服务器重新启动后的 IdentityServer4 访问 token

Question

我已经实现了一个 Web API，将 IdentityServer4 身份验证合并为 Web 服务的一部分。

如果我重新启动，则重新启动之前颁发的服务器访问 token 将不再有效。我使用 AddConfigurationStore 和 AddOperationalStore 保存 IdentityServer 数据。

我认为应该保留访问 token 是错误的吗？

Answer 1

IdentityServer4 使用非对称 key 对来签名和验证 JWT。除了 AddOperationalStore 调用之外，您还应该保留该对。如 documentation 中所述:

AddSigningCredential

Adds a signing key service that provides the specified key material to the various token creation/validation services. You can pass in either an X509Certificate2, a SigningCredential or a reference to a certificate from the certificate store.

AddDeveloperSigningCredential

Same purpose as the temporary signing credential. But this version persists the key to the file system so it stays stable between server restarts. This addresses issues when the client/api metadata caches get out of sync during development.

更多信息:Cryptography, Keys and HTTPS .

AddSigningCredential 示例:GitHub .

附注我猜 AddOperationalStore 仅存储刷新 token ，这是设计使然。