ASP.NET Core 6 Web API配置AWS Cognito授权遇无效受众错误

问题概述 #

配置AWS Cognito授权时，执行以下代码后出现受众验证错误：

var AWSconfiguration = builder.Configuration.GetSection("AWS:Cognito");
var userPoolId = AWSconfiguration["UserPoolId"];
var clientId = AWSconfiguration["ClientId"];
var region = AWSconfiguration["Region"];

builder.Services.AddAuthentication(options =>
{
    options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddJwtBearer(options =>
{
    options.Authority = $"https://cognito-idp.{region}.amazonaws.com/{userPoolId}";
    options.TokenValidationParameters = new TokenValidationParameters
    {
        ValidateIssuerSigningKey = true,
        ValidateIssuer = true,
        ValidateAudience = true,
        ValidIssuer = $"https://cognito-idp.{region}.amazonaws.com/{userPoolId}",
        ValidAudience = clientId,
        
    };
});

错误信息：

www-authenticate: Bearer error="invalid_token",
error_description="The audience 'empty' is invalid"

已确认AWS控制台的ClientID正确，需解决该问题。

解决方案 #

1. 检查令牌的aud字段 #

用JWT解析工具解码你请求中使用的令牌，查看aud（受众）字段的实际值：

• ID Token：aud值应为你的应用客户端ID（即配置中的clientId）
• Access Token：默认aud值为aws.cognito.signin.user.admin，若配置了资源服务器则为对应的标识符

2. 匹配ValidAudience配置 #

根据令牌类型调整TokenValidationParameters中的ValidAudience：

• 使用ID Token时，保留ValidAudience = clientId，但需确保请求传递的是ID Token而非Access Token
• 使用Access Token时，将ValidAudience替换为aws.cognito.signin.user.admin或资源服务器标识符

3. 处理数组格式的aud字段 #

部分场景下Cognito返回的令牌中aud是数组，此时需添加自定义验证逻辑：

.AddJwtBearer(options =>
{
    options.Authority = $"https://cognito-idp.{region}.amazonaws.com/{userPoolId}";
    options.TokenValidationParameters = new TokenValidationParameters
    {
        ValidateIssuerSigningKey = true,
        ValidateIssuer = true,
        ValidateAudience = true,
        ValidIssuer = $"https://cognito-idp.{region}.amazonaws.com/{userPoolId}",
        ValidAudience = clientId,
        // 支持数组格式的受众验证
        AudienceValidator = (audiences, token, parameters) =>
        {
            return audiences.Contains(clientId);
        }
    };
});

4. 验证配置值加载正确性 #

确认clientId是否从配置文件正确读取，可添加日志输出检查：

Console.WriteLine($"Loaded ClientId: {clientId}");

同时检查appsettings.json中的配置层级是否为"AWS:Cognito:ClientId"，确保与代码中GetSection("AWS:Cognito")的路径匹配。

5. 自动加载Cognito验证元数据（推荐） #

让AddJwtBearer自动从Cognito的OpenID配置端点获取验证参数，避免手动设置签名密钥和发行者：

builder.Services.AddAuthentication(options =>
{
    options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddJwtBearer(options =>
{
    options.Authority = $"https://cognito-idp.{region}.amazonaws.com/{userPoolId}";
    options.TokenValidationParameters = new TokenValidationParameters
    {
        ValidateAudience = true,
        ValidAudience = clientId, // 根据令牌类型调整
        AudienceValidator = (audiences, token, parameters) => audiences.Contains(clientId)
    };
    // 自动获取OpenID配置信息
    options.ConfigurationManager = new ConfigurationManager<OpenIdConnectConfiguration>(
        $"{options.Authority}/.well-known/openid-configuration",
        new OpenIdConnectConfigurationRetriever(),
        new HttpDocumentRetriever());
});

最后确认中间件顺序 #

确保在Program.cs中按正确顺序添加中间件：

app.UseAuthentication();
app.UseAuthorization();

内容的提问来源于stack exchange，提问作者Yaron