C＃OWIN安全 - 设置过期令牌 - 始终具有默认值

Question

大家好，我目前有一个项目，我使用owin安全

当我尝试向/令牌发出请求时，我得到了这个

指定到期令牌是7199秒（2小时）

我正在寻找这个端点（路线），但我没有喜欢/标记它或找到他们将这个值设置为2小时的地方（在整个解决方案中查看）

我发现的唯一一件事是这个类对应于刷新令牌（但没有到期令牌），但是这个令牌设置为14400但是当我再次发出请求时，令牌始终保持在该值

namespace Conarch.Providers
{
    public class SimpleRefreshTokenProvider : IAuthenticationTokenProvider
    {

        public async Task CreateAsync(AuthenticationTokenCreateContext context)
        {
            var clientid = context.Ticket.Properties.Dictionary["as:client_id"];

            context.Ticket.Properties.ExpiresUtc = DateTime.UtcNow.AddMinutes(Convert.ToDouble(12000));

            if (string.IsNullOrEmpty(clientid))
            {
                return;
            }

            var refreshTokenId = Guid.NewGuid().ToString("n");

            using (AuthRepository _repo = new AuthRepository())
            {
                var refreshTokenLifeTime = context.OwinContext.Get<string>("as:clientRefreshTokenLifeTime"); 

                var token = new RefreshToken() 
                { 
                    Id = Helper.GetHash(refreshTokenId),
                    ClientId = clientid, 
                    Subject = context.Ticket.Identity.Name,
                    IssuedUtc = DateTime.UtcNow,
                    ExpiresUtc = DateTime.UtcNow.AddMinutes(Convert.ToDouble(refreshTokenLifeTime)) 
                };

                context.Ticket.Properties.IssuedUtc = token.IssuedUtc;
                context.Ticket.Properties.ExpiresUtc = token.ExpiresUtc;

                token.ProtectedTicket = context.SerializeTicket();

                var result = await _repo.AddRefreshToken(token);

                if (result)
                {
                    context.SetToken(refreshTokenId);
                }

            }
        }

        public async Task ReceiveAsync(AuthenticationTokenReceiveContext context)
        {

            var allowedOrigin = context.OwinContext.Get<string>("as:clientAllowedOrigin");
            context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin", new[] { allowedOrigin });

            string hashedTokenId = Helper.GetHash(context.Token);

            using (AuthRepository _repo = new AuthRepository())
            {
                var refreshToken = await _repo.FindRefreshToken(hashedTokenId);

                if (refreshToken != null )
                {
                    //Get protectedTicket from refreshToken class
                    context.DeserializeTicket(refreshToken.ProtectedTicket);
                    var result = await _repo.RemoveRefreshToken(hashedTokenId);
                }
            }
        }

        public void Create(AuthenticationTokenCreateContext context)
        {
            throw new NotImplementedException();
        }

        public void Receive(AuthenticationTokenReceiveContext context)
        {
            throw new NotImplementedException();
        }

我的问题是：你在什么地方设定了这个值，时间又增加了多少？

非常感谢你

Answer 1

您必须在Web应用程序配置期间设置到期时间使用此：

OAuthAuthorizationServerOptions OAuthServerOptions = new OAuthAuthorizationServerOptions()  
{  

    AllowInsecureHttp = true,  
    TokenEndpointPath = new PathString("/token"),  
    AccessTokenExpireTimeSpan = TimeSpan.FromMinutes(30),  
    Provider = new AuthorizationServerProvider(),  
    RefreshTokenProvider = new RefreshTokenProvider()  
};

你可以找到完整的文章here