推送訂閱的驗證

/// <summary>
/// Extended JWT payload to match the pubsub payload format.
/// </summary>
public class PubSubPayload : JsonWebSignature.Payload
{
    [JsonProperty("email")]
    public string Email { get; set; }
    [JsonProperty("email_verified")]
    public string EmailVerified { get; set; }
}
/// <summary>
/// Handle authenticated push request coming from pubsub.
/// See the full sample in https://github.com/GoogleCloudPlatform/dotnet-docs-samples/blob/main/appengine/flexible/Pubsub/Pubsub.Sample/Controllers/HomeController.cs
/// </summary>
[HttpPost]
[Route("/AuthPush")]
public async Task<IActionResult> AuthPushAsync([FromBody] PushBody body, [FromQuery] string token)
{
    // Get the Cloud Pub/Sub-generated "Authorization" header.
    string authorizaionHeader = HttpContext.Request.Headers["Authorization"];
    string verificationToken = token ?? body.message.attributes["token"];
    // JWT token comes in `Bearer <JWT>` format substring 7 specifies the position of first JWT char.
    string authToken = authorizaionHeader.StartsWith("Bearer ") ? authorizaionHeader.Substring(7) : null;
    if (verificationToken != _options.VerificationToken || authToken is null)
    {
        return new BadRequestResult();
    }
    // Verify and decode the JWT.
    // Note: For high volume push requests, it would save some network
    // overhead if you verify the tokens offline by decoding them using
    // Google's Public Cert; caching already seen tokens works best when
    // a large volume of messages have prompted a single push server to
    // handle them, in which case they would all share the same token for
    // a limited time window.
    var payload = await JsonWebSignature.VerifySignedTokenAsync<PubSubPayload>(authToken);

    // IMPORTANT: you should validate payload details not covered
    // by signature and audience verification above, including:
    //   - Ensure that `payload.Email` is equal to the expected service
    //     account set up in the push subscription settings.
    //   - Ensure that `payload.Email_verified` is set to true.

    var messageBytes = Convert.FromBase64String(body.message.data);
    string message = System.Text.Encoding.UTF8.GetString(messageBytes);
    s_authenticatedMessages.Add(message);
    return new OkResult();
}

// receiveMessagesHandler validates authentication token and caches the Pub/Sub
// message received.
func (a *app) receiveMessagesHandler(w http.ResponseWriter, r *http.Request) {
	if r.Method != "POST" {
		http.Error(w, http.StatusText(http.StatusMethodNotAllowed), http.StatusMethodNotAllowed)
		return
	}

	// Verify that the request originates from the application.
	// a.pubsubVerificationToken = os.Getenv("PUBSUB_VERIFICATION_TOKEN")
	if token, ok := r.URL.Query()["token"]; !ok || len(token) != 1 || token[0] != a.pubsubVerificationToken {
		http.Error(w, "Bad token", http.StatusBadRequest)
		return