@
目录原理修改请求报文配置JwtBearerOptions生成Token校验Token修改认证EndPoint修改前端登录登出最终效果项目地址免登录验证是用户在首次两步验证通过后,在常用的设备(浏览器)中,在一定时间内不需要再次输入验证码直接登录。
常见的网页上提示“7天免登录验证”或“信任此设备,7天内无需两步验证”等内容。这样可以提高用户的体验。但同时也会带来一定的安全风险,因此需要用户自己决定是否开启。
【资料图】
原理常用的实现方式是在用户登录成功后,生成一个随机的字符串Token,将此Token保存在用户浏览器的 cookie 中,同时将这个字符串保存在用户的数据库中。当用户再次访问时,如果 cookie 中的字符串和数据库中的字符串相同,则免登录验证通过。流程图如下:
为了安全,Token采用对称加密传输存储,同时参与校验的还有用户Id,以进一步验证数据一致性。Token存储于数据库中并设置过期时间(ExpireDate)认证机制由JSON Web Token(JWT)实现,通过自定义Payload声明中添加Token和用户Id字段,实现校验。
下面来看代码实现:
修改请求报文项目添加对Microsoft.AspNetCore.Authentication.JwtBearer
包的引用
在Authenticate方法参数AuthenticateModel中添加RememberClient和RememberClientToken属性,
当首次登录时,若用户选择免登录,RememberClient为true,非首次登录时,系统校验RememberClientToken合法性,是否允许跳过两步验证。
public class AuthenticateModel{ .. public bool RememberClient { get; set; } public string RememberClientToken { get; set; }}
同时返回值中添加RememberClientToken,用于首次登录生成的Token
public class AuthenticateResultModel{ ... public string RememberClientToken { get; set; }}
配置JwtBearerOptions在TokenAuthController的Authenticate方法中,添加validation参数:
var validationParameters = new TokenValidationParameters{ ValidAudience = _configuration.Audience, ValidIssuer = _configuration.Issuer, IssuerSigningKey = _configuration.SecurityKey};
在默认的AbpBoilerplate模板项目中已经为我们生成了默认配置
"Authentication": { "JwtBearer": { "IsEnabled": "true", "SecurityKey": "MatoAppSample_C421AAEE0D114E9C", "Issuer": "MatoAppSample", "Audience": "MatoAppSample" } },
生成Token在TokenAuthController类中
添加自定义Payload声明类型
public const string USER_IDENTIFIER_CLAIM = "USER_IDENTIFIER_CLAIM";public const string REMEMBER_CLIENT_TOKEN = "REMEMBER_CLIENT_TOKEN";
添加生成Token的方法CreateAccessToken,它将根据自定义Payload声明,validationParameters生成经过SHA256加密的Token,过期时间即有效期为7天:
private string CreateAccessToken(IEnumerable claims, TokenValidationParameters validationParameters){ var now = DateTime.UtcNow; var expiration = TimeSpan.FromDays(7); var signingCredentials = new SigningCredentials(validationParameters.IssuerSigningKey, SecurityAlgorithms.HmacSha256); var jwtSecurityToken = new JwtSecurityToken( issuer: validationParameters.ValidIssuer, audience: validationParameters.ValidAudience, claims: claims, notBefore: now, expires: now.Add(expiration), signingCredentials: signingCredentials ); return new JwtSecurityTokenHandler().WriteToken(jwtSecurityToken);}
更改方法TwoFactorAuthenticateAsync
的签名,添加rememberClient和validationParameters形参
在该方法中添加生成Token的代码
if (rememberClient){ if (await settingManager.GetSettingValueAsync(AbpZeroSettingNames.UserManagement.TwoFactorLogin.IsRememberBrowserEnabled)) { var expiration = TimeSpan.FromDays(7); var tokenValidityKey = Guid.NewGuid().ToString("N"); var accessToken = CreateAccessToken(new[] { new Claim(USER_IDENTIFIER_CLAIM, user.ToUserIdentifier().ToString()), new Claim(REMEMBER_CLIENT_TOKEN, tokenValidityKey) }, validationParameters ); await _userManager.AddTokenValidityKeyAsync(user, tokenValidityKey, DateTime.Now.Add(expiration)); return accessToken; }}
校验Token添加校验方法TwoFactorClientRememberedAsync,它表示校验结果是否允许跳过两步验证
