{"id":371,"date":"2021-07-07T14:40:04","date_gmt":"2021-07-07T14:40:04","guid":{"rendered":"https:\/\/okankaradag.com\/?p=371"},"modified":"2021-07-09T14:10:14","modified_gmt":"2021-07-09T14:10:14","slug":"json-web-token-jwt-nedir-net-core-5-0-ortaminda-nasil-kullanilir","status":"publish","type":"post","link":"https:\/\/okankaradag.com\/en\/asp-net-5\/json-web-token-jwt-nedir-net-core-5-0-ortaminda-nasil-kullanilir","title":{"rendered":"What is Json Web Token (JWT)? How to use in .Net Core (5.0)"},"content":{"rendered":"
Merhaba bu g\u00f6nderide jwt hakk\u0131nda bilgi verece\u011fim ve bununla ilgili \u00f6rnek bir proje yapaca\u011f\u0131z<\/p>\n\n\n\n
JWT Nedir?<\/h4>\n\n\n\n
Jwt, sunucu (server) ve istemci (client) aras\u0131nda g\u00fcvenlik bilgilerini payla\u015fmak i\u00e7in kullan\u0131lan a\u00e7\u0131k bir standartt\u0131r. Her jwt bir json objesi i\u00e7erir bu json objelerinde de baz\u0131 talepler (claims) vard\u0131r. Taleplerin de\u011fi\u015ftirilememesini sa\u011flamak i\u00e7in de bir kriptografik algoritma ile \u015fifrelenir.<\/p>\n\n\n\n
\u00d6rnek Senaryo<\/h4>\n\n\n\n
T\u00fcm \u00fcr\u00fcnlerinizin d\u00f6nd\u00fc\u011f\u00fc bir api oldu\u011funu varsayal\u0131m bu servisden \u00fcr\u00fcnleri \u00e7ekebilmek i\u00e7inde gerekli \u015fart, kay\u0131tl\u0131 kullan\u0131c\u0131 olmak ve rol\u00fcm\u00fcz\u00fcn de yetkili personel olmas\u0131. Her api iste\u011finde parametre olarak username ve \u015fifre mant\u0131ken g\u00f6nderilemez i\u015flemi yapmaya hak kazanmak i\u00e7in :d bir tane biletimizin (token) olmas\u0131 gerekiyor bu bilet ile api isteklerini g\u00fcvenli ve sorunsuz bir \u015fekilde yapabiliriz. Token alaca\u011f\u0131m\u0131z servise username ve \u015fifremizi g\u00fcvenli bir \u015fekilde g\u00f6ndeririz bilgilerimiz do\u011fru ise servis bize bir bilet verir bu bilet bir Json Web Token’dir. (\u0130leriki k\u0131s\u0131mlarda ayr\u0131nt\u0131lar\u0131 var) \u00dcr\u00fcnler servisinin header b\u00f6l\u00fcm\u00fcne bu bileti ekleyerek iste\u011fi g\u00f6ndeririz e\u011fer bilet ge\u00e7erli ise servis \u00fcr\u00fcnleri d\u00f6ner.<\/p>\n\n\n\n
\u00d6rnek Bir Jwt Objesi<\/h4>\n\n\n\n
jwt objesi base64 ile \u015fifrelenmi\u015f \u00fc\u00e7 b\u00f6l\u00fcmden olu\u015fur:<\/p>\n\n\n\n
Header<\/strong>
\u015eifreleme algoritmas\u0131 hakk\u0131nda bilgi verir<\/li><\/ul><\/li>
Payload<\/strong>
Id, Username, Name gibi kullan\u0131c\u0131 bilgileri d\u00f6ner<\/li><\/ul><\/li>
Verify Signature<\/strong>
Bu k\u0131s\u0131m en \u00f6nemli yer, buray\u0131 dijital imza olarak tan\u0131mlayabiliriz. serverdan belirli bir key ile hashleyerek imza olu\u015ftulur bu imza sayesinde server do\u011frulama yapar. \u00d6rne\u011fin name’i de\u011fi\u015ftirip bir encoding yaparsam tokenler de\u011fi\u015fecektir ve do\u011frulama ba\u015far\u0131s\u0131z olacakt\u0131r.<\/li><\/ul><\/li><\/ul>\n\n\n\n
<\/figure><\/li><\/ul><\/figure>\n\n\n\n
<\/figure><\/li><\/ul><\/figure>\n\n\n\n
Asp.Net 5.0 Api Projesi ile Nas\u0131l Kullan\u0131l\u0131r<\/h4>\n\n\n\n
Bundan sonraki anlat\u0131m kod \u00fczerinden devam edece\u011fim, \u015eimdi Basit bir web api projesi yaparak kod taraf\u0131nda nas\u0131l kullan\u0131ld\u0131\u011f\u0131n\u0131 inceleyelim.<\/p>\n\n\n\n
