清除缓存

时间：2015-07-03 10:27:13

标签： asp.net authentication cookies asp.net-web-api forms-authentication

我目前遇到的问题是清除缓存/ Cookie后IE10＆amp; IE11不会再次设置cookie。请求和响应看起来几乎完全相同，但在清除缓存之后，即使看起来设置正确，cookie也永远不会被传递。

以下是我的登录方法的流程： 

 1. VerifyLogin()    -> Fail: Go To Login page
                     -> Pass: Call rest of the AJAX Methods // Enter Login Credentials and submit
 2. Authentication() -> Fail: Prompt the user
                     -> Pass: set forms auth cookie and navigate back to original page, where it will call VerifyLogin() again

一旦Authentication（）通过，它们应该毫无问题地通过VerifyLogin（）并继续使用该产品。所有调用现在都会传递表单身份验证cookie。

在我看到它失败的实例中，Authentication（）调用传递并获得200 OK（并且具有set-cookie响应头）但是，VerifyLogin（）然后失败，因为它没有通过cookie中。

我真的很难再现这个，但到目前为止我的再现步骤如下。这是从没有运行IE的实例开始的。我不是100％确定这是我的客户遇到的完全相同的问题，但它似乎揭示了他们所看到的同样问题。

  1. 启动IE
  2. 浏览到该站点的索引页面并退回登录（验证失败）
  3. 使用凭据登录，Authentication（）返回200 OK并具有set-cookie响应标头。然后它会导航并调用通过的VerifyLogin（）。 cookie在请求中发送，并且全部成功。后续调用全部工作。
  4. 清除我的缓存和Cookie
  5. 浏览网站的索引页面并退回登录（验证失败）
  6. 使用凭据登录，Authentication（）返回200 OK并具有set-cookie响应标头。然后它会导航并在此时调用VerifyLogin（）失败。即使之前在Authentication（）的响应中设置了cookie，也不会在请求中传递cookie。如果我关闭并重新打开IE，它将再次运行。

    7. 所以，就像第二次set-cookie响应就是没有设置cookie。

    首先，Heres是我的web.config的相关部分以及我如何设置表单cookie。

    的web.config： 

     <authentication mode="Forms">
      <forms enableCrossAppRedirects="true" name="Gator.Express.Auth" timeout="2880" />
    </authentication>

    setAuthenticationCookie方法： 

     public void SetAuthenticationCookie(string userName, CookieData cookieData)
        {
            //In order to pickup the settings from config, we create a default cookie and use its values to create a 
            //new one.
            var cookie = FormsAuthentication.GetAuthCookie(userName, true);
            var ticket = FormsAuthentication.Decrypt(cookie.Value);

            if (ticket == null)
                throw new Exception("Error setting authorisation cookie. Decryption of default cookie failed.");

            var jsonToken = JsonConvert.SerializeObject(cookieData);

            var newTicket = new FormsAuthenticationTicket(ticket.Version, ticket.Name, ticket.IssueDate, ticket.Expiration,
                ticket.IsPersistent, jsonToken, ticket.CookiePath);
            var encTicket = FormsAuthentication.Encrypt(newTicket);

            cookie.Value = encTicket;

            HttpContext.Current.Response.Cookies.Add(cookie);
        }

    现在，下面是请求和响应。

    工作认证请求 

    POST http://localhost:55733/api/Authentication HTTP/1.1
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://localhost:61496/Login.html
Accept-Language: en-GB
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko
Connection: Keep-Alive
Content-Length: 35
DNT: 1
Host: localhost:55733
Pragma: no-cache

Username=michaelGator&Password=XXXX

    ＃Working Authentication Response 

    HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: application/json; charset=utf-8
Expires: -1
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
Set-Cookie: Gator.Express.Auth=01020FCCF4658183D208FE0F4CC8BA1385D208000C6D00690063006800610065006C004700610074006F00720000012F00FF; path=/; HttpOnly
Set-Cookie: Gator.Express.Auth=0102054E17668183D208FE05CEEABA1385D208010C6D00690063006800610065006C004700610074006F007200377B002200530073006F004100630063006F0075006E0074004900640022003A002200300030003000300030003000300030002D0030003000300030002D0030003000300030002D0030003000300030002D0030003000300030003000300030003000300030003000300022007D00012F00FF; expires=Sun, 05-Jul-2015 08:28:39 GMT; path=/; HttpOnly
X-SourceFiles: =?UTF-8?B?QzpcV29ya2luZ1xnYXRvci5nYXRvcndlYnNlcnZpY2VcU291cmNlXEdhdG9yV2ViU2VydmljZVxhcGlcQXV0aGVudGljYXRpb24=?=
Access-Control-Allow-Origin: http://localhost:61496
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, token
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Credentials: true
Date: Fri, 03 Jul 2015 08:28:39 GMT
Content-Length: 14

"michaelGator"

    #FELING VerifyLogin Request 

    GET http://localhost:55733/api/VerifyLogin HTTP/1.1
Referer: http://localhost:61496/
Accept: */*
Accept-Language: en-GB
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko
Connection: Keep-Alive
DNT: 1
Host: localhost:55733
Cookie: Gator.Express.Auth=0102054E17668183D208FE05CEEABA1385D208010C6D00690063006800610065006C004700610074006F007200377B002200530073006F004100630063006F0075006E0074004900640022003A002200300030003000300030003000300030002D0030003000300030002D0030003000300030002D0030003000300030002D0030003000300030003000300030003000300030003000300022007D00012F00FF

