options.AutomaticAuthenticate 与 UseJwtBearerAuthentication 的用途

Question

将代码库从 ASP 5 beta 7 更新到 RC1-final 后，我开始从 JwtBearer 中间件

收到此异常

Unable to cast object of type 'Newtonsoft.Json.Linq.JArray' to type 'System.IConvertible'.

到目前为止我能看到的决定因素似乎是 options.AutomaticAuthenticate 的设置。如果是 true，那么我得到异常，否则，我没有。

什么是 AutomaticAuthenticate，为什么我需要启用它？

    app.UseJwtBearerAuthentication(options =>
    {
        options.AutomaticAuthenticate = true; 
    }

这是完整的堆栈跟踪：

at System.Convert.ToInt32(Object value, IFormatProvider provider)
   at System.IdentityModel.Tokens.Jwt.JwtPayload.GetIntClaim(String claimType)
   at System.IdentityModel.Tokens.Jwt.JwtPayload.get_Nbf()
   at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateToken(String token, TokenValidationParameters validationParameters, SecurityToken& validatedToken)
   at Microsoft.AspNet.Authentication.JwtBearer.JwtBearerHandler.<HandleAuthenticateAsync>d__1.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at Microsoft.AspNet.Authentication.JwtBearer.JwtBearerHandler.<HandleAuthenticateAsync>d__1.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult()
   at Microsoft.AspNet.Authentication.AuthenticationHandler`1.<InitializeAsync>d__48.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.GetResult()
   at Microsoft.AspNet.Authentication.AuthenticationMiddleware`1.<Invoke>d__18.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.GetResult()
   at Api.Startup.<<Configure>b__9_0>d.MoveNext() in ...\Startup.cs:line 156

更新根本原因

我们的代码库正在为 nbf、exp 和 iat 创建重复声明。这解释了为什么 get_Nbf 在堆栈跟踪中以及对 "JArray" 的抱怨，因为每个值都是一个数组而不是一个值。

Answer 1

如果它设置为 true 那么中间件将在每个入站请求上运行查找 JWT 令牌，如果存在，它将对其进行验证，如果有效，则从创建身份并将其添加到当前用户。

如果 false 没有发生，您需要通过在授权属性中指定承载方案来请求中间件设置身份。

[Authorize(AuthenticationSchemes = "YourBearerSchemeName")]

或者你在策略中设置这个；

options.AddPolicy("RequireBearer", policy =>
{
    policy.AuthenticationSchemes.Add("YourBearerSchemeName");
    policy.RequireAuthenticatedUser();

});

因此，通过将其设置为 false，您实际上并没有运行在您提出要求之前使用不记名内容，您只是将异常推迟到以后。

options.AutomaticAuthenticate 与 UseJwtBearerAuthentication 的用途

Purpose of options.AutomaticAuthenticate with UseJwtBearerAuthentication

jwt

asp.net-core