在appsettings.json文件中配置JWT节点，节点下创建SigningKey、ExpireSeconds两个配置项，分别代表JWT的密钥和过期时间（单位：秒）。

{
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },
  "AllowedHosts": "*",
  "JWT": {
    "SecKey": "sdfarwer8sdf7sd6f6^#dfsdfdsf",
    "ExpireSeconds": 3600
  }
}

再创建配置类JWTOptions，包含SigningKey、ExpireSeconds两个属性。

namespace JWTTest
{
    public class JWTOptions
    {
        public string SecKey { get; set; }
        public int ExpireSeconds { get; set; }
    }
}

Nuget：Microsoft.AspNetCore.Authentication.JwtBearer

//获取配置信息
services.Configure<JWTOptions>(builder.Configuration.GetSection("JWT"));
//Jwt校验配置
services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
.AddJwtBearer(x =>
{
       var jwtOpt = builder.Configuration.GetSection("JWT").Get<JWTOptions>();
       byte[] keyBytes = Encoding.UTF8.GetBytes(jwtOpt.SigningKey);
       var secKey = new SymmetricSecurityKey(keyBytes);
       x.TokenValidationParameters = new()
       {
             ValidateIssuer=false, ValidateAudience=false, ValidateLifetime=true,
              ValidateIssuerSigningKey=true, IssuerSigningKey=secKey
      };
 });

在Program.cs文件的app.UseAuthorization()这行代码之前添加app.UseAuthentication()

namespace JWTTest.Controllers
{
    [Route("api/[controller]/[action]")]
    [ApiController]
    public class LoginController : ControllerBase
    {
        //获取配置文件
        private readonly IOptionsSnapshot<JWTOptions> jWTOptions;
        public LoginController(IOptionsSnapshot<JWTOptions> jWTOptions)
        {
            this.jWTOptions = jWTOptions;
        }
        /// <summary>
        /// 登录并返回Jwt代码
        /// </summary>
        /// <param name="userName"></param>
        /// <param name="password"></param>
        /// <returns></returns>
        [HttpPost]
        public ActionResult<string?> Login(string userName, string password)
        {
            if (userName == "admin" && password == "666666")
            {
                List<Claim> claims = new List<Claim>();
                claims.Add(new Claim(ClaimTypes.NameIdentifier, "1"));
                //读取配置文件
                string key = jWTOptions.Value.SecKey;
                //超时时间
                DateTime expires = DateTime.Now.AddSeconds(jWTOptions.Value.ExpireSeconds);
                byte[] secBytes = Encoding.UTF8.GetBytes(key);
                var secKey = new SymmetricSecurityKey(secBytes);
                var credentials = new SigningCredentials(secKey, SecurityAlgorithms.HmacSha256Signature);
                var tokenDescriptor = new JwtSecurityToken(claims: claims, expires: expires, signingCredentials: credentials);
                return new JwtSecurityTokenHandler().WriteToken(tokenDescriptor);
            }
            else
            {
                return BadRequest();
            }
        }
    }
}

在需要登录才能访问的控制器类或者Action方法上添加[Authorize] 

[HttpGet]
[Authorize]
public ActionResult<string?> Test1()
{
      return "ok";
}

用PostMan自定义报文头，Authorization的值为“Bearer JWTToken”， Authorization的值中的“Bearer”和JWT令牌之间一定要通过空格分隔。前后不能多出来额外的空格、换行等。