如何证明 JWT 是否有效并且是否真的来自 Microsoft？

Question

客户端应用程序正在从 Microsoft 获取 JWT，并将其发送到我的 API。它工作正常，但我的 API 如何知道令牌是否真的来自 Microsaft 以及它是否有效？

这是客户端获取令牌的方式：

string ClientID = "xxx";
string TenantID = "yyy";

IPublicClientApplication pca = PublicClientApplicationBuilder
     .Create(ClientID)
     .WithAuthority(AzureCloudInstance.AzurePublic, TenantID)
     .WithRedirectUri("https://login.microsoftonline.com/common/oauth2/nativeclient")
     .Build();

string[] scopes = { "user.read" };
AuthenticationResult result = await pca.AcquireTokenInteractive(scopes).ExecuteAsync();
string JWT = result.AccessToken;

• 客户端使用 .net framework 4.8 编写
• API 使用 .net core 3.1 编写

Answer 1

在API项目中，可以安装Microsoft.Identity.Web包。 然后在 Startup.cs 中添加如下代码

    services
       .AddAuthentication()
       .AddMicrosoftIdentityWebApi(options => { }, options =>
        {
            options.ClientId = "Your Azure AD ClientId";
            options.TenantId = "Your Azure AD TenantId";
            options.Instance = "https://login.microsoftonline.com/";
        });

要手动完成，请尝试类似

services.AddAuthentication(options =>
            {
                options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
            }).AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
             {
                 var clientSecret = "";
                 var clientId = "";
                 var tenantId = "";

                 options.TokenValidationParameters = new TokenValidationParameters
                 {
                     ValidAudience = clientId,
                     ValidIssuer = $"https://sts.windows.net/{tenantId}/",
                     IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(clientSecret)),
                     ValidateIssuer = true,
                     ValidateIssuerSigningKey = true,
                     ValidateLifetime = true,
                     ValidateAudience = true,
                     ClockSkew = TimeSpan.Zero
                 };
            });