public async Task TwoFactorClientRememberedAsync(UserIdentifier userIdentifier, string TwoFactorRememberClientToken, TokenValidationParameters validationParameters){ if (!await settingManager.GetSettingValueAsync(AbpZeroSettingNames.UserManagement.TwoFactorLogin.IsRememberBrowserEnabled)) { return false; } if (string.IsNullOrWhiteSpace(TwoFactorRememberClientToken)) { return false; } try { var tokenHandler = new JwtSecurityTokenHandler(); if (tokenHandler.CanReadToken(TwoFactorRememberClientToken)) { try { SecurityToken validatedToken; var principal = tokenHandler.ValidateToken(TwoFactorRememberClientToken, validationParameters, out validatedToken); var userIdentifierString = principal.Claims.First(c => c.Type == TwoFactorAuthorizationManager.USER_IDENTIFIER_CLAIM); if (userIdentifierString == null) { throw new SecurityTokenException(TwoFactorAuthorizationManager.USER_IDENTIFIER_CLAIM + " invalid"); } var tokenValidityKeyInClaims = principal.Claims.First(c => c.Type == TwoFactorAuthorizationManager.REMEMBER_CLIENT_TOKEN); var currentUserIdentifier = UserIdentifier.Parse(userIdentifierString.Value); var user = _userManager.GetUserById(currentUserIdentifier.UserId); var isValidityKetValid = AsyncHelper.RunSync(() => _userManager.IsTokenValidityKeyValidAsync(user, tokenValidityKeyInClaims.Value)); if (!isValidityKetValid) { throw new SecurityTokenException(REMEMBER_CLIENT_TOKEN + " invalid"); } return userIdentifierString.Value == userIdentifier.ToString(); } catch (Exception ex) { LogHelper.LogException(ex); } } } catch (Exception ex) { LogHelper.LogException(ex); } return false;}
更改方法IsTwoFactorAuthRequiredAsync
添加twoFactorRememberClientToken和validationParameters形参
添加对TwoFactorClientRememberedAsync的调用
public async Task IsTwoFactorAuthRequiredAsync(AbpLoginResult loginResult, string TwoFactorRememberClientToken, TokenValidationParameters validationParameters){ if (!await settingManager.GetSettingValueAsync(AbpZeroSettingNames.UserManagement.TwoFactorLogin.IsEnabled)) { return false; } if (!loginResult.User.IsTwoFactorEnabled) { return false; } if ((await _userManager.GetValidTwoFactorProvidersAsync(loginResult.User)).Count <= 0) { return false; } if (await TwoFactorClientRememberedAsync(loginResult.User.ToUserIdentifier(), TwoFactorRememberClientToken, validationParameters)) { return false; } return true;}
修改认证EndPoint在TokenAuthController的Authenticate方法中,找到校验代码片段,对以上两个方法的调用传入实参
...await userManager.InitializeOptionsAsync(loginResult.Tenant?.Id);string twoFactorRememberClientToken = null;if (await twoFactorAuthorizationManager.IsTwoFactorAuthRequiredAsync(loginResult, model.RememberClientToken, validationParameters)){ if (string.IsNullOrEmpty(model.TwoFactorAuthenticationToken)) { return new AuthenticateResultModel { RequiresTwoFactorAuthenticate = true, UserId = loginResult.User.Id, TwoFactorAuthenticationProviders = await userManager.GetValidTwoFactorProvidersAsync(loginResult.User), }; } else { twoFactorRememberClientToken = await twoFactorAuthorizationManager.TwoFactorAuthenticateAsync(loginResult.User, model.TwoFactorAuthenticationToken, model.TwoFactorAuthenticationProvider, model.RememberClient, validationParameters); }}
完整的TwoFactorAuthorizationManager代码如下:
public class TwoFactorAuthorizationManager : ITransientDependency{ public const string USER_IDENTIFIER_CLAIM = "USER_IDENTIFIER_CLAIM"; public const string REMEMBER_CLIENT_TOKEN = "REMEMBER_CLIENT_TOKEN"; private readonly UserManager _userManager; private readonly ISettingManager settingManager; private readonly SmsCaptchaManager smsCaptchaManager; private readonly EmailCaptchaManager emailCaptchaManager; public TwoFactorAuthorizationManager( UserManager userManager, ISettingManager settingManager, SmsCaptchaManager smsCaptchaManager, EmailCaptchaManager