I am learning DDD and JWT so I thought about using both in my application. The problem starts like this. When I do a resquest with username and password, the api returns the token, but when I put it in the postman's header status 401.
I've tried to put http and https.
LoginController.cs
using System;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using Grp.Domain.Entities;
using Grp.Service.Services;
namespace Grp.Api.Controllers
{
[Route("api/[controller]")]
[ApiController]
public class LoginController : ControllerBase
{
private readonly LoginService _loginService;
private readonly RepresentanteService _representanteService;
public LoginController(LoginService loginService,
RepresentanteService representanteService)
{
_loginService = loginService;
_representanteService = representanteService;
}
// POST: api/Login
[HttpPost]
[AllowAnonymous]
public ActionResult<dynamic> Authenticate([FromBody]Representante representante)
{
try
{
representante.Senha = _representanteService.CriptografarSenha(representante.Senha);
var usuarioValido = _loginService.UsuarioValido(representante);
if (!usuarioValido)
return BadRequest(new { message = "Usuário ou senha inválidos" });
var token = TokenService.GenerateToken(representante);
representante.Senha = "";
return new
{
representante,
token
};
}
catch (Exception ex)
{
return BadRequest(ex);
}
}
}
}
ClientesController.cs
using System;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using Grp.Domain.Entities;
using Grp.Service.Services;
using Grp.Service.Validators;
namespace OpersanEM.Api.Controllers
{
[Authorize]
[Route("api/[controller]")]
[ApiController]
public class ClientesController : ControllerBase
{
private readonly BaseService<Cliente> _service;
public ClientesController(BaseService<Cliente> service)
{
_service = service;
}
// GET: api/Clientes
[HttpGet]
public IActionResult Get()
{
try
{
return new ObjectResult(_service.Get());
}
catch (Exception ex)
{
return BadRequest(ex.Message);
}
}
// GET: api/Clientes/5
[HttpGet("{id}")]
public IActionResult Get(int id)
{
try
{
return new ObjectResult(_service.Get(id));
}
catch (ArgumentException ex)
{
return NotFound(ex);
}
catch (Exception ex)
{
return BadRequest(ex.Message);
}
}
// POST: api/Clientes
[HttpPost]
public IActionResult Post([FromBody] Cliente item)
{
try
{
_service.Post<ClienteValidator>(item);
return new ObjectResult(item.Id);
}
catch (ArgumentNullException ex)
{
return NotFound(ex);
}
catch (Exception ex)
{
return BadRequest(ex.Message);
}
}
// PUT: api/Clientes/5
[HttpPut("{id}")]
public IActionResult Put([FromBody] Cliente item)
{
try
{
_service.Put<ClienteValidator>(item);
return new ObjectResult(item);
}
catch (ArgumentNullException ex)
{
return NotFound(ex);
}
catch (Exception ex)
{
return BadRequest(ex.Message);
}
}
// DELETE: api/ApiWithActions/5
[HttpDelete("{id}")]
public IActionResult Delete(int id)
{
try
{
_service.Delete(id);
return new NoContentResult();
}
catch (ArgumentException ex)
{
return NotFound(ex);
}
catch (Exception ex)
{
return BadRequest(ex.Message);
}
}
}
}
Startup.cs
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Hosting;
using Microsoft.IdentityModel.Tokens;
using Grp.Domain.Entities;
using Grp.Infra.CrossCutting;
using Grp.Infra.Data.Context;
using Grp.Infra.Data.Repository;
using Grp.Service.Services;
using System.Text;
namespace Grp.Api
{
public class Startup
{
public Startup(IConfiguration configuration)
{
Configuration = configuration;
}
public IConfiguration Configuration { get; }
// This method gets called by the runtime. Use this method to add services to the container.
public void ConfigureServices(IServiceCollection services)
{
services.AddCors();
services.AddControllers();
var key = Encoding.ASCII.GetBytes(Settings.Secret);
services.AddAuthentication(x =>
{
x.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
x.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddJwtBearer(x =>
{
x.RequireHttpsMetadata = false;
x.SaveToken = true;
x.TokenValidationParameters = new TokenValidationParameters
{
ValidateIssuerSigningKey = true,
IssuerSigningKey = new SymmetricSecurityKey(key),
ValidateIssuer = false,
ValidateAudience = false
};
});
services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_3_0);
services.AddScoped<SqlContext, SqlContext>();
services.AddScoped<BaseRepository<Cliente>>();
services.AddScoped<BaseRepository<Representante>>();
services.AddScoped<BaseService<Cliente>>();
services.AddScoped<BaseService<Representante>>();
services.AddScoped<RepresentanteService>();
services.AddScoped<LoginService>();
services.AddScoped<StringCipher>();
}
// This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
if (env.IsDevelopment())
{
app.UseDeveloperExceptionPage();
}
app.UseStaticFiles();
app.UseRouting();
app.UseCors(x => x
.AllowAnyOrigin()
.AllowAnyMethod()
.AllowAnyHeader());
app.UseAuthentication();
app.UseAuthorization();
app.UseEndpoints(endpoints =>
{
endpoints.MapControllerRoute("default", "{controller=Home}/{action=Index}");
});
}
}
}
TokenService.cs
using Microsoft.IdentityModel.Tokens;
using Grp.Domain.Entities;
using System;
using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Text;
namespace Grp.Service.Services
{
public static class TokenService
{
public static string GenerateToken(Representante representante)
{
var tokenHandler = new JwtSecurityTokenHandler();
var key = Encoding.ASCII.GetBytes(Settings.Secret);
var tokenDescriptor = new SecurityTokenDescriptor
{
Subject = new ClaimsIdentity(new Claim[]
{
new Claim(ClaimTypes.Name, representante.Nome)
}),
Expires = DateTime.UtcNow.AddDays(2),
SigningCredentials = new SigningCredentials(new SymmetricSecurityKey(key), SecurityAlgorithms.HmacSha256Signature)
};
var token = tokenHandler.CreateToken(tokenDescriptor);
return tokenHandler.WriteToken(token);
}
}
}
Validate JWT Token using Custom Middleware and Custom Authorize Attribute. Below is the custom JWT middleware that validates the token in the request "Authorization" header if it exists. On successful validation, the middleware retrieves that associated user from the database and assigns it to its context.
JSON Web Tokens (commonly known as JWT) is an open standard to pass data between client and server, and enables you to transmit data back and forth between the server and the consumers in a secure manner.
Did you find a solution? I was rolling around the same problem for a while. Finally I Solved it adding
[Authorize(AuthenticationSchemes=JwtBearerDefaults.AuthenticationScheme)]
in the decorator of my controller.
Edit: If you don't want to set the scheme in every controller then configure it in the Startup.cs ConfigureServices()
services.AddAuthorization(options =>
{
var defaultAuthorizationPolicyBuilder = new AuthorizationPolicyBuilder(
JwtBearerDefaults.AuthenticationScheme);
defaultAuthorizationPolicyBuilder =
defaultAuthorizationPolicyBuilder.RequireAuthenticatedUser();
options.DefaultPolicy = defaultAuthorizationPolicyBuilder.Build();
});
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With