blocks|key|2266084|text|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2266085|如果Cookie/token过期，应用程序接口调用将被拒绝，但我的FE-BE如何知道它们不再有效？我是否要检查每个请求的到期日期？|blockquote|2266086|2266087|2266088|要确定授权访问是否已过期，请检查optionally+comes+with+an+OpenID+Connect+implicit+flow+response.的expires_in时间范围。|offset|length|style|CODE|2266089|2266090|access_token|unordered-list-item|2266091|token_type|2266092|id_token|2266093|state|2266094|expires_in可选。访问令牌自生成响应以来的过期时间。|2266095|2266096|由于access_token对客户端通常是不透明的，因此确定访问权限是否已过期的唯一另一种方法是询问access_token的颁发者。|2266097|2266098|但我的问题是，我如何知道他在X分钟后仍在登录？|2266099|2266100|2266101|要确定您的用户是否仍在登录，请使用id_token而不是access_token。|2266102|entityMap|0|LINK|mutability|MUTABLE|url|http://openid.net/specs/openid-connect-core-1_0.html#ImplicitAuthResponse^0|0|0|0|0|28|A|G|1R|0|0|0|0|C|0|0|A|0|0|8|0|0|5|0|0|A|0|0|0|0|0|0|0|H|8|S|C|0^^$0|@$1|2|3|-4|4|5|6|1F|7|@]|8|@]|9|$]]|$1|A|3|B|4|C|6|1G|7|@]|8|@]|9|$]]|$1|D|3|-4|4|5|6|1H|7|@]|8|@]|9|$]]|$1|E|3|-4|4|5|6|1I|7|@]|8|@]|9|$]]|$1|F|3|G|4|5|6|1J|7|@$H|1K|I|1L|J|K]]|8|@$H|1M|I|1N|1|1O]]|9|$]]|$1|L|3|-4|4|5|6|1P|7|@]|8|@]|9|$]]|$1|M|3|N|4|O|6|1Q|7|@$H|1R|I|1S|J|K]]|8|@]|9|$]]|$1|P|3|Q|4|O|6|1T|7|@$H|1U|I|1V|J|K]]|8|@]|9|$]]|$1|R|3|S|4|O|6|1W|7|@$H|1X|I|1Y|J|K]]|8|@]|9|$]]|$1|T|3|U|4|O|6|1Z|7|@$H|20|I|21|J|K]]|8|@]|9|$]]|$1|V|3|W|4|O|6|22|7|@$H|23|I|24|J|K]]|8|@]|9|$]]|$1|X|3|-4|4|5|6|25|7|@]|8|@]|9|$]]|$1|Y|3|Z|4|5|6|26|7|@]|8|@]|9|$]]|$1|10|3|-4|4|5|6|27|7|@]|8|@]|9|$]]|$1|11|3|12|4|C|6|28|7|@]|8|@]|9|$]]|$1|13|3|-4|4|5|6|29|7|@]|8|@]|9|$]]|$1|14|3|-4|4|5|6|2A|7|@]|8|@]|9|$]]|$1|15|3|16|4|5|6|2B|7|@$H|2C|I|2D|J|K]|$H|2E|I|2F|J|K]]|8|@]|9|$]]|$1|17|3|-4|4|5|6|2G|7|@]|8|@]|9|$]]]|18|$19|$4|1A|1B|1C|9|$1D|1E]]]]

<blockquote>
 The API calls will get denied if the Cookie/token expired, but how does my FE-BE know that they are no longer valid? Do I check on every request the expiry date?
</blockquote>

To determine whether authorized access has expired, check the <code>expires_in</code> time frame that <a href="http://openid.net/specs/openid-connect-core-1_0.html#ImplicitAuthResponse" rel="nofollow noreferrer">optionally comes with an OpenID Connect implicit flow response.</a>.

<ul>
<li><code>access_token</code></li>
<li><code>token_type</code></li>
<li><code>id_token</code></li>
<li><code>state</code></li>
<li><code>expires_in</code> OPTIONAL. Expiration time of the Access Token in seconds since the response was generated. </li>
</ul>

Since an access_token is usually opaque to the client, the only other way to find out whether access has expired is to ask the issuer of the access_token.

