Browse Source

Update OpenIddict.md

pull/12794/head
maliming 4 years ago
parent
commit
f1e6c54257
No known key found for this signature in database GPG Key ID: 96224957E51C89E
  1. 36
      docs/en/Modules/OpenIddict.md

36
docs/en/Modules/OpenIddict.md

@ -150,42 +150,22 @@ https://documentation.openiddict.com
https://github.com/openiddict/openiddict-core#resources
### Token encryption
### Disable AccessToken Encryption
https://documentation.openiddict.com/configuration/encryption-and-signing-credentials.html
> By default, OpenIddict enforces encryption for all the token types it supports. While this enforcement cannot be disabled for authorization codes, refresh tokens and device codes for security reasons, it can be relaxed for access tokens when integration with third-party APIs/resource servers is desired. Access token encryption can also be disabled if the resource servers receiving the access tokens don't fully support JSON Web Encryption.
ABP disables the `access token encryption` by default for compatibility, you can manually enable it if needed.
```cs
PreConfigure<OpenIddictServerBuilder>(builder =>
public override void PreConfigureServices(ServiceConfigurationContext context)
{
builder.DisableAccessTokenEncryption();
});
```
An example of using `SecurityKey`
> In production, it is recommended to use two RSA certificates, distinct from the certificate(s) used for HTTPS: one for encryption, one for signing.
```cs
// In OpenIddict Server
PreConfigure<OpenIddictServerBuilder>(builder =>
{
builder.AddSigningKey(new SymmetricSecurityKey(Encoding.UTF8.GetBytes("Abp_OpenIddict_Demo_C40DBB176E78")));
builder.AddEncryptionKey(new SymmetricSecurityKey(Encoding.UTF8.GetBytes("Abp_OpenIddict_Demo_87E33FC57D80")));
});
//In Client AddJwtBearer
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
.AddJwtBearer(options =>
PreConfigure<OpenIddictServerBuilder>(builder =>
{
//Other configuration
options.TokenValidationParameters.IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("Abp_OpenIddict_Demo_C40DBB176E78"));
options.TokenValidationParameters.TokenDecryptionKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("Abp_OpenIddict_Demo_87E33FC57D80"));
builder.Configure(options => options.DisableAccessTokenEncryption = false);
});
}
```
https://documentation.openiddict.com/configuration/token-formats.html#disabling-jwt-access-token-encryption
### PKCE

Loading…
Cancel
Save