在ASP.NET Core2.0中使用Swagger UI实现令牌授权

Question

我想在我的应用程序中使用Swagger来使用JWT承载令牌授权。当我使用邮递员工具授权工作很好。但是，当我尝试使用Swagger进行授权时，控制器方法总是返回未授权，即使在传递令牌之后也是如此。

我是不是缺少了一些用于接受令牌的代码行？实现的代码如下所示。

public void ConfigureServices(IServiceCollection services)
    {           
   // Register the Swagger generator, defining one or more Swagger documents
        services.AddSwaggerGen(c =>
        {
            c.SwaggerDoc("v1", new Info { Title = "XYZ API", Version = "v1", Description = "This is a API for XYZ client applications.", });
            c.IncludeXmlComments(GetXmlCommentsPath());
            c.AddSecurityDefinition("Bearer", new ApiKeyScheme { In = "header", Description = "Please paste JWT Token with Bearer + White Space + Token into field", Name = "Authorization", Type = "apiKey" });
            //c.AddSecurityDefinition("basic", new BasicAuthScheme { Type = "basic" });
        });

        services.AddCors(config =>
        {
            var policy = new CorsPolicy();
            policy.Headers.Add("*");
            policy.Methods.Add("*");
            policy.Origins.Add("*");
            policy.SupportsCredentials = true;
            config.AddPolicy("policy", policy);
        });


        services.AddAuthorization(auth =>
        {
            auth.AddPolicy("Bearer", new AuthorizationPolicyBuilder()
                .AddAuthenticationSchemes(JwtBearerDefaults.AuthenticationScheme‌​)
                .RequireAuthenticatedUser().Build());
        });

        services.AddAuthentication(options =>
        {
            options.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
        })
        .AddJwtBearer(options =>
        {

            options.TokenValidationParameters = new TokenValidationParameters()
            {
                ValidateIssuer = true,
                ValidateAudience = true,
                ValidateLifetime = true,
                ValidateIssuerSigningKey = true,
                IssuerSigningKey = _signingKey,
                ValidAudience = "Audience",
                ValidIssuer = "Issuer",
                // ClockSkew = TimeSpan.FromMinutes(0)
                ClockSkew = TimeSpan.Zero
            };
        });
}


public void Configure(IApplicationBuilder app, IHostingEnvironment env)
    {
        app.UseCors("policy");
        app.UseAuthentication();
        app.UseMvc();


       // Enable middleware to serve generated Swagger as a JSON endpoint.
        app.UseSwagger();
        // Enable middleware to serve swagger-ui (HTML, JS, CSS etc.), specifying the Swagger JSON endpoint.
        app.UseSwaggerUI(c =>
        {
            c.SwaggerEndpoint("/swagger/v1/swagger.json", "XYZ API V1");
        });
     }

Controller
[Authorize("Bearer")]
[Route("api/[controller]")]
public class ValuesController : Controller
{


}

Answer 1

您还需要在swagger模式定义中添加AddSecurityRequirement，以表明该模式适用于API中的所有操作。如下所示：

c.AddSecurityRequirement(new Dictionary<string, IEnumerable<string>>
{
    { "Bearer", new string[] { } }
});

因此，完整的定义将是：

services.AddSwaggerGen(c =>
{
    c.SwaggerDoc("v1", new Info { Title = "XYZ API", Version = "v1", Description = "This is a API for XYZ client applications."});
    c.IncludeXmlComments(GetXmlCommentsPath());
    c.AddSecurityDefinition("Bearer", new ApiKeyScheme 
    {
        In = "header", 
        Description = "Please paste JWT Token with Bearer + White Space + Token into field", 
        Name = "Authorization", 
        Type = "apiKey" 
    });
    c.AddSecurityRequirement(new Dictionary<string, IEnumerable<string>>
    {
        { "Bearer", new string[] { } }
    });
});