Auth0与Winforms认证实现问题：调用ASP.NET Core API返回未授权

我在实现一个简单的认证功能时遇到了瓶颈，目标是让.NET 6 WinForms客户端通过Auth0登录，之后用获取的访问令牌调用受Auth0保护的ASP.NET Core MVC风格Web API。

客户端登录代码 #

private async void LoginBtn_Click(object sender, EventArgs e)
{
    Auth0ClientOptions clientOptions = new Auth0ClientOptions
    {
        Domain = this.config["Auth0Domain"].ToString(),
        ClientId = this.config["Auth0ClientId"].ToString(),
        Scope = "offline_access"
    };
    
    var client = new Auth0Client(clientOptions);
    clientOptions.PostLogoutRedirectUri = clientOptions.RedirectUri;
   
    var loginResult = await client.LoginAsync();

    if (loginResult != null)
    {
        if (loginResult.IsError)
        {
            MessageBox.Show(loginResult.Error, "Login", MessageBoxButtons.OK, MessageBoxIcon.Error);
            return;
        }
        else
        {
            this.accessTokenLifetimeManager = new AccessTokenLifetimeManager
                (loginResult, 300, cancellationOnExitTokenSource.Token, config);

            var refreshTokenTask = Task.Run(accessTokenLifetimeManager.PeriodicallyRefreshAccessTokensWorkerTaskAsync);

            vr2Button.Enabled = true;
        }
    }
}

API配置代码（Program.cs） #

var builder = WebApplication.CreateBuilder(args);

var GoogleTextSpeechApiKey = builder.Configuration["GoogleTextSpeech:apikey"];


builder.Services.AddAuthentication(options =>
{
    options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
}).AddJwtBearer(options =>
{
    options.Authority = $"https://{builder.Configuration["Auth0:Domain"]}/";
    options.Audience = builder.Configuration["Auth0:Audience"];
    options.TokenValidationParameters = new TokenValidationParameters
    {
        NameClaimType = ClaimTypes.NameIdentifier
    };
    
});

builder.Services.AddControllers();

builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen();

var app = builder.Build();

if (app.Environment.IsDevelopment())
{
    app.UseSwagger();
    app.UseSwaggerUI();
}

app.UseHttpsRedirection();

app.UseAuthentication();
app.UseAuthorization();

app.MapControllers();
app.Run();

API控制器代码 #

[Authorize]
public class ModelResourceController : ControllerBase
{
    private readonly IWebHostEnvironment _webHostEnvironment;

    public ModelResourceController(IWebHostEnvironment webHostEnvironment)
    {
        _webHostEnvironment = webHostEnvironment;
    }

    [HttpGet]
    [Route("ModelResource/Model/{id}")]
    [ProducesResponseType(StatusCodes.Status200OK)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
    public async Task<ActionResult> ModelAsync(string id)
    {
    //...
    }
}

客户端调用API的RestSharp代码 #

public static partial class GetDiscreteResourceTasks
{
    private static readonly string restClientBaseUrl;

    private static readonly RestClient restClient;

    private static readonly TimeSpan maxDelay;

    private static readonly IEnumerable<TimeSpan> delay;

    private static AsyncRetryPolicy<RestResponse> resourcesRetryPolicy;

    private static AsyncRetryPolicy<RestResponse<ScoreValues>> calculateScoresRetryPolicy;

    static GetDiscreteResourceTasks()
    {
#if LOCAL
            restClientBaseUrl = @"https://localhost:7230";
#else
            restClientBaseUrl = @"xxx";
#endif

        restClient = new RestClient(restClientBaseUrl);
//...
    }

    public static async Task<RestResponse> GetJsonModelAsync(AccessTokenLifetimeManager.TokenValuesClass tokenValues, string resourceId, CancellationToken cancellationToken)
    {
        string htmlResourceId = @"ModelResource/Model/" + System.Web.HttpUtility.UrlEncode(resourceId);

#if DEBUG

            var request = new RestRequest(htmlResourceId, Method.Get);

    //tokenValues.AccessToken.ToJwtBearerHeaderValue() is equivalent to "Bearer <AccessToken>"
            request.AddOrUpdateHeader("Authorization", tokenValues.AccessToken.ToJwtBearerHeaderValue());

            var response = await restClient.ExecuteAsync(request, cancellationToken);

        return response;


#else
//...
#endif
    }

//...
}
}

问题现象 #

• 登录成功后，loginResult中的访问令牌在jwt.io显示Invalid Signature，头部有效但payload为空，推测是签名方式不兼容jwt.io的检测逻辑。
• 用该令牌调用API时，RestSharp返回401 Unauthorized，响应头的WWW-Authenticate值为Bearer error="invalid_token"。
• Auth0控制台只有客户端登录日志，无API相关日志，怀疑ASP.NET Core直接拒绝了令牌，未向Auth0发起验证请求。

排查方向建议 #

1. 检查访问令牌的受众（Audience）配置

   • 当前客户端代码的Scope仅设置了offline_access，未指定API受众，导致Auth0颁发的是ID令牌（ID Token）而非访问令牌（Access Token）——这是payload为空、jwt.io验证失败的核心原因。需要在Auth0ClientOptions中添加Audience参数，值为API在Auth0中配置的标识符：

     Auth0ClientOptions clientOptions = new Auth0ClientOptions
     {
         Domain = this.config["Auth0Domain"].ToString(),
         ClientId = this.config["Auth0ClientId"].ToString(),
         Scope = "offline_access",
         Audience = this.config["Auth0ApiAudience"].ToString() // 新增API受众配置
     };
     

2. 验证令牌类型

   • 登录成功后，确认loginResult.AccessToken是用于API访问的Access Token，而非面向客户端的ID Token。可以通过Auth0控制台的日志详情查看令牌类型。

3. 匹配API与Auth0的配置

   • 确保API的Authority和Audience与Auth0设置完全一致：
     • Authority必须是完整的Auth0域名（如https://your-domain.auth0.com/，注意末尾斜杠）。
     • Audience必须是Auth0中API的标识符（Identifier），不能填写错误。

4. 启用API的详细验证日志

   • 在API的appsettings.Development.json中添加日志配置，获取令牌验证的具体错误信息：

     "Logging": {
       "LogLevel": {
         "Microsoft.AspNetCore.Authentication.JwtBearer": "Debug"
       }
     }
     

   • 运行API后，控制台会输出验证过程中的细节（如受众不匹配、签名无效、令牌过期等）。

5. 确认签名算法一致性

   • 检查Auth0中API的签名算法，默认RS256算法下，ASP.NET Core会自动从Auth0的/.well-known/openid-configuration端点获取公钥验证签名；如果使用HS256，需要在API中配置对应的密钥。

内容的提问来源于stack exchange，提问作者user3561406