ASP.NET Core MVC中通过Header传递JWT Token的实现方案

步骤1：在MVC项目中启用Session #

首先确保MVC项目支持Session，用于存储登录后获取的Token。在Program.cs中添加以下配置：

// 注册Session服务
builder.Services.AddSession(options =>
{
    options.IdleTimeout = TimeSpan.FromHours(3); // 与API生成的Token过期时间保持一致
    options.Cookie.HttpOnly = true;
    options.Cookie.IsEssential = true;
});

// 添加Session中间件（放在UseRouting之后，UseAuthorization之前）
app.UseSession();

步骤2：修改MVC登录方法，保存Token到Session #

更新登录接口的实现，解析API返回的Token并存储到Session中：

[HttpPost]
public async Task<IActionResult> LogIn(LogInModel log)
{
    HttpClient client = _api.Initial();
    // 注意移除原URL末尾多余的斜杠
    var response = await client.PostAsJsonAsync("api/Authonticate/LogIn", log);

    if (response.IsSuccessStatusCode)
    {
        // 读取API返回的Token数据
        var resultString = await response.Content.ReadAsStringAsync();
        var tokenData = JsonConvert.DeserializeObject<dynamic>(resultString);
        string jwtToken = tokenData.token;
        
        // 将Token存入Session
        HttpContext.Session.SetString("JWTToken", jwtToken);
        
        return RedirectToAction("Index", "Home", new { Area = "Employee" });
    }
    
    ModelState.AddModelError("", "邮箱或密码错误");
    return View(log);
}

步骤3：自动为HttpClient添加Token Header #

方式一：全局注入式（推荐）

1. 先在Program.cs注册IHttpContextAccessor，用于访问Session：

builder.Services.AddHttpContextAccessor();

2. 修改Helper类api，通过构造函数注入IHttpContextAccessor，并自动添加Token到Header：

public class api
{
    private readonly IHttpContextAccessor _httpContextAccessor;

    public api(IHttpContextAccessor httpContextAccessor)
    {
        _httpContextAccessor = httpContextAccessor;
    }

    public HttpClient Initial()
    {
        var client = new HttpClient();
        client.BaseAddress = new Uri("https://localhost:44324/");
        
        // 从Session获取Token，存在则添加Authorization头
        var jwtToken = _httpContextAccessor.HttpContext?.Session.GetString("JWTToken");
        if (!string.IsNullOrEmpty(jwtToken))
        {
            client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", jwtToken);
        }
        
        return client;
    }
}

3. 在MVC控制器中通过构造函数注入api类，代替直接实例化：

[Area("Admin")]
public class RegisterController : Controller
{
    private readonly api _api;

    public RegisterController(api api)
    {
        _api = api;
    }

    // 后续接口调用逻辑无需修改，Initial方法会自动添加Token
}

方式二：手动添加（按需使用）

如果不需要全局添加Token，可以在每次调用API前手动设置Header：

public async Task<IActionResult> GetUserRoles()
{
    HttpClient client = _api.Initial();
    var jwtToken = HttpContext.Session.GetString("JWTToken");
    
    if (!string.IsNullOrEmpty(jwtToken))
    {
        client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", jwtToken);
    }
    
    HttpResponseMessage res = await client.GetAsync("api/Authonticate/Role");
    if (res.IsSuccessStatusCode)
    {
        var result = await res.Content.ReadAsStringAsync();
        var userRoles = JsonConvert.DeserializeObject<List<dynamic>>(result);
        return View(userRoles);
    }
    else if (res.StatusCode == HttpStatusCode.Unauthorized)
    {
        // Token无效或过期，跳转登录页
        return RedirectToAction("LogIn");
    }
    return NotFound();
}

步骤4：保护API接口 #

在API中需要授权访问的接口或控制器上添加[Authorize]属性，确保只有携带有效Token的请求才能访问：

[HttpGet]
[Route("Role")]
[Authorize] // 添加授权属性
public IQueryable<Object> Role()
{
    // 原逻辑不变
}

步骤5：登出时清除Token #

修改MVC的登出方法，清除Session中的Token：

public async Task<IActionResult> LogOut()
{
    // 清除Session中的Token
    HttpContext.Session.Remove("JWTToken");
    
    HttpClient client = _api.Initial();
    HttpResponseMessage res = await client.GetAsync("api/Authonticate/LogOut");

    if (res.IsSuccessStatusCode)
    {
        return RedirectToAction("Index", "Home", new { Area = "Employee" });
    }
    return NotFound();
}

内容的提问来源于stack exchange，提问作者Laxmi Teli