错误：响应状态为 404，JWT 在 NET 6 Web Api 中使用 Swagger

【问题标题】：Error: response status is 404 with JWT using Swagger in NET 6 Web Api错误：响应状态为 404，JWT 在 NET 6 Web Api 中使用 Swagger
【发布时间】：2022-06-12 22:18:39
【问题描述】：

我在 NET 6 中有 2 个使用 Swagger 的身份验证端点。第一个端点使用 _signInManager.PasswordSignInAsync，它按预期工作。输入有效的用户名和密码后，就可以访问受保护的资源了。

但是使用 _userManager.CheckPasswordAsync 和 JWT 的第二个端点没有按预期工作。我通过输入相同的有效用户名和密码对此进行了测试。它返回我的令牌。但是在 Swagger Authorize 中复制并粘贴令牌字符串后，我无法访问受保护的资源。

这里是一些相关的代码。

    [AllowAnonymous]
    [HttpPost("Token")]
    public async Task<IActionResult> CheckPasswordAsync([FromBody] LoginRequest loginRequest)
    {
        if (ModelState.IsValid)
        {
            ApplicationUser user = await _userManager.FindByEmailAsync(loginRequest.Username);

            if (user == null)
            {
                return NotFound($"Unable to load user with username '{loginRequest.Username}'.");
            }

            if (await _userManager.CheckPasswordAsync(user, loginRequest.Password) == false) {
                await _signInManager.SignOutAsync();
                return BadRequest("Invalid username or password.");
            };

            var appUser = _dBContext.Users
                .FirstOrDefault(u => u.Email == loginRequest.Username);

            if (appUser == null)
            {
                await _signInManager.SignOutAsync();
                return BadRequest();
            }

            user.LastSignInDate = DateTime.Now;

            var token = GetToken(appUser);

            return Ok(token);                
        }
        return BadRequest(ModelState);
    }

    private string GetToken(User user)
    {
        var claims = new List<Claim>
        {  
            new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()),
            new Claim(ClaimTypes.Name, user.Email),
            new Claim(ClaimTypes.Role, user.RoleId)
        };

        var key = new SymmetricSecurityKey(System.Text.Encoding.UTF8
            .GetBytes("xxx"));

        var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha512Signature);

        var token = new JwtSecurityToken(
                claims: claims,
                expires: DateTime.Now.AddDays(1),
                signingCredentials: creds);

        string tokenString = new JwtSecurityTokenHandler().WriteToken(token);

        return tokenString;
    }

还有我的program.cs

builder.Services.AddSwaggerGen(c =>
{
    var xmlFile = $"{Assembly.GetExecutingAssembly().GetName().Name}.xml";
    var xmlPath = Path.Combine(AppContext.BaseDirectory, xmlFile);
    c.IncludeXmlComments(xmlPath);

    c.AddSecurityDefinition("Bearer", new OpenApiSecurityScheme
    {
        Scheme = "Bearer",
        BearerFormat = "JWT",
        In = ParameterLocation.Header,
        Name = "Authorization",
        Description = "Bearer Authentication with JWT Token",
        Type = SecuritySchemeType.Http
    });

    c.AddSecurityRequirement(new OpenApiSecurityRequirement
    {
        {
            new OpenApiSecurityScheme
            {
                Reference = new OpenApiReference
                {
                    Id = "Bearer",
                    Type = ReferenceType.SecurityScheme
                }
            },
            new List<string>()
        }
    });
});

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options => {
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidateAudience = true,
            ValidateLifetime = true,
            ValidateIssuerSigningKey = true,
            ValidIssuer = builder.Configuration["Jwt:Issuer"],
            ValidAudience = builder.Configuration["Jwt:Audience"],
            IssuerSigningKey = 
            new SymmetricSecurityKey(Encoding.UTF8.GetBytes(builder.Configuration["Jwt:Key"]))
        };
    });
builder.Services.AddAuthorization();

...

app.UseAuthentication();
app.UseAuthorization();


app.MapControllers().RequireAuthorization();

【问题讨论】：

• 端点称为/api/MarketingEvent，但显示的代码中没有这样的端点...

标签： c#