ASP.NET Core Web API实现登录时自动注册不存在用户

核心思路 #

在原有登录流程中加入用户存在性校验：若用户不存在，直接使用登录提交的邮箱（同时作为UserName）和密码完成自动注册，随后执行正常登录逻辑（生成认证令牌）。

步骤实现 #

1. 定义登录请求DTO #

先准备接收登录参数的模型，包含必要的邮箱和密码字段：

public class LoginRequestDto
{
    [Required]
    [EmailAddress]
    public string Email { get; set; } = string.Empty;

    [Required]
    [DataType(DataType.Password)]
    public string Password { get; set; } = string.Empty;
}

2. 修改Login服务逻辑 #

假设你已有IAuthService接口和AuthService实现类，注入UserManager<IdentityUser>和配置项，修改LoginAsync方法如下：

public class AuthService : IAuthService
{
    private readonly UserManager<IdentityUser> _userManager;
    private readonly IConfiguration _configuration;

    public AuthService(UserManager<IdentityUser> userManager, IConfiguration configuration)
    {
        _userManager = userManager;
        _configuration = configuration;
    }

    public async Task<AuthResponseDto> LoginAsync(LoginRequestDto request)
    {
        // 1. 查询用户是否存在
        var user = await _userManager.FindByEmailAsync(request.Email);

        // 2. 用户不存在则自动注册
        if (user == null)
        {
            user = new IdentityUser
            {
                UserName = request.Email, // 将Email作为UserName
                Email = request.Email,
                EmailConfirmed = true // 若业务需邮箱验证，可设为false并补充验证流程
            };

            var createResult = await _userManager.CreateAsync(user, request.Password);
            if (!createResult.Succeeded)
            {
                return new AuthResponseDto
                {
                    IsSuccess = false,
                    Errors = createResult.Errors.Select(e => e.Description).ToList()
                };
            }
        }

        // 3. 验证密码（新老用户统一校验）
        var passwordValid = await _userManager.CheckPasswordAsync(user, request.Password);
        if (!passwordValid)
        {
            return new AuthResponseDto
            {
                IsSuccess = false,
                Errors = new List<string> { "邮箱或密码错误" }
            };
        }

        // 4. 生成JWT令牌（完成自动登录）
        var token = GenerateJwtToken(user);

        return new AuthResponseDto
        {
            IsSuccess = true,
            Token = token,
            UserId = user.Id,
            Email = user.Email
        };
    }

    // 生成JWT令牌的辅助方法
    private string GenerateJwtToken(IdentityUser user)
    {
        var claims = new List<Claim>
        {
            new Claim(ClaimTypes.NameIdentifier, user.Id),
            new Claim(ClaimTypes.Email, user.Email),
            new Claim(ClaimTypes.Name, user.UserName)
        };

        var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_configuration["Jwt:Key"]));
        var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);

        var tokenDescriptor = new SecurityTokenDescriptor
        {
            Subject = new ClaimsIdentity(claims),
            Expires = DateTime.UtcNow.AddHours(2), // 按需设置令牌过期时间
            SigningCredentials = creds,
            Issuer = _configuration["Jwt:Issuer"],
            Audience = _configuration["Jwt:Audience"]
        };

        var tokenHandler = new JwtSecurityTokenHandler();
        var token = tokenHandler.CreateToken(tokenDescriptor);

        return tokenHandler.WriteToken(token);
    }
}

3. 配套响应DTO #

定义返回给前端的认证响应模型：

public class AuthResponseDto
{
    public bool IsSuccess { get; set; }
    public string? Token { get; set; }
    public string? UserId { get; set; }
    public string? Email { get; set; }
    public List<string>? Errors { get; set; }
}

4. 更新控制器端点 #

修改登录接口的Action，调用修改后的服务方法：

[ApiController]
[Route("api/auth")]
public class AuthController : ControllerBase
{
    private readonly IAuthService _authService;

    public AuthController(IAuthService authService)
    {
        _authService = authService;
    }

    [HttpPost("login")]
    public async Task<IActionResult> Login([FromBody] LoginRequestDto request)
    {
        if (!ModelState.IsValid)
        {
            return BadRequest(ModelState);
        }

        var response = await _authService.LoginAsync(request);
        if (!response.IsSuccess)
        {
            return BadRequest(response);
        }

        return Ok(response);
    }
}

关键注意事项 #

• 密码策略配置：若需调整密码强度要求，可在Program.cs中修改Identity配置：

  builder.Services.AddIdentity<IdentityUser, IdentityRole>(options =>
  {
      options.Password.RequireDigit = false;
      options.Password.RequireLowercase = false;
      // 按需配置其他密码规则
  })
  .AddEntityFrameworkStores<AppDbContext>();
  

• 邮箱验证逻辑：如果业务要求用户必须验证邮箱才能登录，需将注册时的EmailConfirmed设为false，并在登录前检查该字段，补充邮箱发送验证链接的流程。
• 错误信息优化：可根据业务场景细化错误提示，比如区分“注册失败”和“密码错误”，但注意避免泄露敏感信息。
• 性能优化：可给AspNetUsers表的Email字段添加索引，提升用户查询效率。

内容的提问来源于stack exchange，提问作者Ayobamilaye