如何在C#的OWIN API及控制台应用中验证Auth0的JWT令牌？

步骤1：安装依赖包 #

安装以下NuGet包：

• System.IdentityModel.Tokens.Jwt
• Microsoft.IdentityModel.Protocols.OpenIdConnect

步骤2：编写验证方法 #

using System.IdentityModel.Tokens.Jwt;
using Microsoft.IdentityModel.Protocols;
using Microsoft.IdentityModel.Protocols.OpenIdConnect;
using Microsoft.IdentityModel.Tokens;

public static async Task<bool> ValidateToken(string accessToken, string auth0Domain, string apiAudience)
{
    var configManager = new ConfigurationManager<OpenIdConnectConfiguration>(
        $"{auth0Domain}.well-known/openid-configuration",
        new OpenIdConnectConfigurationRetriever());

    var openIdConfig = await configManager.GetConfigurationAsync(CancellationToken.None);

    var validationParams = new TokenValidationParameters
    {
        ValidateIssuer = true,
        ValidIssuer = auth0Domain,
        ValidateAudience = true,
        ValidAudience = apiAudience,
        ValidateIssuerSigningKey = true,
        IssuerSigningKeys = openIdConfig.SigningKeys,
        ValidateLifetime = true
    };

    var handler = new JwtSecurityTokenHandler();
    try
    {
        handler.ValidateToken(accessToken, validationParams, out _);
        return true;
    }
    catch (SecurityTokenException)
    {
        // 令牌无效（过期、签名错误、受众不匹配等）
        return false;
    }
}

// 调用示例
var tokenIsValid = await ValidateToken(
    "你的PKCE流程获取的访问令牌",
    "https://你的Auth0租户域名/",
    "你的API标识符");

关键注意事项 #

• 通过OpenID Connect配置端点自动拉取签名密钥，无需手动维护
• 捕获SecurityTokenException处理所有令牌验证失败场景
• 确保auth0Domain和apiAudience与令牌中的iss和aud声明完全匹配

内容的提问来源于stack exchange，提问作者wlscaudill