我使用以下代码来发行我的 JWE:
var signCreds = new SigningCredentials(new SymmetricSecurityKey(Encoding.ASCII.GetBytes(Configuration["Jwt:SigningKey"])), SecurityAlgorithms.HmacSha256);
var encryptionCreds = new EncryptingCredentials(new SymmetricSecurityKey(Encoding.ASCII.GetBytes(Configuration["Jwt:Encryptionkey"])), SecurityAlgorithms.Aes128KW, SecurityAlgorithms.Aes128CbcHmacSha256);
var handler = new JwtSecurityTokenHandler();
var jwtSecurityToken = handler.CreateJwtSecurityToken(
Configuration["Jwt:Issuer"],
Configuration["Jwt:Audience"],
new ClaimsIdentity(claims),
DateTime.UtcNow,
expiresIn,
DateTime.UtcNow,
signCreds,
encryptionCreds);
但它没有指定 token 的“cty” header - 仅指定 alg、enc 和typ。如果我理解正确,则必须为加密的 JWT 设置 header ,因此由于 header 缺失,我在解析 golang 中的 token 时遇到问题。
我还尝试了以下方式来发行JWE:
var signCreds = new SigningCredentials(new SymmetricSecurityKey(Encoding.ASCII.GetBytes(Configuration["Jwt:SigningKey"])), SecurityAlgorithms.HmacSha256);
var encryptionCreds = new EncryptingCredentials(new SymmetricSecurityKey(Encoding.ASCII.GetBytes(Configuration["Jwt:Encryptionkey"])), SecurityAlgorithms.Aes128KW, SecurityAlgorithms.Aes128CbcHmacSha256);
var handler = new JwtSecurityTokenHandler();
var tokenDescriptor1 = new SecurityTokenDescriptor
{
Audience = "you",
Issuer = "me",
Subject = new ClaimsIdentity(claims),
EncryptingCredentials = encryptionCreds
};
var tokenDescriptor2 = new SecurityTokenDescriptor
{
Audience = "you",
Issuer = "me",
Subject = new ClaimsIdentity(claims),
EncryptingCredentials = encryptionCreds,
SigningCredentials = signCreds
};
var tokenDescriptor3 = new SecurityTokenDescriptor
{
Audience = "you",
Issuer = "me",
Subject = new ClaimsIdentity(claims),
EncryptingCredentials = encryptionCreds,
SigningCredentials = signCreds,
AdditionalHeaderClaims = new Dictionary<string, object> { { "cty", "JWT" } }
};
var enc = handler.CreateEncodedJwt(tokenDescriptor1);
var encSigned = handler.CreateEncodedJwt(tokenDescriptor2);
var encSignedWithCty = handler.CreateEncodedJwt(tokenDescriptor3);
我扫描了library但还没有找到为token设置Cty header的代码。
也许有人知道我错过了什么或者问题是什么?
谢谢!
最佳答案
这似乎是一个图书馆issue
关于c# - .NET核心JWE : no "cty" header,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/58890118/