Oauth 使用ASP.net API进行承载令牌身份验证

我正在研究使用ASP.net web API来设置带有承载令牌的请求身份验证。使用OWIN服务器中间件时，加密密钥来自哪里？服务器如何撤销尚未过期的令牌

OWIN服务器中间件的默认Tiken数据保护方法是使用

为了在服务器端撤销令牌，需要实现令牌存储。您可以使用

AccessTokenProvider.Create

来创建和存储令牌

下面是此类场景的一个示例。以这段代码为例

在Startup.cs中注册

 app.UseOAuthAuthorizationServer(new OAuthAuthorizationServerOptions
        {
            AuthorizeEndpointPath = new PathString("/Authorize"),
            TokenEndpointPath = new PathString("/Token"),
            ApplicationCanDisplayErrors = true,
            Provider = new ApplicationOAuthProvider(PublicClientId, UserManagerFactory),
            AuthorizationCodeProvider = new MyAuthenticationTokenProvider(TokenType.Code),
            AccessTokenProvider = new MyAuthenticationTokenProvider(TokenType.Access),
            RefreshTokenProvider = new MyAuthenticationTokenProvider(TokenType.Refresh),
            AuthorizationCodeFormat = new MyFormatProvider("MyAudiences"),
            AccessTokenFormat = new MyFormatProvider("MyAudiences"),
            RefreshTokenFormat = new MyFormatProvider("MyAudiences"))
        });
    }

提供加密：这基于Katana项目中的JWT格式。仍然不支持JwtFormat.protect（）方法。因此，您需要创建自己的实现

---

你是在看发球还是客户？OAuthAuthorizationServerMiddleware或OAuthBeareAuthenticationMiddleware。对于客户端，您不需要撤销令牌，只需验证即可。数据保护Api用作默认加密方法。中间件选项需要提供适当的DataProtectionProvider和/或SecureDataFormat？你是说访问令牌吗？

    //You need to manage your Key in this class
    public class MyFormatProvider: ISecureDataFormat<AuthenticationTicket>
    {
        public MyFormatProvider(string allowedAudiences)
        {
        }
        public string Protect(AuthenticationTicket data)
        {
            return "encrypted";
        }
        public AuthenticationTicket Unprotect(string protectedText)
        {
            return new AuthenticationTicket(new System.Security.Claims.ClaimsIdentity(), new AuthenticationProperties());
        }
    }

    public enum TokenType { Code,Access,Refresh }
    public class MyAuthenticationTokenProvider : AuthenticationTokenProvider
    {
        TokenType tokenType = TokenType.Access;
        public MyAuthenticationTokenProvider(TokenType tokenType)
        {

        }
        public override void Create(AuthenticationTokenCreateContext context)
        {
            /*Create Token, Store Token and Tiket info*/
            context.SetToken("MyToken");/*This will call Your MyFormatProvider internally*/
            base.Create(context);
        }

        public override void Receive(AuthenticationTokenReceiveContext context)
        {
            /*retrieve Token and Tiket info to process*/
            base.Receive(context);
        }
    }