emailCaptchaManager) { this._userManager = userManager; this.settingManager = settingManager; this.smsCaptchaManager = smsCaptchaManager; this.emailCaptchaManager = emailCaptchaManager; } public async Task IsTwoFactorAuthRequiredAsync(AbpLoginResult loginResult, string TwoFactorRememberClientToken, TokenValidationParameters validationParameters) { if (!await settingManager.GetSettingValueAsync(AbpZeroSettingNames.UserManagement.TwoFactorLogin.IsEnabled)) { return false; } if (!loginResult.User.IsTwoFactorEnabled) { return false; } if ((await _userManager.GetValidTwoFactorProvidersAsync(loginResult.User)).Count <= 0) { return false; } if (await TwoFactorClientRememberedAsync(loginResult.User.ToUserIdentifier(), TwoFactorRememberClientToken, validationParameters)) { return false; } return true; } public async Task TwoFactorClientRememberedAsync(UserIdentifier userIdentifier, string TwoFactorRememberClientToken, TokenValidationParameters validationParameters) { if (!await settingManager.GetSettingValueAsync(AbpZeroSettingNames.UserManagement.TwoFactorLogin.IsRememberBrowserEnabled)) { return false; } if (string.IsNullOrWhiteSpace(TwoFactorRememberClientToken)) { return false; } try { var tokenHandler = new JwtSecurityTokenHandler(); if (tokenHandler.CanReadToken(TwoFactorRememberClientToken)) { try { SecurityToken validatedToken; var principal = tokenHandler.ValidateToken(TwoFactorRememberClientToken, validationParameters, out validatedToken); var userIdentifierString = principal.Claims.First(c => c.Type == TwoFactorAuthorizationManager.USER_IDENTIFIER_CLAIM); if (userIdentifierString == null) { throw new SecurityTokenException(TwoFactorAuthorizationManager.USER_IDENTIFIER_CLAIM + " invalid"); } var tokenValidityKeyInClaims = principal.Claims.First(c => c.Type == TwoFactorAuthorizationManager.REMEMBER_CLIENT_TOKEN); var currentUserIdentifier = UserIdentifier.Parse(userIdentifierString.Value); var user = _userManager.GetUserById(currentUserIdentifier.UserId); var isValidityKetValid = AsyncHelper.RunSync(() => _userManager.IsTokenValidityKeyValidAsync(user, tokenValidityKeyInClaims.Value)); if (!isValidityKetValid) { throw new SecurityTokenException(REMEMBER_CLIENT_TOKEN + " invalid"); } return userIdentifierString.Value == userIdentifier.ToString(); } catch (Exception ex) { LogHelper.LogException(ex); } } } catch (Exception ex) { LogHelper.LogException(ex); } return false; } public async Task TwoFactorAuthenticateAsync(User user, string token, string provider, bool rememberClient, TokenValidationParameters validationParameters) { if (provider == "Email") { var isValidate = await emailCaptchaManager.VerifyCaptchaAsync(token, CaptchaPurpose.TWO_FACTOR_AUTHORIZATION); if (!isValidate) { throw new UserFriendlyException("验证码错误"); } } else if (provider == "Phone") { var isValidate = await smsCaptchaManager.VerifyCaptchaAsync(token, CaptchaPurpose.TWO_FACTOR_AUTHORIZATION); if (!isValidate) { throw new UserFriendlyException("验证码错误"); } } else { throw new UserFriendlyException("验证码提供者错误"); } if (rememberClient) { if (await settingManager.GetSettingValueAsync(AbpZeroSettingNames.UserManagement.TwoFactorLogin.IsRememberBrowserEnabled)) { var expiration = TimeSpan.FromDays(7); var tokenValidityKey = Guid.NewGuid().ToString("N"); var accessToken = CreateAccessToken(new[] { new Claim(USER_IDENTIFIER_CLAIM, user.ToUserIdentifier().ToString()), new