C#：JWT 不记名令牌身份验证失败：未经授权

Question

我在客户端使用证书加密 JWT，并尝试在服务器端验证该 JWT，但它总是失败。有人可以帮忙吗？

发件人

 var handler = new JwtSecurityTokenHandler();
 var tokenDescriptor = new SecurityTokenDescriptor {
       Audience = "https://you.com",
       Issuer = "https://me.com",
       Subject = new ClaimsIdentity(new List < Claim > { new Claim("sub", "MyName")),
       IssuedAt = DateTime.UtcNow,
       Expires = DateTime.UtcNow.AddMinutes(50),
       EncryptingCredentials = new X509EncryptingCredentials(new X509Certificate2("certificate.crt", "XYZ"))
       };

var JWT = handler.CreateEncodedJwt(tokenDescriptor);

测试上述 JWT 令牌以检查 cert 和 pfx 文件是否正确。

var handler = new JwtSecurityTokenHandler();
var claimsPrincipal = handler.ValidateToken(
    token,
    new TokenValidationParameters
    {
       ValidAudience = "https://you.com",
       ValidIssuer = "https://me.com",
       RequireSignedTokens = false,
       TokenDecryptionKey = new X509SecurityKey(new X509Certificate2("certificate.pfx", "XYZ"))
    },
    out SecurityToken securityToken);

securityToken 包含 JWT 令牌中传递的所有信息。所以我知道证书或 pfx 文件没有问题

在我的其余调用中将 JWT 令牌（“Bearer {token}”）作为标题

Receiver

[HttpPut("Authenticate"), Authorize(AuthenticationSchemes = JwtBearerDefaults.AuthenticationScheme)]
public async Task<IActionResult> Auth([FromBody] User user)
{
    // stuff
}

public void ConfigureServices(IServiceCollection services) {
  //...
  X509Certificate2 cert = new X509Certificate2("certificate.pfx", "XYZ");
  SecurityKey key = new X509SecurityKey(cert);
  services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options => {
      options.Authority = "https://me.com";
      options.Audience = "https://you.com";
      options.SaveToken = true;
      options.RequireHttpsMetadata = false;
      options.TokenValidationParameters = new TokenValidationParameters {
        ValidateIssuer = true,
          ValidateAudience = true,
          ValidateLifetime = true,
          ValidateIssuerSigningKey = true,
          ValidIssuer = "https://me.com",
          ValidAudience = "https://you.com",
          IssuerSigningKey = key
      };
    });
}

在其余调用中 传递，我总是收到 401：未经授权的错误。 cert 和 pfx 文件看起来不错。我是否在客户端做错了什么，或者我需要在客户端做其他事情来授权 JWT 吗？