时间戳

首页 > 解决方案 > .NET Core 2.2 Shared Cookie 在登录时导致 Bad Request 错误

c# - .NET Core 2.2 Shared Cookie 在登录时导致 Bad Request 错误

问题描述

我有 2 个应用程序在它们之间共享 cookie。这是两个startup.cs中的配置：

services.ConfigureApplicationCookie(options =>
{
    // Cookie settings
    options.Cookie.Name = Environment.GetEnvironmentVariable(CONST.CookieName);
    options.Cookie.SameSite = SameSiteMode.Lax;
    options.Cookie.SecurePolicy = CookieSecurePolicy.SameAsRequest;
    options.Cookie.Path = Environment.GetEnvironmentVariable(CONST.CookiePath);
    options.Cookie.Domain = Environment.GetEnvironmentVariable(CONST.CookieDomain);
    options.Cookie.HttpOnly = true;
    options.ExpireTimeSpan = TimeSpan.FromMinutes(Convert.ToDouble(Environment.GetEnvironmentVariable(CONST.CookieExpiryTimeSpanInMinutes)));

    options.LoginPath = Environment.GetEnvironmentVariable(CONST.LoginPath);
    options.AccessDeniedPath = Environment.GetEnvironmentVariable(CONST.AccessDeniedPath);
    options.SlidingExpiration = true;
});

现在的问题是，如果我同时加载 App A 和 App B，登录到 App A 然后在 App B 上单击登录，我会收到错误请求错误。我尝试调试 App B 以检查为什么会出现此错误，我发现当我登录到 App A 并尝试登录 App B 时，应用程序不知道我已经通过身份验证。

if (User.Identity.IsAuthenticated)
{
    return LocalRedirect(returnUrl);
}

上面的行总是错误的。

有没有办法防止这个问题？或者有没有办法检查cookie是否已经设置？

编辑：

我为所有应用设置了数据保护密钥：

var ds = new DirectoryInfo("PathTOKey");
services.AddDataProtection()
    .PersistKeysToFileSystem(ds)
    .SetApplicationName("DPName");

编辑：

Startup.cs 中的 Cookie 选项

services.Configure<CookiePolicyOptions>(options =>
{
    // This lambda determines whether user consent for non-essential cookies is needed for a given request.
    options.CheckConsentNeeded = context => false;
    options.MinimumSameSitePolicy = SameSiteMode.None;
});
services.Configure<IdentityOptions>(options =>
{
    options.Password.RequireDigit = false;
    options.Password.RequireLowercase = false;
    options.Password.RequireNonAlphanumeric = true;
    options.Password.RequireUppercase = true;
    options.Password.RequiredLength = 6;
    options.User.AllowedUserNameCharacters =
    "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._@+";
    options.User.RequireUniqueEmail = false;
    options.SignIn.RequireConfirmedEmail = false;
    options.SignIn.RequireConfirmedPhoneNumber = false;
    options.Lockout.AllowedForNewUsers = false;
});
var ds = new DirectoryInfo(Path.Combine(Environment.GetEnvironmentVariable(UCCASGlobals.CentralApplicationSettings), "KeyRing"));
services.AddDataProtection()
    .PersistKeysToFileSystem(ds)
    .SetApplicationName(Environment.GetEnvironmentVariable(UCCASGlobals.DataProtectionApplicationName));

services.ConfigureApplicationCookie(options =>
{
    // Cookie settings
    options.Cookie.Name = Environment.GetEnvironmentVariable(UCCASGlobals.CookieName);
    options.Cookie.SameSite = SameSiteMode.Lax;
    options.Cookie.SecurePolicy = CookieSecurePolicy.SameAsRequest;
    options.Cookie.Path = Environment.GetEnvironmentVariable(UCCASGlobals.CookiePath);
    options.Cookie.Domain = Environment.GetEnvironmentVariable(UCCASGlobals.CookieDomain);
    options.Cookie.HttpOnly = true;
    options.ExpireTimeSpan = TimeSpan.FromMinutes(Convert.ToDouble(Environment.GetEnvironmentVariable(UCCASGlobals.CookieExpiryTimeSpanInMinutes)));

    options.LoginPath = Environment.GetEnvironmentVariable(UCCASGlobals.LoginPath);
    options.AccessDeniedPath = Environment.GetEnvironmentVariable(UCCASGlobals.AccessDeniedPath);
    options.SlidingExpiration = true;
});

标签： c#asp.net-mvcasp.net-core.net-core

解决方案

确保您在应用程序和数据保护密钥中都配置了数据保护，并且两个应用程序中的应用程序名称必须相同。

将数据保护系统配置为将密钥保存到指定目录。此路径可能位于本地计算机上，也可能指向 UNC 共享。

services.AddDataProtection()
         .PersistKeysToFileSystem(new DirectoryInfo(@"d:\Keys"))
         .SetApplicationName("SharedCookieApp");

services.ConfigureApplicationCookie(options => {
          options.Cookie.Name = ".AspNet.SharedCookie";
        });

您可以通过请求中的 cookie 名称检查 cookie 值

var cookie=Request.Cookies["Cookie Name"];

参考： https ://docs.microsoft.com/en-us/aspnet/core/security/data-protection/configuration/overview?view=aspnetcore-3.0

推荐阅读