    #Renit VerifyLogin响应 

    HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Expires: -1
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
X-SourceFiles: =?UTF-8?B?QzpcV29ya2luZ1xnYXRvci5nYXRvcndlYnNlcnZpY2VcU291cmNlXEdhdG9yV2ViU2VydmljZVxhcGlcVmVyaWZ5TG9naW4=?=
Access-Control-Allow-Origin: http://localhost:61496
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, token
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Credentials: true
Date: Fri, 03 Jul 2015 08:28:39 GMT
Content-Length: 0

    下面是非工作的请求和响应集。请注意，Authentication方法返回200 OK和set-cookie命令，但在下一次验证登录调用中，coookie已经消失。

    ＃身份验证请求 - 按原样返回但是部分非工作请求 

    POST http://localhost:55733/api/Authentication HTTP/1.1
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://localhost:61496/Login.html
Accept-Language: en-GB
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko
Connection: Keep-Alive
Content-Length: 35
DNT: 1
Host: localhost:55733
Pragma: no-cache

Username=michaelGator&Password=XXXX

    ＃身份验证响应 - 按原样返回但是部分非工作请求 

    HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: application/json; charset=utf-8
Expires: -1
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
Set-Cookie: Gator.Express.Auth=01022054EB9B8183D208FE20D4BEF01385D208000C6D00690063006800610065006C004700610074006F00720000012F00FF; path=/; HttpOnly
Set-Cookie: Gator.Express.Auth=01028447109C8183D208FE84C7E3F01385D208010C6D00690063006800610065006C004700610074006F007200377B002200530073006F004100630063006F0075006E0074004900640022003A002200300030003000300030003000300030002D0030003000300030002D0030003000300030002D0030003000300030002D0030003000300030003000300030003000300030003000300022007D00012F00FF; expires=Sun, 05-Jul-2015 08:30:10 GMT; path=/; HttpOnly
X-SourceFiles: =?UTF-8?B?QzpcV29ya2luZ1xnYXRvci5nYXRvcndlYnNlcnZpY2VcU291cmNlXEdhdG9yV2ViU2VydmljZVxhcGlcQXV0aGVudGljYXRpb24=?=
Access-Control-Allow-Origin: http://localhost:61496
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, token
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Credentials: true
Date: Fri, 03 Jul 2015 08:30:10 GMT
Content-Length: 14

"michaelGator"

    #NotoreWork VerifyLogin请求 - 请注意，没有cookie消失 

    GET http://localhost:55733/api/VerifyLogin HTTP/1.1
Referer: http://localhost:61496/
Accept: */*
Accept-Language: en-GB
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; rv:11.0) like Gecko
Connection: Keep-Alive
DNT: 1
Host: localhost:55733

    #NotoreWork VerifyLogin响应 - 由于没有传递任何表单Cookie而失败 

    HTTP/1.1 401 Unauthorized
Cache-Control: no-cache
Pragma: no-cache
Content-Type: application/json; charset=utf-8
Expires: -1
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
X-SourceFiles: =?UTF-8?B?QzpcV29ya2luZ1xnYXRvci5nYXRvcndlYnNlcnZpY2VcU291cmNlXEdhdG9yV2ViU2VydmljZVxhcGlcVmVyaWZ5TG9naW4=?=
Access-Control-Allow-Origin: http://localhost:61496
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, token
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Credentials: true
Date: Fri, 03 Jul 2015 08:30:10 GMT
Content-Length: 71

{"$id":"1","Message":"Authorization has been denied for this request."}

    任何人对此都有任何想法？

2 个答案:

答案 0 :(得分：2)

您似乎获得了两个身份验证Cookie，这表明您的实现与ASP.Net尝试为您自动化的内容发生冲突。

有一个FormsAuthentication.SetAuthCookie可以创建和设置Cookie，我认为这已经应用了，所以：

  1. FormsAuthentication.SetAuthCookie获取cookie（已在同一响应中设置）。
  2. 你的SetAuthenticationCookie火灾。
  3. 这会调用FormsAuthentication.GetAuthCookie并将原始进程（将JSON序列化数据嵌入到新的cookie中）。
  4. 您致电HttpContext.Current.Response.Cookies.Add创建第二个Cookie。
  5. 两个Cookie都在标题中以相同名称
    6. 发送

    您尚未清除原始Cookie，。Net不知道如何处理已处理的Cookie。

    我认为你有两个选择：

    1. 将您的JSON数据拆分为一个具有不同名称的完全独立的Cookie。
    2. 从头开始滚动自己的Cookie，不要使用任何.Net的FormsAuthentication方法。

      3. 我个人认为前者是最简单，最快捷的。

      也许值得尝试使用Cookie名称 - 我不确定所有浏览器是否支持Cookie名称中的句点，但它们都区分大小写。

      最后还有其他值得检查的东西 - 它差不多never worth setting a cookie's path in .Net，因为IIS将URL视为不区分大小写，但浏览器都将cookie名称视为区分大小写。

答案 1 :(得分：0)

  1. 为什么响应会发送两个具有相同Cookie名称的SetCookie标头？这似乎......错误和令人困惑。

  2. 小心不要在IE中提供过多的IE数据。你的cookie值很长！饼干限制为~4k。这是您域名的总Cookie。如果它比这长，IE将不会将其发回。

    3. HTH

相关问题
最新问题