<blockquote>
 But my question is, how do I know that he is still logged in after X minutes?
</blockquote>

To determine whether your user is still logged in, use the <code>id_token</code> not the <code>access_token</code>.

blocks|key|2269627|text|在与朋友交谈后，(在我看来)更合适的解决方案如下所示。(代码可以清理)|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2269628|++++++++//
++++//+POST:+/Account/Login
++++[HttpPost]
++++[AllowAnonymous]
++++[ValidateAntiForgeryToken]
++++public+async+Task<IActionResult>+Login(LoginViewModel+model)
++++{
++++++++if+(ModelState.IsValid)
++++++++{
++++++++++++//+Do+a+rest+call+to+the+API
++++++++++++Uri+_baseUri+=+new+Uri("http://localhost:8000/");
++++++++++++var+client+=+new+RestClient(_baseUri+%2B+"api/Account/login");
++++++++++++var+request+=+new+RestRequest(Method.POST);
++++++++++++request.AddHeader("postman-token",+"7ee2a21b-70d5-8a68-f0dd-518b8a61ddbf");
++++++++++++request.AddHeader("cache-control",+"no-cache");
++++++++++++request.AddHeader("content-type",+"application/x-www-form-urlencoded");
++++++++++++request.AddParameter("application/x-www-form-urlencoded",+"Email=blah%2540gmail.com&password=a1Aa1Aa1A!&=",+ParameterType.RequestBody);
++++++++++++IRestResponse+response+=+client.Execute(request);

++++++++++++//+Check+the+response
++++++++++++if+(response.StatusCode+==+HttpStatusCode.OK)+{
++++++++++++++++//+Grab+the+cookie+for+the+Identity
++++++++++++++++//+this+can+be+replaced+by+a+token+in+the+future
++++++++++++++++String+cookie+=+response.Cookies.Where(c+=>+c.Name+==+".AspNetCore.Identity.Application").First().Value;
++++++++++++++++//+Store+the+cookie+value+to+use+it+in+sub-sequent+requests++++++++++++++++
++++++++++++++++HttpContext.Session.SetString("IdentityCookieId",+cookie);


++++++++++++++++//+Add+claims+to+our+new+user,+an+example+Name+and+an+example+Role+
++++++++++++++++const+string+Issuer+=+"http://blah.com";
++++++++++++++++var+claims+=+new+List<Claim>();
++++++++++++++++claims.Add(new+Claim(ClaimTypes.Name,+"AnonymUser",+ClaimValueTypes.String,+Issuer));
++++++++++++++++claims.Add(new+Claim(ClaimTypes.Role,+"Administrator",+ClaimValueTypes.String,+Issuer));

++++++++++++++++var+userIdentity+=+new+ClaimsIdentity("SecuredLoggedIn");
++++++++++++++++userIdentity.AddClaims(claims);
++++++++++++++++var+userPrincipal+=+new+ClaimsPrincipal(userIdentity);

++++++++++++++++//+Sign+in+the+user+creating+a+cookie+with+X+ammount+of+Expiry
++++++++++++++++await+HttpContext.Authentication.SignInAsync("Cookie",+userPrincipal,
++++++++++++++++++++new+AuthenticationProperties
++++++++++++++++++++{
++++++++++++++++++++++++ExpiresUtc+=+DateTime.UtcNow.AddMinutes(1),
++++++++++++++++++++++++IsPersistent+=+false,
++++++++++++++++++++++++AllowRefresh+=+false
++++++++++++++++++++});

++++++++++++++++//+Move+back+to+the+ReturnUrl+or+for+me+always+to+the+dashboard
++++++++++++++++return+RedirectToLocal("/dashboard");
++++++++++++}
++++++++}

++++++++return+View(model);
++++}|code-block|syntax|javascript|2269629|当然，您必须编辑ConfigureServices下的Startup.cs文件，以便在AddMvc()之前添加services.AddAuthorization();。|offset|length|style|CODE|2269630|并在Configure下添加|2269631|++++++++app.UseCookieAuthentication(new+CookieAuthenticationOptions
++++++++{
++++++++++++AuthenticationScheme+=+"Cookie",
++++++++++++LoginPath+=+new+PathString("/account/login/"),
++++++++++++AccessDeniedPath+=+new+PathString("/Account/Forbidden/"),
++++++++++++AutomaticAuthenticate+=+true,
++++++++++++AutomaticChallenge+=+true
++++++++});|2269632|entityMap^0|0|0|8|H|R|A|17|8|1J|S|0|2|9|0|0^^$0|@$1|2|3|4|5|6|7|S|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|T|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|U|8|@$I|V|J|W|K|L]|$I|X|J|Y|K|L]|$I|Z|J|10|K|L]|$I|11|J|12|K|L]]|9|@]|A|$]]|$1|M|3|N|5|6|7|13|8|@$I|14|J|15|K|L]]|9|@]|A|$]]|$1|O|3|P|5|D|7|16|8|@]|9|@]|A|$E|F]]|$1|Q|3|-4|5|6|7|17|8|@]|9|@]|A|$]]]|R|$]]

After some talk with a friend, the solution that is more appropriate (in my opinion) is the following. (the code can be cleaned up)

<pre><code> //
 // POST: /Account/Login
 [HttpPost]
 [AllowAnonymous]
 [ValidateAntiForgeryToken]
 public async Task&lt;IActionResult&gt; Login(LoginViewModel model)
 {
 if (ModelState.IsValid)
 {
 // Do a rest call to the API
 Uri _baseUri = new Uri("http://localhost:8000/");
 var client = new RestClient(_baseUri + "api/Account/login");
 var request = new RestRequest(Method.POST);
 request.AddHeader("postman-token", "7ee2a21b-70d5-8a68-f0dd-518b8a61ddbf");
 request.AddHeader("cache-control", "no-cache");
 request.AddHeader("content-type", "application/x-www-form-urlencoded");
 request.AddParameter("application/x-www-form-urlencoded", "Email=blah%40gmail.com&amp;password=a1Aa1Aa1A!&amp;=", ParameterType.RequestBody);
 IRestResponse response = client.Execute(request);

 // Check the response
 if (response.StatusCode == HttpStatusCode.OK) {
 // Grab the cookie for the Identity
 // this can be replaced by a token in the future
 String cookie = response.Cookies.Where(c =&gt; c.Name == ".AspNetCore.Identity.Application").First().Value;
 // Store the cookie value to use it in sub-sequent requests 
 HttpContext.Session.SetString("IdentityCookieId", cookie);


 // Add claims to our new user, an example Name and an example Role 
 const string Issuer = "http://blah.com";
 var claims = new List&lt;Claim&gt;();
 claims.Add(new Claim(ClaimTypes.Name, "AnonymUser", ClaimValueTypes.String, Issuer));
 claims.Add(new Claim(ClaimTypes.Role, "Administrator", ClaimValueTypes.String, Issuer));

 var userIdentity = new ClaimsIdentity("SecuredLoggedIn");
 userIdentity.AddClaims(claims);
 var userPrincipal = new ClaimsPrincipal(userIdentity);

 // Sign in the user creating a cookie with X ammount of Expiry
 await HttpContext.Authentication.SignInAsync("Cookie", userPrincipal,
 new AuthenticationProperties
 {
 ExpiresUtc = DateTime.UtcNow.AddMinutes(1),
 IsPersistent = false,
 AllowRefresh = false
 });

 // Move back to the ReturnUrl or for me always to the dashboard
 return RedirectToLocal("/dashboard");
 }
 }

 return View(model);
 }
</code></pre>

Ofcourse you must edit the <code>Startup.cs</code> file under <code>ConfigureServices</code> to add <code>services.AddAuthorization();</code> before your <code>AddMvc()</code>.

And under <code>Configure</code> add 

<pre><code> app.UseCookieAuthentication(new CookieAuthenticationOptions
 {
 AuthenticationScheme = "Cookie",
 LoginPath = new PathString("/account/login/"),
 AccessDeniedPath = new PathString("/Account/Forbidden/"),
 AutomaticAuthenticate = true,
 AutomaticChallenge = true
 });
</code></pre>

I have the following setup. A Web API that uses Identity and Token Authorization, containing the whole User Management and ofcourse some extra API calls.

Further I am building a FE to consume the API again with .net core. I have my Login form and post to the FE which uses RestSharp to do an API request giving the credentials I got from the form. And I receive some User Data and the Identity Cookie/Token.
I set the cookie/token to the response and now my FE is able to use that to do other API calls with ajax for example.

But my question is, how do I know that he is still logged in after X minutes? The API calls will get denied if the Cookie/token expired, but how does my FE-BE know that they are no longer valid? Do I check on every request the expiry date? 
<a href="https://i.stack.imgur.com/pJyBX.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/pJyBX.png" alt="enter image description here"></a>

I am asking this mainly to challenge the way I have build my system to avoid any huge security flaws.

Authentication using API .net core

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我有以下设置。使用身份和令牌授权的Web API，包含整个用户管理，当然还有一些额外的API调用。此外，我正在构建一个FE来再次使用.net核心的应用程序接口。我有我的登录表和post到FE，它使用RestSharp来做一个应用程序接口请求，给出我从表单获得的凭据。并且我接收一些用户数据和身份Cookie/令牌。我将c...

问使用API .net核心进行身份验证
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问使用API .net核心进行身份验证EN