如何在令牌过期（而不是无效）时让OAuthAuthorizationServerProvider返回特定的错误代码或响应？

I've got a regular OWIN OAuth setup for my MVC WebAPI project - one of the requests from the frontend developers was to be able to determine whether a token is rejected because it's expired, or when it's just an invalid token.

我为我的MVC WebAPI项目设置了常规的OWIN OAuth设置 - 来自前端开发人员的一个请求是能够确定令牌是否因为过期而被拒绝,或者它只是一个无效的令牌。

From what I can tell, by default the OAuthAuthorizationServerProvider sits in the middle and magically just intercepts requests looking at the Authorization header for the bearer token, and determines whether to authorize or send a 401 / Authorization has been denied for this request.

据我所知,默认情况下,OAuthAuthorizationServerProvider位于中间,并且神奇地只是拦截查看承载令牌的Authorization标头的请求,并确定是否对此请求授权或发送401 / Authorization。

Is it possible to customize this behaviour / is there any other way to determine the reason behind authorization being denied?

是否可以自定义此行为/是否有任何其他方法来确定授权被拒绝的原因?

I can see the following method exists:

我可以看到存在以下方法:

    public virtual Task ValidateAuthorizeRequest(OAuthValidateAuthorizeRequestContext context);

But I'm not sure what the default implementation is, what it looks like, or whether this is where I'm supposed to go to customize the provider to achieve what I'm after.

但我不确定默认的实现是什么,看起来是什么样的,或者这是否是我应该去定制提供程序以实现我所追求的目标。

My OAuthOptions in Startup.cs:

我在Startup.cs中的OAuthOptions:

    OAuthOptions = new OAuthAuthorizationServerOptions
        {
            TokenEndpointPath = new PathString("/Token"),
            Provider = new ApplicationOAuthProvider(PublicClientId, UserManagerFactory),
            AuthorizeEndpointPath = new PathString("/api/Account/ExternalLogin"),
            AccessTokenExpireTimeSpan = TimeSpan.FromMinutes(60),
            AllowInsecureHttp = true
        };

1 个解决方案

#1

Take a look at Token Based Authentication using ASP.NET Web API 2, Owin, and Identity from Taiseer Joudeh, it is in depth series of blo gposts about the OAuthAuthorizationServerProvider.

使用ASP.NET Web API 2,Owin和来自Taiseer Joudeh的Identity来查看基于令牌的身份验证,它是关于OAuthAuthorizationServerProvider的深入系列的blopos。