dictionary<string, string>
    {
        {"USERNAME", username},
        // 根据MFA类型选择对应的参数名
        {authResponse.ChallengeName == ChallengeNameType.SMS_MFA ? "SMS_MFA_CODE" : "SOFTWARE_TOKEN_MFA_CODE", mfaCode}
    }
};

var challengeResponse = await cognitoClient.RespondToAuthChallengeAsync(challengeRequest);

// 认证成功，获取令牌组（Access Token/ID Token/Refresh Token）
var tokens = challengeResponse.AuthenticationResult;

二、访问令牌自动刷新实现 #

1. 令牌存储与过期检测 #

将令牌及过期时间存储在安全位置（如HttpContext.Session或HttpOnly Cookie），每次请求前检测是否需要提前刷新：

// 从存储中读取令牌信息
var accessToken = HttpContext.Session.GetString("CognitoAccessToken");
var refreshToken = HttpContext.Session.GetString("CognitoRefreshToken");
var tokenExpiry = HttpContext.Session.GetDateTime("CognitoTokenExpiry");

// 提前5分钟触发刷新，避免请求时令牌过期
if (tokenExpiry.HasValue && tokenExpiry.Value <= DateTime.UtcNow.AddMinutes(5))
{
    var newTokens = await RefreshCognitoTokens(refreshToken);
    // 更新存储的令牌和过期时间
    HttpContext.Session.SetString("CognitoAccessToken", newTokens.AccessToken);
    HttpContext.Session.SetString("CognitoRefreshToken", newTokens.RefreshToken);
    HttpContext.Session.SetDateTime("CognitoTokenExpiry", DateTime.UtcNow.AddSeconds(newTokens.ExpiresIn));
}

2. 刷新令牌核心方法 #

通过Refresh Token获取新的令牌组：

private async Task<AuthenticationResultType> RefreshCognitoTokens(string refreshToken)
{
    var cognitoClient = new AmazonCognitoIdentityProviderClient(RegionEndpoint.YourRegion);
    var refreshRequest = new InitiateAuthRequest
    {
        ClientId = "你的Cognito客户端ID",
        AuthFlow = AuthFlowType.REFRESH_TOKEN_AUTH,
        AuthParameters = new Dictionary<string, string>
        {
            {"REFRESH_TOKEN", refreshToken}
        }
    };

    var refreshResponse = await cognitoClient.InitiateAuthAsync(refreshRequest);
    return refreshResponse.AuthenticationResult;
}

3. 中间件集成实现静默刷新 #

自定义中间件自动处理令牌刷新，无需在每个请求中重复逻辑：

public class CognitoTokenRefreshMiddleware
{
    private readonly RequestDelegate _next;

    public CognitoTokenRefreshMiddleware(RequestDelegate next)
    {
        _next = next;
    }

    public async Task InvokeAsync(HttpContext context)
    {
        var tokenExpiry = context.Session.GetDateTime("CognitoTokenExpiry");
        if (tokenExpiry.HasValue && tokenExpiry.Value <= DateTime.UtcNow.AddMinutes(5))
        {
            var refreshToken = context.Session.GetString("CognitoRefreshToken");
            if (!string.IsNullOrEmpty(refreshToken))
            {
                var newTokens = await RefreshCognitoTokens(refreshToken);
                // 更新存储的令牌信息
                context.Session.SetString("CognitoAccessToken", newTokens.AccessToken);
                context.Session.SetString("CognitoRefreshToken", newTokens.RefreshToken);
                context.Session.SetDateTime("CognitoTokenExpiry", DateTime.UtcNow.AddSeconds(newTokens.ExpiresIn));
            }
        }

        await _next(context);
    }

    // 此处嵌入上面的RefreshCognitoTokens方法
}

// 在Program.cs中注册中间件
app.UseMiddleware<CognitoTokenRefreshMiddleware>();

三、用户体验优化 #

• MFA挑战阶段，前端根据挑战类型展示对应提示（如“请输入短信验证码”或“请输入谷歌验证码”）
• 令牌刷新全程静默执行，不打断用户当前操作
• 存储Refresh Token时使用HttpOnly、Secure属性的Cookie，或加密后的Session存储，避免泄露
• 处理Refresh Token过期场景，自动引导用户重新登录

内容的提问来源于stack exchange，提问作者Olatunji Damilare