ow

CloudBuilder/CloudBuilder.Security.Service/AuthService.cs

@@ -417,20 +417,28 @@ namespace CloudBuilder.Security.Service
                 ValidateLifetime = false,//不验证过期时间
             };
 
-            // 验证 Token
-            var tokenHandler = new JwtSecurityTokenHandler();
-            SecurityToken vTocken;
+            // 验证 Token。
+            // 必须用 JsonWebTokenHandler（.NET 8 的 JwtBearer 鉴权、ClaimPolicy.GetClaimValue 用的都是它）：
+            // legacy 的 JwtSecurityTokenHandler 与 Microsoft.IdentityModel.Tokens 8.x 版本混用时会错乱解析令牌
+            // （issuer 读成空 → IDX10211），于是刷新恒失败、访问令牌两小时一到期用户就被踢下线。
+            var tokenHandler = new JsonWebTokenHandler();
             string token = jwtInfo.AccessToken.Replace("Bearer ", "");
             try
             {
-                var tokenValidationResult = tokenHandler.ValidateToken(token, parameters, out vTocken);
+                var tokenValidationResult = tokenHandler.ValidateTokenAsync(token, parameters).GetAwaiter().GetResult();
 
-                if (tokenValidationResult == null || !tokenValidationResult.Identities.Any() || !tokenValidationResult.Identities.First().IsAuthenticated)
-                    throw new ServiceErrorException("无效的令牌,请重新登录.");
+                if (tokenValidationResult == null || !tokenValidationResult.IsValid
+                    || tokenValidationResult.ClaimsIdentity == null || !tokenValidationResult.ClaimsIdentity.IsAuthenticated)
+                    throw new ServiceErrorException($"无效的令牌,请重新登录.({tokenValidationResult?.Exception?.Message})");
             }
-            catch (Exception)
+            catch (ServiceErrorException)
             {
-                throw new ServiceErrorException("无效的令牌,请重新登录.");
+                throw;
+            }
+            catch (Exception ex)
+            {
+                // 带上原始异常：以前直接吞掉，出问题时只看到"无效的令牌"，无法定位
+                throw new ServiceErrorException($"无效的令牌,请重新登录.({ex.Message})");
             }
 
             string clainmName = ClaimPolicy.GetClaimValue(token, ClaimPolicy.CLAINM_NAME);