在我的服务器上,我已使用
成功添加了一个仅限HTTP的cookieapp.UseCookieAUthentication(...)
app.UseOAuthAuthorizationServer(...)
用户在/ oauth2 / token处对服务器进行身份验证,这将在响应头中返回Set-Cookie,通过此调用执行此操作
context.Request.Context.Authentication.SignIn(props, identity);
但是在资源(客户端)上,客户端正在接收标头,但未经授权
app.UseJwtBearerAuthentication(
new JwtBearerAuthenticationOptions
{
AllowedAudiences = new[] { audience },
IssuerSecurityTokenProviders = new IIssuerSecurityTokenProvider[]
{
new SymmetricKeyIssuerSecurityTokenProvider(issuer, secret)
},
Provider = new CookieOAuthBearerProvider("authCookie")
});
}
public class MyAuthorize : AuthorizeAttribute
{
protected override bool IsAuthorized(HttpActionContext actionContext)
{
bool authenticated = actionContext.ControllerContext.RequestContext.Principal.Identity.IsAuthenticated;//always false!! and there are no claims...
return base.IsAuthorized(actionContext);
}
}
authenticated
变量总是假的并且没有声明我做错了什么?
由于