ASP.NET Core 7.0迁移后OnTokenValidated事件未触发问题求助

我正在API层添加自定义JWT验证，用的是ASP.NET Core 7.0。原本期望客户端调用带[Authorize]特性的API方法时，OnTokenValidated事件能被触发，但这段在ASP.NET Core 3.1里正常运行的代码，迁移到7.0后完全没反应。以下是program.cs里的代码：

builder.Services.AddAuthorization();
builder.Services.AddAuthentication();

var secretKey = builder.Configuration.GetValue<string>("Auth:SecretKey");


builder.Services.AddAuthentication(o =>
{
    o.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    o.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
})
               .AddJwtBearer(x =>
               {
                   x.RequireHttpsMetadata = false;
                   x.SaveToken = true;
                   x.TokenValidationParameters = new TokenValidationParameters
                   {
                       ValidateIssuerSigningKey = true,
                       IssuerSigningKey = new SymmetricSecurityKey(Convert.FromBase64String(secretKey)),
                       ValidateIssuer = false,
                       ValidateAudience = false,
                   };
                   x.Events = new JwtBearerEvents
                   {
                       OnTokenValidated = context =>
                       {
                           var sessionManager = context.HttpContext.RequestServices.GetRequiredService<ISessionManager>();
                        
                           if (!sessionManager.IsCurrentTokenValid())
                           {
                               context.Fail($"invalidToken");
                        
                           }

                           return Task.CompletedTask;
                       }
                   };
               });

var app = builder.Build();

问题原因及修复方案 #

1. 重复注册Authentication服务 #

代码里两次调用了builder.Services.AddAuthentication()：第一次无参数，第二次带JWT配置。在ASP.NET Core 7.0中，重复注册会覆盖后续配置，导致你设置的JWT Bearer选项不生效。直接删掉第一次无参数的AddAuthentication()调用就行。

2. 缺少认证/授权中间件 #

ASP.NET Core 7.0要求在app.Build()之后必须添加认证和授权中间件，而且顺序不能错：先加认证，再加授权。

修改后的核心代码如下：

// 移除重复的builder.Services.AddAuthentication();
builder.Services.AddAuthorization();

var secretKey = builder.Configuration.GetValue<string>("Auth:SecretKey");

builder.Services.AddAuthentication(o =>
{
    o.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    o.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddJwtBearer(x =>
{
    x.RequireHttpsMetadata = false;
    x.SaveToken = true;
    x.TokenValidationParameters = new TokenValidationParameters
    {
        ValidateIssuerSigningKey = true,
        IssuerSigningKey = new SymmetricSecurityKey(Convert.FromBase64String(secretKey)),
        ValidateIssuer = false,
        ValidateAudience = false,
    };
    x.Events = new JwtBearerEvents
    {
        OnTokenValidated = context =>
        {
            var sessionManager = context.HttpContext.RequestServices.GetRequiredService<ISessionManager>();
        
            if (!sessionManager.IsCurrentTokenValid())
            {
                context.Fail("invalidToken");
            }

            return Task.CompletedTask;
        }
    };
});

var app = builder.Build();

// 必须添加这两个中间件，顺序不能乱
app.UseAuthentication();
app.UseAuthorization();

// 别忘了添加路由映射
app.MapControllers();

app.Run();

3. 额外排查点 #

• 确认客户端请求时正确携带了JWT Token，格式为Bearer {token}
• 检查secretKey的Base64解码是否正确，密钥错误会导致Token验证提前失败，OnTokenValidated不会触发
• 如果接口加了[AllowAnonymous]，不会走认证流程，自然也不会触发事件

内容的提问来源于stack exchange，提问作者Massimiliano Peluso