c# – Web API授权access_token验证

https://localhost/Profile?access_token=...

private static TokenResponse GetToken()
    {
            var client = new OAuth2Client(new Uri("http://localhost:2727/token"),"client1","secret");
            var response = client.RequestResourceOwnerPasswordAsync("bob","bob").Result;
            return response;
    }

您无需担心服务器端的访问令牌.服务器端的访问令牌由Katana中间件解析和验证.如果您需要有关如何创建/使用访问令牌的更多详细信息,然后在 Katana sources中搜索DeserializeTicket和SerializeTicket方法,您会发现这些方法与Token一起使用来序列化/反序列化您在客户端(DummyMVC)上设置的ClaimsIdentity .

无论如何,您正在使用Embedded AuthorizationServer Thinktecture项目中的SimpleAuthorizationServerProvider,它是OAuthAuthorizationServerProvider的包装器.我对吗？我相信你想要验证凭据.在您的情况下,您可以覆盖GrantResourceOwnerCredentials.

public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
    {
        // validate user credentials (demo!)
        // user credentials should be stored securely (salted,iterated,hashed yada)
        if (context.UserName != context.Password)
        {
            context.Rejected();
            return;
        }
        context.Validated();
    }

如果你看看Thinktecture examples,那将是最好的.