Asp.net core 未正确验证JWT令牌

我有一个ASP.NET核心MVC应用程序，它使用JWT进行验证

我在startup类中添加了身份验证，使用appsettings文件中的令牌机密来验证令牌

services.Configure<ApplicationSettings>(Configuration.GetSection("AppSettings"));

var key = System.Text.Encoding.UTF8
            .GetBytes(Configuration.GetSection("AppSettings:Token").Value);

services.AddAuthentication(x => {
    x.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    x.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
    x.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
}).AddJwtBearer(x => {
    x.RequireHttpsMetadata = false;
    x.SaveToken = false;
    x.TokenValidationParameters = new TokenValidationParameters
    {
        ValidateIssuerSigningKey = true,
        IssuerSigningKey = new SymmetricSecurityKey(key),
        ValidateIssuer = false,
        ValidateAudience = false,
        ClockSkew =  TimeSpan.Zero
    };
});

    [HttpPost("login")]
    public async Task<IActionResult> Login([FromBody] UserForLoginDto userForLoginDto)
    {
        var user = await _userManager.FindByNameAsync(userForLoginDto.Username);

        var result = await _signInManager
            .CheckPasswordSignInAsync(user, userForLoginDto.Password, false);



        if (result.Succeeded)
        {
            var tokenDescriptor = new SecurityTokenDescriptor
            {
                Subject = new ClaimsIdentity(new Claim[]
                {
                    new Claim("UserID",user.Id.ToString())
                }),
                Expires = DateTime.UtcNow.AddDays(1),
                SigningCredentials = new Microsoft.IdentityModel.Tokens.SigningCredentials(new SymmetricSecurityKey(Encoding.UTF8
                    .GetBytes(appSettings.Token)), SecurityAlgorithms.HmacSha256Signature)
            };

            var tokenHandler = new JwtSecurityTokenHandler();
            var securityToken = tokenHandler.CreateToken(tokenDescriptor);
            var token = tokenHandler.WriteToken(securityToken);

            return Ok(new { token });
        }

        return Unauthorized();
    }

现在，当用户尝试登录时，将运行以下控制器方法，使用相同的令牌密钥生成令牌

services.Configure<ApplicationSettings>(Configuration.GetSection("AppSettings"));

var key = System.Text.Encoding.UTF8
            .GetBytes(Configuration.GetSection("AppSettings:Token").Value);

services.AddAuthentication(x => {
    x.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    x.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
    x.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
}).AddJwtBearer(x => {
    x.RequireHttpsMetadata = false;
    x.SaveToken = false;
    x.TokenValidationParameters = new TokenValidationParameters
    {
        ValidateIssuerSigningKey = true,
        IssuerSigningKey = new SymmetricSecurityKey(key),
        ValidateIssuer = false,
        ValidateAudience = false,
        ClockSkew =  TimeSpan.Zero
    };
});

    [HttpPost("login")]
    public async Task<IActionResult> Login([FromBody] UserForLoginDto userForLoginDto)
    {
        var user = await _userManager.FindByNameAsync(userForLoginDto.Username);

        var result = await _signInManager
            .CheckPasswordSignInAsync(user, userForLoginDto.Password, false);



        if (result.Succeeded)
        {
            var tokenDescriptor = new SecurityTokenDescriptor
            {
                Subject = new ClaimsIdentity(new Claim[]
                {
                    new Claim("UserID",user.Id.ToString())
                }),
                Expires = DateTime.UtcNow.AddDays(1),
                SigningCredentials = new Microsoft.IdentityModel.Tokens.SigningCredentials(new SymmetricSecurityKey(Encoding.UTF8
                    .GetBytes(appSettings.Token)), SecurityAlgorithms.HmacSha256Signature)
            };

            var tokenHandler = new JwtSecurityTokenHandler();
            var securityToken = tokenHandler.CreateToken(tokenDescriptor);
            var token = tokenHandler.WriteToken(securityToken);

            return Ok(new { token });
        }

        return Unauthorized();
    }

并发送一个与testcontroller方法对应的请求，授权头设置为

Bearer

，但我仍然收到401个未经授权的请求

---

有人能解释为什么会发生这种情况吗？如果您需要其他信息，请告诉我。

我认为这是使用中间件的问题：

        app.UseRouting();

        app.UseAuthorization();

        app.UseAuthentication();

可以通过以下方式进行尝试：

        app.UseAuthentication();
        app.UseRouting();

        app.UseAuthorization();

---

因此，首先，我们使用身份验证用户-中间件读取令牌并将标识注入http上下文

您发送的令牌有效吗（签入）？@auburg是的，这就是问题所在。很高兴，我可以帮助：）