Visual studio \u00fczerinden bir Asp.net 5.0 web api projesi olu\u015fturarak ba\u015fl\u0131yoruz.<\/p>\n\n\n\n
<\/figure><\/li><\/ul><\/figure>\n\n\n\n
UserService ad\u0131nda bir s\u0131n\u0131f ekleyelim.<\/p>\n\n\n\n
public interface IUserService\n {\n User AuthenticateUser(string firstname, string password);\n }\n public class UserService : IUserService\n {\n private readonly List<User> Users = new List<User>\n {\n new User\n {\n Id=1,\n Name=\"Okan\",\n Surname=\"Karada\u011f\",\n Username = \"okank\",\n Password=\"Test\", \/\/Normal \u015fartlar alt\u0131nda db de hashli olarak tutulmal\u0131\n }\n };\n public User AuthenticateUser(string firstname, string password)\n {\n return Users.FirstOrDefault(u => u.Name == firstname && u.Password == password);\n }\n }<\/pre><\/div>\n\n\n\n
Jwt ile ilgili baz\u0131 bilgililerimizi appsettings.json dosyas\u0131nda tutaca\u011f\u0131z.<\/p>\n\n\n\n
JwtSettings objesini dotnet i\u00e7inde daha kolay eri\u015febilmek i\u00e7in bir s\u0131n\u0131f yarataca\u011f\u0131z ve daha sonra middleware’de bu s\u0131n\u0131fla ili\u015fkilendirece\u011fiz.<\/p>\n\n\n\n
public class JwtSettings\n{\n public string Issuer { get; set; }\n public string Audience { get; set; }\n public string SigningKey { get; set; }\n}<\/pre><\/div>\n\n\n\n
Jwt ile ilgili konfig\u00fcrasyonlar\u0131 yapal\u0131m. Middlewarede a\u015fa\u011f\u0131daki gibi tan\u0131mlar\u0131 ekliyoruz<\/p>\n\n\n\n
Startup.cs’deki configure i\u00e7ine app.UseAuthentication()<\/strong> ve app.UseAuthorization()<\/strong> eklemelerini yapmay\u0131 unutmay\u0131n\u0131z<\/p><\/blockquote>\n\n\n\n
ilk sat\u0131rda yukar\u0131da bahsetti\u011fim gibi appsettings.json<\/strong>‘daki JwtSettings <\/strong>s\u0131n\u0131f\u0131 tan\u0131mlad\u0131k. Token Validation Parametrelerinde yay\u0131mc\u0131, izleyici(auidence) ve yay\u0131mc\u0131ya(issuer) \u00f6zg\u00fcn imzal\u0131 keyi tan\u0131mlad\u0131k.<\/p>\n\n\n\n
JwtHelper <\/strong>ad\u0131nda bir s\u0131n\u0131f ile token <\/strong>\u00fcretimi yapaca\u011f\u0131z<\/p>\n\n\n\n
public class JwtHelper\n{\n public static string GetJwtToken(string username, JwtSettings jwtSettings, TimeSpan expiration, Claim[] additionalClaims = null)\n {\n var tokenHandler = new JwtSecurityTokenHandler();\n var claims = new[]\n {\n new Claim(JwtRegisteredClaimNames.UniqueName,username),\n new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString())\n };\n\n if (additionalClaims is object)\n {\n var claimList = new List<Claim>(claims);\n claimList.AddRange(additionalClaims);\n claims = claimList.ToArray();\n }\n\n var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwtSettings.SigningKey));\n var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);\n var token = new JwtSecurityToken(\n issuer: jwtSettings.Issuer,\n audience: jwtSettings.Audience,\n expires: DateTime.UtcNow.Add(expiration),\n claims: claims,\n signingCredentials: creds\n ); ;\n\n return tokenHandler.WriteToken(token);\n }\n}<\/pre><\/div>\n\n\n\n
Claim k\u0131sm\u0131na iki tane unique de\u011fer ekledik b\u00f6ylece tokenlerin ayn\u0131 olabilme ihtimalini s\u0131f\u0131rlad\u0131k. settings k\u0131sm\u0131nda yazd\u0131\u011f\u0131m\u0131z bilgiler ve Sha256 algoritmas\u0131n\u0131 kullanarak bir token nesnesi olu\u015fturduk fakat bu token bilgisinde nerdeyse b\u00fct\u00fcn bilgiler oldu\u011fu i\u00e7in WriteToken <\/strong>metodu ile son kullan\u0131c\u0131ya ge\u00e7ecek tokeni olu\u015fturmu\u015f olduk.<\/p>\n\n\n\n
