Question

我一直试图弄清楚这一点。我有一个应用程序转发到另一个应用程序，以处理登录。第一个应用程序重定向到webAPI URL。然后该url接受其中一个参数并创建一个令牌。然后它使用Set-Cookie标头发送403响应。发送的cookie是永远不会设置标头。

经过一系列的研究，我认为它可能需要一个P＃P头，所以我尝试了各种组合。

以下是代码：

    Public Function Authenticate(t As String, forwardURL As String) As HttpResponseMessage
        Dim resp As New HttpResponseMessage()
        If VestigoBusinessObjects.UserToken.IsValid(t, EncType.AES) Then
            Dim user As New UserToken(t, EncType.AES)
            user.ResetExperation()
            'Create usertoken cookie
            Dim Cookie = New CookieHeaderValue("t", user.GetEncTicket())
            Cookie.Expires = DateTimeOffset.Now.AddDays(1)
            Cookie.Domain = Request.RequestUri.Host
            Cookie.Path = "/"

            resp.Headers.AddCookies(New CookieHeaderValue() {Cookie})
            resp.StatusCode = HttpStatusCode.RedirectMethod
            resp.Headers.Location = New Uri(forwardURL)
            resp.Headers.Add("Pragma", "no-cache")
            resp.Headers.Add("Cache-Control", "no-cache")

            Return resp
        End If
        resp.StatusCode = HttpStatusCode.Unauthorized

        Return resp
    End Function

以下是我在浏览器中设置的标题：

请求网址：已删除，因为它不允许我发帖吗？

T = BB％2B％2FpRLq％2BzobRcXgQuw5rjMa8Yeb1Wxb7qIZCtjLfwiN8RNT％2BQYjzIuWI9j3JPn4qnpXpgK％2F％2B6ucL96lBmpD6ryIbFJvP3yPOfJjXuZsECfWlj58etczEco79q0SNJj0c％2BwKLREh5FWMfTvN％2BQxSn8nMEr6JzS06CuPizM1k0Kef52ZrHVkxHDv6qVyGLJrxRFebwbpFT0LNMCCihJ％2BZ％2FbmfvvKl9lfg18vHT8nhL1dDtAlR0Fd％2FdSuB5L6Yg3Yj％3F％3FHKZNy0zYBTVwdL7NXMFGXw％3D％3D＆安培; forwardurl = HTTP％3A％2F％2Flocalhost％3A4644％2FInternalMonitor html的

请求方法：GET

状态代码：303见其他

远程地址：[:: 1]：4644

响应标题

缓存控制：无缓存

的Content-Length：0

日期：2016年11月29日星期二22:58:11 GMT

位置：已删除，因为它不允许我发布

P3P：CP =＆＃34; IDC DSP COR IVAi IVDi我们的TST＆＃34;

杂注：无缓存

服务器：IIS / 10.0

设置Cookie：T = 5524596D26C583E9DEAC935880DD6FE40D579B362A63EECE67942CD0DCEDDE47D5B6B367AF3547A93E4F309C12F2607EED1F02E19D698D2BAD97E6E9BB1FD807EF331842AEA6B62CE0BFF90206F62B31EAAB5035BD26BC66B89D1A8A676E47FB2CD007B5644487781D79DD0D26454B16E60EF96E6034EA350F8190C0317BCF3CA0875EAA41795014F1F1430E55E79E56E911BA097F09E89DAF3BC86BFE8E5EC6E74C72CDB500005E0E0FDA6E2B394A8400DDB63C4B33EA755D0D083A87B5B1244F1529353FE758EF666ECBA57BEE50AF4D319AB42F1183A3244E01AF87A3F9CADF8861DC29497945052CC568E6B4D996A9E0F8139CEEF4DCCCBB1990F138F735D2FC6FEFA352430FE9CB999926A47EA374E87895F8079F3C0550A45000EF26E030E14CE814E823BCC788E4882CCBCC795FAAC7C9BC4D7A5BEBD902CF79900296D61DC277A2CC375AEBE3FEAF6E605CC167DF757A8805332C33E32A6B8DECF3C92DCB96B7A4E015499D6B5FFB807FAA69408A74EFE323C58C796027ED89D39E4F6C22B3865B301B7B1BF77C1CA4B2AD39B245E9B0388B3D2D3D9C33DFD577ED633F9AB82AC2A63DA608BBCA32FFCEC96FE7CB299930674745018B81BE606C6181F0A5C94AA6DB025A6B5829ABCABD4A7A075BE33246CBE151D320904AA3643C6AE7E4DBA553500AB195229700 36DA64323E1A4352241DB8CF4FEE6FE121135DC9364F8A2C3ADA4346BAFBF8B18F7875F3;到期= 2016年11月30日星期三22:58:12 GMT;域本地主机=;路径= /

