拥有ASP.NET Core Identity后端的.NET MAUI应用身份验证实现方案咨询

核心思路 #

你已有基于ASP.NET Core Identity的后端，MAUI端核心是实现令牌验证流程（移动端优先推荐JWT）：完成登录获取令牌，后续请求自动携带令牌完成身份校验。

具体步骤 #

1. 后端确认JWT配置（确保Identity兼容） #

先检查ASP.NET Core项目已正确配置JWT认证，在Program.cs中添加：

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidateAudience = true,
            ValidateLifetime = true,
            ValidateIssuerSigningKey = true,
            ValidIssuer = builder.Configuration["Jwt:Issuer"],
            ValidAudience = builder.Configuration["Jwt:Audience"],
            IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(builder.Configuration["Jwt:Key"]))
        };
    });

同时新增登录接口，验证用户名密码后返回JWT令牌：

[HttpPost("login")]
public async Task<IActionResult> Login([FromBody] LoginModel model)
{
    var user = await _userManager.FindByNameAsync(model.Username);
    if (user != null && await _userManager.CheckPasswordAsync(user, model.Password))
    {
        var authClaims = new List<Claim>
        {
            new Claim(ClaimTypes.Name, user.UserName),
            new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString()),
        };

        var authSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_configuration["Jwt:Key"]));
        var token = new JwtSecurityToken(
            issuer: _configuration["Jwt:Issuer"],
            audience: _configuration["Jwt:Audience"],
            expires: DateTime.Now.AddHours(3),
            claims: authClaims,
            signingCredentials: new SigningCredentials(authSigningKey, SecurityAlgorithms.HmacSha256)
        );

        return Ok(new
        {
            token = new JwtSecurityTokenHandler().WriteToken(token),
            expiration = token.ValidTo
        });
    }
    return Unauthorized();
}

// 配套登录模型
public class LoginModel
{
    public string Username { get; set; }
    public string Password { get; set; }
}

2. MAUI 实现登录逻辑 #

• 创建登录页面，包含用户名、密码输入框和登录按钮。
• 通过HttpClient发送登录请求，将获取到的令牌存入安全存储（SecureStorage，避免明文泄露）：

private async void LoginBtn_Clicked(object sender, EventArgs e)
{
    var loginData = new { Username = UsernameEntry.Text, Password = PasswordEntry.Text };
    var jsonContent = new StringContent(JsonSerializer.Serialize(loginData), Encoding.UTF8, "application/json");

    using var client = new HttpClient();
    var response = await client.PostAsync("https://你的后端域名/api/auth/login", jsonContent);

    if (response.IsSuccessStatusCode)
    {
        var tokenResult = await response.Content.ReadFromJsonAsync<TokenResponse>();
        await SecureStorage.SetAsync("auth_token", tokenResult.Token);
        // 跳转至主页面
        await Shell.Current.GoToAsync("//MainPage");
    }
    else
    {
        await DisplayAlert("登录失败", "用户名或密码错误", "确定");
    }
}

// 令牌响应模型
public class TokenResponse
{
    public string Token { get; set; }
    public DateTime Expiration { get; set; }
}

3. 全局请求自动携带令牌 #

创建自定义HttpClient服务，自动为请求添加Authorization头：

public class AuthHttpClient
{
    private readonly HttpClient _client;

    public AuthHttpClient(HttpClient client)
    {
        _client = client;
        _client.BaseAddress = new Uri("https://你的后端域名/api/");
    }

    public async Task<HttpResponseMessage> GetAsync(string uri)
    {
        var token = await SecureStorage.GetAsync("auth_token");
        if (!string.IsNullOrEmpty(token))
        {
            _client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token);
        }
        return await _client.GetAsync(uri);
    }

    // 按需封装PostAsync、PutAsync等方法
}

在MauiProgram.cs中注册该服务：

builder.Services.AddHttpClient<AuthHttpClient>();

4. 登录状态管理 #

在App启动时检查令牌有效性，跳转对应页面：

protected override async void OnStart()
{
    var token = await SecureStorage.GetAsync("auth_token");
    if (string.IsNullOrEmpty(token))
    {
        await Shell.Current.GoToAsync("//LoginPage");
    }
    // 可选：添加令牌过期校验逻辑
}

5. 登出功能 #

清除安全存储中的令牌，跳转回登录页：

private async void LogoutBtn_Clicked(object sender, EventArgs e)
{
    await SecureStorage.RemoveAsync("auth_token");
    await Shell.Current.GoToAsync("//LoginPage");
}

关键注意事项 #

• 必须使用SecureStorage存储令牌，禁止用普通Preferences，防止令牌泄露。
• 后端需配置CORS，允许MAUI应用的请求来源跨域访问。
• 可扩展令牌自动刷新逻辑，在令牌快过期时调用后端刷新接口获取新令牌。

内容的提问来源于stack exchange，提问作者Samuel Severua