JWT ​

public static string CreateJwt(Dictionary<string, object> payload, string secret)
{
    var builder = new JwtBuilder()
        .WithAlgorithm(new HMACSHA256Algorithm())
        .WithSecret(secret);

    foreach (var key in payload.Keys)
        builder.AddClaim(key, payload[key]);

    return builder.Build();
}

public static bool VerifyJwt(string token, string secret, out IDictionary<string, object> payload)
{
    try
    {
        payload = new JwtBuilder()
            .WithSecret(secret)
            .MustVerifySignature()
            .Decode<IDictionary<string, object>>(token);

        return true;
    }
    catch (TokenExpiredException)
    {
        //JWT过期
        payload = null;
        return false;
    }
    catch (SignatureVerificationException)
    {
        //签名错误
        payload = null;
        return false;
    }
}

public class Startup
{
    public Startup(IConfiguration configuration) =>
        Configuration = configuration;

    public IConfiguration Configuration { get; }

    public void ConfigureServices(IServiceCollection services)
    {
        services.AddControllers();
        services.Configure<JwtOptions>(Configuration.GetSection(nameof(JwtOptions)));
        services.AddAuthentication(options =>
            {
                options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
            })
            .AddJwtBearer(options =>
            {
                var jwt = Configuration.GetSection(nameof(JwtOptions)).Get<JwtOptions>();
                options.TokenValidationParameters = new TokenValidationParameters
                {
                    ValidIssuer = jwt.ValidIssuer,
                    ValidAudience = jwt.ValidAudience,
                    IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwt.IssuerSigningKey)),
                    ValidateIssuerSigningKey = true
                };
            });
            services.AddAuthorization(options => options.AddPolicy("admin", policy =>
            {
                policy.RequireAuthenticatedUser();
                policy.RequireRole("Administrator");
            }));
        services.AddSwaggerGen(c =>
        {
            c.SwaggerDoc("v1", new OpenApiInfo {Title = "ColinChang.ApiSample", Version = "v1"});
        });
    }

    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
            app.UseSwagger();
            app.UseSwaggerUI(c => c.SwaggerEndpoint("/swagger/v1/swagger.json", "ColinChang.ApiSample v1"));
        }

        app.UseHttpsRedirection();
        app.UseRouting();
        app.UseAuthentication();
        app.UseAuthorization();
        app.UseEndpoints(endpoints => { endpoints.MapControllers(); });
    }
}

[ApiController]
[Route("[controller]")]
public class HomeController : ControllerBase
{
    [Authorize]
    [HttpGet]
    public string Get() => $"{User.Identity.Name} is authenticated";

    [Authorize("admin")]
    [HttpPost]
    public string Post() => $"{User.Identity.Name} is authorized with policy admin";

    [Authorize(Roles = "Administrator")]
    [HttpPut]
    public string Put() => $"{User.Identity.Name} is authorized with role Administrator\nroles:{string.Join(",", User.Claims.Where(c => c.Type == ClaimTypes.Role).Select(c => c.Value))}";
}

[ApiController]
[Route("[controller]")]
public class AccountController : ControllerBase
{
    private static readonly IEnumerable<User> Users = new[]
    {
        new User("Colin", "123123", new[] {new Role("Administrator")}),
        new User("Robin", "123123", new[] {new Role("User")})
    };

    [HttpPost]
    public IActionResult Post([FromServices] IOptions<JwtOptions> options, [FromBody]User user)
    {
        if (user == null)
            return BadRequest("user cannot be null");

        var usr = Users.SingleOrDefault(u =>
            string.Equals(u.Username, user.Username, StringComparison.OrdinalIgnoreCase));
        if (!string.Equals(usr?.Password, user.Password, StringComparison.OrdinalIgnoreCase))
            return BadRequest("invalid username or password");

        var claims = new List<Claim> {new Claim(ClaimTypes.Name, user.Username)};
        claims.AddRange(usr.Roles.Select(role => new Claim(ClaimTypes.Role, role.Name)));

        var jwtOptions = options.Value;
        var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwtOptions.IssuerSigningKey));
        var credentials = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
        var token = new JwtSecurityToken(jwtOptions.ValidIssuer, jwtOptions.ValidAudience, claims, DateTime.Now,
            DateTime.Now.AddMinutes(jwtOptions.Expires), credentials);
        var jwt = new JwtSecurityTokenHandler().WriteToken(token);

        return Ok(jwt);
    }
}