Clerk Authentication集成ASP.NET Core 6.0 Web API同步用户数据问题

1. 创建匹配的API控制器 #

先搭建对应Webhook地址的API端点，确保支持POST请求（Clerk Webhook默认用POST推送事件），示例代码如下：

[ApiController]
[Route("api/v1/User")]
public class UserWebhookController : ControllerBase
{
    [HttpPost("profile")]
    public async Task<IActionResult> ReceiveClerkEvent([FromBody] ClerkWebhookEvent webhookEvent)
    {
        // 后续处理用户同步逻辑
        return Ok();
    }
}

// 定义Clerk事件模型（按需补充字段）
public class ClerkWebhookEvent
{
    public string Type { get; set; } // 事件类型：user.created / user.updated
    public UserDetail Data { get; set; }
}

public class UserDetail
{
    public string Id { get; set; }
    public string EmailAddress { get; set; }
    public string FirstName { get; set; }
    public string LastName { get; set; }
    // 添加你需要同步的其他用户字段
}

2. 验证Webhook签名（核心步骤） #

Clerk会对Webhook请求签名，后端必须验证签名合法性，防止恶意请求：

• 从Clerk控制台的Webhook设置页获取Signing Secret
• 实现签名验证逻辑，示例如下：

public class ClerkSignatureValidator
{
    private readonly string _signingSecret;

    public ClerkSignatureValidator(string signingSecret)
    {
        _signingSecret = signingSecret;
    }

    public bool IsValid(HttpRequest request, string requestBody)
    {
        if (!request.Headers.TryGetValue("Clerk-Signature", out var signatureHeader))
            return false;

        var parts = signatureHeader.ToString().Split(',');
        var timestamp = parts.First(p => p.StartsWith("t=")).Split('=')[1];
        var signature = parts.First(p => p.StartsWith("v1=")).Split('=')[1];

        var payload = $"{timestamp}.{requestBody}";
        var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(_signingSecret));
        var computedHash = hmac.ComputeHash(Encoding.UTF8.GetBytes(payload));
        var computedSignature = Convert.ToHexString(computedHash).ToLower();

        return computedSignature == signature;
    }
}

在控制器中集成验证：

private readonly ClerkSignatureValidator _validator;

public UserWebhookController(IConfiguration config)
{
    var secret = config["Clerk:WebhookSigningSecret"];
    _validator = new ClerkSignatureValidator(secret);
}

[HttpPost("profile")]
public async Task<IActionResult> ReceiveClerkEvent()
{
    using var reader = new StreamReader(Request.Body);
    var requestBody = await reader.ReadToEndAsync();
    
    if (!_validator.IsValid(Request, requestBody))
    {
        return Unauthorized("无效的Webhook签名");
    }

    var webhookEvent = JsonSerializer.Deserialize<ClerkWebhookEvent>(requestBody);
    if (webhookEvent.Type is "user.created" or "user.updated")
    {
        await SyncUserToSqlServer(webhookEvent.Data);
    }

    return Ok();
}

private async Task SyncUserToSqlServer(UserDetail user)
{
    // 编写EF Core或ADO.NET代码，完成用户信息的插入/更新操作
}

3. 配置应用密钥 #

在appsettings.json中添加Clerk配置项：

{
  "Clerk": {
    "WebhookSigningSecret": "你的Clerk Webhook签名密钥"
  }
}

4. 解决网络访问问题 #

• 确保后端服务的HTTPS证书为可信证书（Clerk不向自签名证书地址推送Webhook，测试环境可临时关闭验证，生产环境必须用正规证书）
• 开放服务器防火墙/安全组的7072端口，允许Clerk官方IP访问

5. 测试Webhook #

使用Clerk控制台的「测试」功能发送模拟事件，或借助ngrok等工具暴露本地服务，验证请求是否能到达后端并正确处理。

内容的提问来源于stack exchange，提问作者Kousik Raj