AccountController ekleyip bir token almaya deneyelim.<\/p>\n\n\n\n
[Route(\"[controller]\")]\n[ApiController]\npublic class AccountController : ControllerBase\n{\n private IUserService UserService;\n private JwtSettings JwtSettings;\n public AccountController(IUserService userService, IOptions<JwtSettings> jwtSettings)\n {\n UserService = userService;\n JwtSettings = jwtSettings.Value;\n }\n [HttpPost(\"login\")]\n public IActionResult Login([FromBody] LoginModel loginModel)\n {\n var user = UserService.AuthenticateUser(loginModel.Username, loginModel.Password);\n if (user == null)\n {\n return BadRequest(new { message = \"Username or password is incorrect\" });\n }\n var claims = new List<Claim>();\n claims.Add(new Claim(\"username\", user.Username));\n claims.Add(new Claim(\"displayname\", user.Name));\n var token = JwtHelper.GetJwtToken(user.Username, JwtSettings, new TimeSpan(0, 15, 0), claims.ToArray());\n return Ok(token);\n }\n}<\/pre><\/div>\n\n\n\n
Claim olarak username <\/strong>ve displayname <\/strong>ekledim isterseniz roles t\u00fcr\u00fcnde rolleri de tan\u0131mlayabilrsiniz.<\/p>\n\n\n\n
Tokeni ald\u0131k \u015fimdi s\u0131ra kullanmaya geldi. Dotnetin otomatik olu\u015fturdu\u011fu WeatherForecast ad\u0131nda bir api authorize attribute koyaca\u011f\u0131z<\/p>\n\n\n\n
[ApiController]\n[Route(\"[controller]\")]\npublic class WeatherForecastController : ControllerBase\n{\n private static readonly string[] Summaries = new[]\n {\n \"Freezing\", \"Bracing\", \"Chilly\", \"Cool\", \"Mild\", \"Warm\", \"Balmy\", \"Hot\", \"Sweltering\", \"Scorching\"\n };\n\n private readonly ILogger<WeatherForecastController> _logger;\n\n public WeatherForecastController(ILogger<WeatherForecastController> logger)\n {\n _logger = logger;\n }\n [Authorize]\n [HttpGet]\n public IEnumerable<WeatherForecast> Get()\n {\n var rng = new Random();\n return Enumerable.Range(1, 5).Select(index => new WeatherForecast\n {\n Date = DateTime.Now.AddDays(index),\n TemperatureC = rng.Next(-20, 55),\n Summary = Summaries[rng.Next(Summaries.Length)]\n })\n .ToArray();\n }\n}<\/pre><\/div>\n\n\n\n
Ald\u0131\u011f\u0131m\u0131z tokeni headerse bearer token etiketine yazd\u0131k ve do\u011frulama ba\u015far\u0131l\u0131 oldu. E\u011fer ki tokende ufak bir de\u011fi\u015fiklik yaparsak 401 d\u00f6necektir. <\/p>\n\n\n\n
![\"\"](\"https:\/\/okankaradag.com\/wp-content\/uploads\/2021\/07\/Jwt-Decoded.png\")
<\/figure><\/li><\/ul><\/figure>\n\n\n\n![\"\"](\"https:\/\/okankaradag.com\/wp-content\/uploads\/2021\/07\/Jwt-Encoded-e1625660794368.png\")
<\/figure><\/li><\/ul><\/figure>\n\n\n\n![\"\"](\"https:\/\/okankaradag.com\/wp-content\/uploads\/2021\/07\/asp.net-core-5.0-new-project.png\")
<\/figure><\/li><\/ul><\/figure>\n\n\n\n![\"\"](\"https:\/\/okankaradag.com\/wp-content\/uploads\/2021\/07\/postman-token-request-1024x353.png\")
<\/figure><\/li><\/ul><\/figure>\n\n\n\n![\"\"](\"https:\/\/okankaradag.com\/wp-content\/uploads\/2021\/07\/jwt-decoded-ex.png\")
<\/figure><\/li><\/ul><\/figure>\n\n\n\n![\"\"](\"https:\/\/okankaradag.com\/wp-content\/uploads\/2021\/07\/postman-authorize-request-1024x564.png\")
<\/figure><\/li><\/ul><\/figure>\n\n\n\n