ASP.NET Core7 Identity+JWT认证异常：过期Token仍通过校验

已找到的解决方案 #

将TokenValidationParameters中的ClockSkew设置为TimeSpan.Zero

问题场景与配置 #

我在使用ASP.NET Core Identity框架结合JWT实现认证功能，已完成以下配置：

1. Identity服务注入 #

builder.Services.AddIdentity<AppUser, IdentityRole>(options =>
    {
        options.Password.RequireNonAlphanumeric = false;
        options.Password.RequireUppercase = false;
        options.Password.RequireLowercase = false;
        options.Password.RequireDigit = false;
        options.Password.RequiredUniqueChars = 1;
        options.Password.RequiredLength = 8;
        options.Lockout.AllowedForNewUsers = true;
        options.User.AllowedUserNameCharacters = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_";
    })
    .AddEntityFrameworkStores<ApplicationDbContext>();

2. JWT中间件配置 #

builder.Services
    .AddAuthentication(options =>
    {
        options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
        options.DefaultSignInScheme = JwtBearerDefaults.AuthenticationScheme;
        options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    })
    .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, config =>
    {
        var _configuration = builder.Configuration;
        JwtSettings jwtSettings = _configuration.GetSection("Auth").Get<AuthSettings>()!.Jwt; // 已做非空校验

        var secretKey = jwtSettings.Key;

        config.TokenValidationParameters = new TokenValidationParameters()
        {
            ValidIssuer = jwtSettings.Issuer,
            ValidAudience = jwtSettings.Audience,
            ValidateAudience = true,
            ValidateIssuer = true,
            ValidateLifetime = true,
            ValidateIssuerSigningKey = true,
            IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(secretKey)),
            ClockSkew = TimeSpan.Zero // 默认Token有5分钟的偏移量，手动配置后可支持短于5分钟的有效期
        };
    });

3. 受保护的控制器方法 #

[Authorize()]
[HttpGet()]
public IActionResult Secret()
{
    return Ok();
}

4. Token生成代码 #

public string GenerateAccessToken(IEnumerable<Claim> claims)
{
    var jwtSettings = _authSettings.Jwt;

    var secretKey = jwtSettings.Key;
    var securityKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(secretKey));
    var signingCredentials = new SigningCredentials(securityKey, SecurityAlgorithms.HmacSha256);

    var token = new JwtSecurityToken(
        jwtSettings.Issuer,
        jwtSettings.Audience,
        claims,
        expires: DateTime.Now.ToUniversalTime(),,
        signingCredentials: signingCredentials
        );

    return new JwtSecurityTokenHandler().WriteToken(token);
}

问题描述 #

我生成JWT时将过期时间设置为当前UTC时间（即Token生成瞬间就已过期），但携带该过期Token请求Secret接口时，请求仍能通过认证校验。我已尝试调整Identity与JWT配置的注册顺序，问题依旧存在。

请问问题出在哪里？

内容的提问来源于stack exchange，提问作者x_a1r_x