Asp.Net Owin授权请求在隐身模式下工作，但不是＆＃34;正常＆＃34;铬

Question

我有一个Asp.Net应用程序，我可以在Chrome中正常登录，无论是正常模式还是隐身模式。但是，当我执行API请求时，它仅在隐身模式下授权。

然后我尝试做＃34;清空缓存并重新加载＆＃34;，重新启动Chrome，清除Cookie，甚至重新启动计算机等但没有任何作用。我想是否它可能是一些插件，但我尝试禁用Ad-blocker和所有其他插件，但我仍然得到相同的结果。在Incognito中一切正常。

本地存储空间和会话存储空白，并且在非隐身和隐身状态下，Localhost唯一存在的Cookie为.AspNet.ApplicationCookie。

然后我检查了发送到服务器的请求，这是来自非隐身：

GET /api/prospects/active HTTP/1.1
Host: localhost:3807
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, sdch
Accept-Language: sv-SE,sv;q=0.8,en-US;q=0.6,en;q=0.4
Cookie: ASP.NET_SessionId=ib450fjia5vizwpzxlnfuogd; XSRF-TOKEN=3hd4ZvxqpDU6sjttd22sjnxcrzCkptKajk3ml2maaf6oc8axj8N2P1QH6UzwPNeiKS4DhPYIhDVHzzwTaBb0-RF4ECjLZvPCUXqDEfrmaoIZ5rFOb2vubYL-PT4OGmyH0; XSRF-V=Zmq1iNyMWiHYOuEIYiKBGlEyW7pe1unHxGQN5K3zvn-30oHbX37JgMJTrlJMg0yCtLjfC2JJOiNOV9cO-ox6WIJgQR04cXZffeXzGfTF63E1; .AspNet.ApplicationCookie=RmjkiPr76LDahSXu-vOctxQY_TE0FT8nB-1ytaJ49_p3IYIntIO4fqu_CMuFalVYU9yls9FmGT8kC4L_Zb6fl12plkLfSlCuzVDkvwgi0QABCQ8oK9AgrN5wLx5Lk-OKMZ9LaxIpiDKuLuYFXX9F2LBE5524oEhk8fdUT-k8izwR5pJiBtPFV2PJ4U7ph77gNQRQNd3LMEKX2hYLIO4TjrfteVRClrAJYyVkP4uV9k_fWoHx-Lpx5aJiHIgM2naYqdyi9FmRYFOQRY1dScFhnz-PYYtfP_qkorjzjPLKDHfDQ06wzpuraB2J68bymbB4DG_d_Kr35d97O9WlGgLJo2qQV2HObQlGZ0qU3Dgmrib_ImmmFGcI3fwYWHV9WNV1kjUZ5DS9lIiZsAhqA8_eZbSKILmFw7L7vhMGNVKU6ptOeAyFqqRImY29nw2Fw5Rnrt3cy_Tw-pe229Ztvc7JRwfEF6bs7YqGWJTvGb1c3uE; UMB_UPDCHK=1; _ga=GA1.1.1065814793.1466085326; 3264e9011c=pe_data=|id=0b42d0758724f0295d9384687bcd6b0a; .AspNet.ApplicationCookie=Ol7PeRdke7-95-rLIAQY174l4UAly08mog8da0b7IHfAyHkcZTauLc7ZuGuynO5CTkuVokTuxrsPAwhUgeR9Ex9QpdcFeZV7COICBxBXSQADsbSCs1qf0daOG7LOId_ATup-pOiJcG1tr9JZ4biMdrPrsPE3Z3UITwWesD3UCovmmPMN7tk1cHKQ7XQO3M8tLRE_VWJX79R3aakNolFx2zKnUu15rsGSACcZzfANAGpZR59Ld0vr9378sSkIXrHOJWVgZyOloWlelQfKy1g5X5NZn2rIuBkS1gJrYAKf_4lR46BH8dR8pYbKAVYZb07xLAaiLBz7SkwMrc7nXIONIxnlKTKHBe43FSwu5mmAa5uRltd4Z7E4D_9J96OJd-hyFMA3n-F8SGL6diX6zxtSTjZfXmQmd-PJkzgg7FkuhPpb5nbCEMH6uI_JcU-ZZNbz4cAIbk0maLvLpUQKvkMz-txxNzgABgBUl753LaaHR0o