X-ASPNET-版本：4.0.30319

X供电-通过：ASP.NET

X-SourceFiles：？？？= UTF-8乙

YzpcVEZTXFZlc3RpZ29cVGVzdFxDZW50cmFsTW9uaXRvclxhcGlcQXV0aGVudGljYXRpb25Db250cm9s

bGVyXEF1dGhlbnRpY2F0ZQ ==？=

请求标题

接受：text / html的，应用/ XHTML + xml的，应用/ XML; Q = 0.9，图像/ WEBP， / 的; q = 0的。 8

接受编码：gzip，deflate，sdch，br

接受语言：EN-US，EN; Q = 0.8

缓存控制：无缓存

连接：保活

的Cookie：ASP.NET_SessionId = cnru1r4g0svzeomwglkwestw; .ASPXAUTH = 1566301093F4FC41F147432F8A4B044E3A19EFC46C47A1BE54F95A98E08EE8952197E5212230F0416776480CA3496036DCA0C0B8AEF0D08675D4B20E655E107F055E1D60150BF84334F65FE63E134B0252EF3B8F02E1E0BC372DBA80006300215AAE095F4333F48BB04D0DF315D825BF1A1B0F27A81E32E82ACEEA791BF11551A8F96A1B0AED9EC11EEA5EF34AE03406; hoursDiffGMTTime = -5;的屏幕分辨率1920×1080 =; BrowserResolution = 1920x950; T = FDB5B335C4DCE820A037947D7A19D487FF44AB3CC2EA8E44FB6EA59FDA43E14BA53B0E455EED57C63040B8995C67C9B96146516B600B0ED4FC397DFFBE16FA259C554AC24A2CCBB99537FBA6BAC2F1F78031BD3F0D11FED97B57CB401738319890ACD128926B3DF05AEAE975979B18DE32A60795FB8360B4D1CB8517B7E34E7B14EF0EBE77036FA72504F3C2B12B2C147D6599C1357F2789A09134B9F2020F4A413E96A5DBE0E725E09EAEB82AB8DFAB212760E5D09501BC0AD9248119CAF245E2B448437529A7AF72725E0DB2EA2975915D934B13E6226C4DF0D1E4426B25DA6822F1D678127B30736355B645729501888C5079629052467C5AB0458709AEE6B3BA04363951DDDCE33DA656C5B1E3979A7BFD182459074B3588856A0859FCFBC5EB95A6BF8C6ECAF9623E8A2E167580191C1C3BE89446FA212E0E908578DC7CE1E99F11CCD460A2E07E1D53F25DA96AFD92D9D13B753C80015E7E2722A1F473D1E958CA0FA19DA3F959E4A813D55C8468B8A16F959C7F3469D71F6433282FE5C03B5FFEE32ED2739CBB4ECBF79D8573769F497A954B58611F7FB9D3EB256492675F36523E6557545FC9AFD27A04360835AD5DC54CE94372FAB5830AEB7FAE086E1D13837ADB91EEC76C0F12614524E98B0D5B0C6D833490D280F62FDBF69706896D9B5EDDD2B59C8DF3A82CEF4475941A319B BD03FB4C16522B5188081943EDFEB0DFD857FB853D903B036DF66F0B9F

主机：本地主机：4644

杂注：无缓存

升级不安全-要求：1

User-Agent：Mozilla / 5.0（Windows NT 10.0; Win64; x64）AppleWebKit / 537.36（KHTML，与Gecko一样）Chrome / 54.0.2840.99 Safari / 537.36

查询字符串参数

T：BB + / + pRLq + zobRcXgQuw5rjMa8Yeb1Wxb7qIZCtjLfwiN8RNT QYjzIuWI9j3JPn4qnpXpgK / + + 6ucL96lBmpD6ryIbFJvP3yPOfJjXuZsECfWlj58etczEco79q0SNJj0c + wKLREh5FWMfTvN + QxSn8nMEr6JzS06CuPizM1k0Kef52ZrHVkxHDv6qVyGLJrxRFebwbpFT0LNMCCihJ Z / bmfvvKl9lfg18vHT8nhL1dDtAlR0Fd / dSuB5L6Yg3Yj ?? HKZNy0zYBTVwdL7NXMFGXw == forwardurl：已删除，因为它不允许我发布它们

真的很感激任何意见。

在403重定向期间，IE 9-10和Edge不保存cookie

0 个答案: