|
|
Posted on1 minute ago
|
|
|
|
Requirements: When requesting an API, the JWT token authentication information will be included. The backend needs to verify whether the token signature is valid, then verify whether it has expired, the issuance information, etc.
JSON Web Key Set URI
jwks_uri (JSON Web Key Set URI) is a standard configuration item in OAuth 2.0 and OpenID Connect (OIDC) specifications.
Simply put, it is a public URL address (or endpoint) pointing to where the authentication server publishes its "public key set." In the standard OIDC process, the authentication server provides a service discovery endpoint containing the jwks_uri address.
Its popular metaphor
If the JWT (or ID Token) issued by the authentication server is likened to a letter stamped with a physical official seal, then:
• Private key: The "physical seal" locked in the safe held by the authentication server, used for stamping (signing).
• jwks_uri: This is the "seal pattern disclosure section" posted on the official website by the authentication server.
• Third-party application (client or resource server): After receiving the email, download the seal design (public key) from this jwks_uri address and compare it with the stamp on the letter to prove that the letter was indeed issued by the official company and was not tampered with.
Here, the meaning of use in the keys collection is:
"sig": Signature, used to verify or generate signatures to ensure data integrity and tamper-proof protection.
"enc": Encryption, used to encrypt or decrypt data, as well as manage keys (Key Encryption) to ensure data confidentiality.
As shown below:
Parse JWT information
First, install the nuget package:System.IdentityModel.Tokens.Jwt, reads the Claims information from the jwt, the code is as follows:
The output is as follows:
Bearer
1059ec2e-ffa8-4ff5-bc47-f25d7e37aa5a
Verify the validity of the JWT signature
You still need to first reference the System.IdentityModel.Tokens.Jwt package. There are two ways to verify the validity of the signature.
Solution 1: X.509 Certificate Chain
Deserialization is performed according to the X.509 international standard, extracting all structured information from the certificate (such as public key, issuer, expiration date, serial number, etc.), and generating an X509Certificate2 object. Finally, the hidden RSA public key inside is obtained to verify the JWT token. The code is as follows:
As shown below:
Solution 2: JsonWebKey
Convert to Security Key: It automatically identifies the algorithm type inside. Then, verify the token's validity. The code is as follows:
(End) |
Previous:.NET/C# Obtain object properties, fields, and comments based on Roslyn
|