结果：

隐身请求：

GET /api/prospects/active HTTP/1.1
Host: localhost:3807
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, sdch
Accept-Language: sv-SE,sv;q=0.8,en-US;q=0.6,en;q=0.4
Cookie: .AspNet.ApplicationCookie=PxTseFnL3UPqv438ySa4f0Cb9mb-0ByyjjMDjTSCD9tSCmN4X0xYgIyMVVriHj1UJ8aogNe_ztHcEfr8pkE4xsMx2miVZ1Z50BGxBwY7sIz22fFQzDmC3-ASPMzYE6k9IFECpdqFfBLkb4rcSx_kd-flUb9hVLGa0zDC-qpypIEZJaYg2j50OfX9g9h0Ko4XXx9DJcDTE4qkPPmD52oMn2qLGSdSOFfLyi4tNE66vsh38Bi4DIxSB2wSHEBlWsE9LyZpwC8IN6C1B6R4XDuJaliWMZJCmoWLCr5X-YPWo-PQcrCiK_iCSp5ndJJJBsY65L2MiVDueShMTi4UeFwzk24kTUES_zhS0JSXEPrOyXGWV_1OAIAGkRObkN7YvD78jSairV547nfcPFzGTt6VPrUq6FkXGINV0AHa_5Vo03Ygjg3o6PgCB8kDrijYy_tAeA2rnmkCUsb8ZD6W-veCoujGKpHOTkuA1Ock1cczxTg

正如您所看到的，即使Chrome开发人员工具 - ＆gt;，非隐身请求还有几个Cookie。应用程序只显示一个cookie。

导致这种情况的原因是什么？

登录控制器：

private IAuthenticationManager AuthenticationManager => HttpContext.GetOwinContext().Authentication;

[HttpPost]
[Route("Login")]
public ActionResult Login(AuthenticationViewModel viewModel)
{
    if (!ModelState.IsValid)
    {
        return View(viewModel);
    }

    User user = authenticationGateway.Authenticate(viewModel.Username, viewModel.Password);

    if (user == null)
    {
        logRepository.LogInformation("Login failed", $"Login attempt for user {viewModel.Username} from IP {Request.UserHostAddress} failed.", Guid.NewGuid());
        TempData["loginError"] = "Wrong username or password.";

        return View(viewModel);
    }

    var claims = new List<Claim>
    {
        new Claim(ClaimTypes.Name, user.Name, ClaimValueTypes.String),
        new Claim(ClaimTypes.NameIdentifier, user.Id.ToString(), ClaimValueTypes.Integer),
        new Claim(ClaimTypes.Email, user.Email ?? string.Empty, ClaimValueTypes.Email),
        new Claim(ClaimTypes.Role, user.Role.ToString(), ClaimValueTypes.String),
        new Claim(ClaimTypes.OtherPhone, user.Phone ?? string.Empty, ClaimValueTypes.String),
        new Claim(CustomClaimTypes.SalesId, user.UgId.ToString(), ClaimValueTypes.Integer)
    };

    var claimsIdentity = new ClaimsIdentity(claims, DefaultAuthenticationTypes.ApplicationCookie);
    AuthenticationManager.SignIn(claimsIdentity);

    logRepository.LogInformation("Login success", $"Login attempt for user {viewModel.Username} from IP {Request.UserHostAddress} succeeded.", Guid.NewGuid());

    return RedirectToAction("Index", "Home");
}

[HttpGet]
[Authorize]
[Route("Logout")]
public ActionResult Logout()
{
    logRepository.LogInformation("Logout", $"Logged out user {User.Identity.Name}. Logout initiated from IP {Request.UserHostAddress}.", Guid.NewGuid());

    AuthenticationManager.SignOut();

    return RedirectToAction("Login");
}

Startup.Auth：

public partial class Startup
{
    public void ConfigureAuth(IAppBuilder app)
    {
        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
            LoginPath = new PathString("/Login"),
            LogoutPath = new PathString("/Logout"),
            SlidingExpiration = true
        });
    }
}

Answer 1

某些Cookie未正确删除。当我直接在浏览器中访问api http://localhost:3807/api/prospects/active时，Chrome开发者工具会显示上面的所有Cookie。我不知道它是否是一个bug，因为应用程序和API都在localhost：3807上运行。 Chrome开发者工具专门说Cookies - ＆gt; API和Web上也http://localhost:3807/。当我手动删除cookie时，一切都在我再次登录后开始工作。

Answer 2

我试图删除Cookie，但它没有帮助。 所以我试图清除Chore Developer Console中的所有站点数据。它显示了特定端口，但有助于所有本地Web应用程序的端口号