ASP.NET Core Web API基于JWT的角色授权实现方法咨询

Hey there! I know how frustrating it can be when you’re trying to implement role-based authorization with JWT in ASP.NET Core and existing articles don’t hit the mark. Let me share some concrete steps, example code, and reliable learning resources that should get you sorted out quickly.

1. Core Configuration & Example Code #

First, let’s cover the key pieces you need to get this working: ensuring your JWT tokens include role claims, configuring auth services correctly, and applying authorization rules to your controllers/actions.

Example 1: Generate JWT Tokens with Role Claims #

When creating your JWT, make sure to add role claims using ClaimTypes.Role (or custom claim names if you prefer):

using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Text;
using Microsoft.IdentityModel.Tokens;

// Build claims list including roles
var claims = new List<Claim>
{
    new Claim(ClaimTypes.Name, "alvin.quezon@example.com"),
    // Add single role
    new Claim(ClaimTypes.Role, "Admin"),
    // Add multiple roles if needed
    new Claim(ClaimTypes.Role, "ContentManager")
};

// Configure token signing credentials
var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration["Jwt:SecretKey"]));
var signingCreds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);

// Create JWT token
var jwtToken = new JwtSecurityToken(
    issuer: Configuration["Jwt:Issuer"],
    audience: Configuration["Jwt:Audience"],
    claims: claims,
    expires: DateTime.UtcNow.AddHours(1),
    signingCredentials: signingCreds);

// Convert token to string
var tokenString = new JwtSecurityTokenHandler().WriteToken(jwtToken);

Example 2: Configure Auth & Authorization in Program.cs (.NET 6+) #

The order of middleware and service configuration matters a lot here:

var builder = WebApplication.CreateBuilder(args);

// Add JWT authentication
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidateAudience = true,
            ValidateLifetime = true,
            ValidateIssuerSigningKey = true,
            ValidIssuer = builder.Configuration["Jwt:Issuer"],
            ValidAudience = builder.Configuration["Jwt:Audience"],
            IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(builder.Configuration["Jwt:SecretKey"])),
            // Ensure role claims are correctly mapped (match your token's claim name)
            RoleClaimType = ClaimTypes.Role
        };
    });

// Add authorization with custom policies
builder.Services.AddAuthorization(options =>
{
    // Policy requiring Admin role
    options.AddPolicy("RequireAdmin", policy => policy.RequireRole("Admin"));
    // Policy requiring either Admin or ContentManager role
    options.AddPolicy("RequireAdminOrContentManager", policy => 
        policy.RequireRole("Admin", "ContentManager"));
    // Policy requiring both roles (AND logic)
    options.AddPolicy("RequireDualRoles", policy =>
    {
        policy.RequireClaim(ClaimTypes.Role, "Admin");
        policy.RequireClaim(ClaimTypes.Role, "ContentManager");
    });
});

builder.Services.AddControllers();

var app = builder.Build();

// Middleware order: Authentication first, then Authorization
app.UseAuthentication();
app.UseAuthorization();

app.MapControllers();

app.Run();

Example 3: Apply Authorization to Controllers/Actions #

Use attributes to restrict access based on roles or custom policies:

[ApiController]
[Route("api/[controller]")]
[Authorize] // Require authenticated users (any role)
public class DashboardController : ControllerBase
{
    // Only accessible to users with Admin role
    [HttpGet("admin-dashboard")]
    [Authorize(Roles = "Admin")]
    public IActionResult GetAdminDashboard()
    {
        return Ok("Admin-only dashboard data");
    }

    // Uses custom policy for Admin or ContentManager
    [HttpGet("content-dashboard")]
    [Authorize(Policy = "RequireAdminOrContentManager")]
    public IActionResult GetContentDashboard()
    {
        return Ok("Content manager dashboard data");
    }

    // Requires both Admin and ContentManager roles
    [HttpGet("super-dashboard")]
    [Authorize(Policy = "RequireDualRoles")]
    public IActionResult GetSuperDashboard()
    {
        return Ok("Super user dashboard data");
    }
}

2. Reliable Learning Resources (No External Links) #

Since you mentioned existing articles didn’t help, focus on these authoritative sources:

• ASP.NET Core Official Documentation: Head to the "Authorization in ASP.NET Core" section, specifically the "Role-based authorization" and "JWT Bearer authentication" subsections. These cover edge cases, troubleshooting tips, and advanced scenarios like policy-based authorization.
• Microsoft Learn Modules: Search for the "Secure an ASP.NET Core API with JWT authentication and authorization" module. It’s a step-by-step hands-on tutorial that walks you from token generation to role-based access control, with interactive exercises.
• Microsoft’s ASP.NET Core Samples Repository: Check the official GitHub samples for ASP.NET Core—there are dedicated projects for JWT auth and role-based authorization that you can clone, run, and dissect to see full working implementations.

Common Pitfalls to Avoid #

• Claim Name Mismatch: If your JWT uses a custom claim name for roles (like roles instead of the default ClaimTypes.Role), make sure to set RoleClaimType = "roles" in your TokenValidationParameters.
• Middleware Order: Always call UseAuthentication() before UseAuthorization()—otherwise, authorization checks will run before the user’s identity is established.
• Role Case Sensitivity: Role names are case-sensitive by default. If you want case-insensitive checks, you can customize the authorization policy to ignore case.

内容的提问来源于stack exchange，提问作者Alvin Quezon