Claim(REMEMBER_CLIENT_TOKEN, tokenValidityKey) }, validationParameters ); await _userManager.AddTokenValidityKeyAsync(user, tokenValidityKey, DateTime.Now.Add(expiration)); return accessToken; } } return null; } private string CreateAccessToken(IEnumerable claims, TokenValidationParameters validationParameters) { var now = DateTime.UtcNow; var expiration = TimeSpan.FromDays(7); var signingCredentials = new SigningCredentials(validationParameters.IssuerSigningKey, SecurityAlgorithms.HmacSha256); var jwtSecurityToken = new JwtSecurityToken( issuer: validationParameters.ValidIssuer, audience: validationParameters.ValidAudience, claims: claims, notBefore: now, expires: now.Add(expiration), signingCredentials: signingCredentials ); return new JwtSecurityTokenHandler().WriteToken(jwtSecurityToken); } public async Task SendCaptchaAsync(long userId, string provider) { var user = await _userManager.FindByIdAsync(userId.ToString()); if (user == null) { throw new UserFriendlyException("找不到用户"); } if (provider == "Email") { if (!user.IsEmailConfirmed) { throw new UserFriendlyException("未绑定邮箱"); } await emailCaptchaManager.SendCaptchaAsync(user.Id, user.EmailAddress, CaptchaPurpose.TWO_FACTOR_AUTHORIZATION); } else if (provider == "Phone") { if (!user.IsPhoneNumberConfirmed) { throw new UserFriendlyException("未绑定手机号"); } await smsCaptchaManager.SendCaptchaAsync(user.Id, user.PhoneNumber, CaptchaPurpose.TWO_FACTOR_AUTHORIZATION); } else { throw new UserFriendlyException("验证码提供者错误"); } }}
至此我们就完成了后端部分的开发
修改前端登录在两步验证的页面中添加一个checkbox,用于选择是否记住客户端
7天内不再要求两步验证
JavaScript部分添加对rememberClientToken的处理,存储于cookie中,即便在网页刷新后也能保持免两步验证的状态
const rememberClientTokenKey = "main_rememberClientToken";const setRememberClientToken = (rememberClientToken: string) => Cookies.set(rememberClientTokenKey, rememberClientToken);const cleanRememberClientToken = () => Cookies.remove(rememberClientTokenKey);const getRememberClientToken = () => Cookies.get(rememberClientTokenKey);
在请求body中添加rememberClientToken, rememberClient的值
var rememberClientToken = getRememberClientToken();var rememberClient=this.loginForm.rememberClient;userNameOrEmailAddress = userNameOrEmailAddress.trim();await request(`${this.host}api/TokenAuth/Authenticate`, "post", { userNameOrEmailAddress, password, twoFactorAuthenticationToken, twoFactorAuthenticationProvider, rememberClientToken, rememberClient})
请求成功后,返回报文中包含rememberClientToken,将其存储于cookie中
setRememberClientToken(data.rememberClientToken);
登出登出的逻辑不用做其他的修改,只需要将页面的两步验证的token清空即可,
this.loginForm.twoFactorAuthenticationToken = "";this.loginForm.password = "";
rememberClientToken是存储于cookie中的,当用户登出时不需要清空cookie中的rememberClientToken,以便下次登录跳过两步验证
除非在浏览器设置中清空cookie,下次登录时,rememberClientToken就会失效。
最终效果项目地址Github:matoapp-samples
@免登录验证是用户在首次两步验证通过后,在常用的设备(浏览器)中,在一定时间内不需要再次输入验证码直接登录。常见的网页上提示“7天免登
调整几日后,算力基础设施细分赛道12日重现大涨,其中CPO概念的通信设备以及服务器相关股票都有出色表现。截至12日收盘,CPO概念锐捷网络(301
什么是美好?是干净整洁的家园环境?是回家路上一盏盏亮起的路灯?亦是未雨绸缪解决房屋漏雨的后顾之忧?是提出问题后得到的回应是我们的心事
弟弟打工供2个姐姐4年大学生活费,二姐回应:他每月赚7000,给我和大姐每人1500,小时候误会了爸妈偏心,学费,白鹿,父母,老幺,上大学,大学生活费
潮新闻记者沈听雨实习生单予晴4月11日,卢拉(左)启程对中国进行国事访问,巴西副总统阿尔克明为他送行。刚刚送走法
学校统一买的100元保险住院能报销,其实就是学平险,有意外身故伤残,住院医疗和重疾保障,其中住院医疗扣除100免赔,有医保可以报85%。
1、3是啥东西这个3不用设密码吧!3是啥东西呀。2、下面不会是密码吧可以设置复杂一点设置呗。3、123456789三密码
过去一年,尽管在国内外多重挑战下,全球经济和社会都受到了不同程度的影响。但生命健康行业仍维持着创新活跃,多个细分领域呈现出由点突破到
1、孕早期是胎儿发育的重要阶段,营养很重要。2、孕妇要保证营养全面,满足胎儿生长发育的需要。3、很多孕妇都会有早孕反应,
由于销售抗肿瘤药物氟尿嘧啶注射液时“达成并实施固定或者变更商品价格协议的行为”、“达成并实施分割销售市场协议的行为”,违反了《反垄断