Question

我已经从asp.net core 1.0升级到asp.net core 2.0我需要基于url的身份验证，这会创建一个授权的cookie。没有登录页面。如果url包含某些令牌，我需要验证请求，如果不将它们重定向到错误页面。我陷入了重定向循环。我的代码中出了什么问题

ConfigureServices方法

 services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
                .AddCookie(options =>
                {
                    options.LoginPath = new PathString("/Error/");
                    options.AccessDeniedPath = new PathString("/Error/");
                    options.SlidingExpiration = true;
                    options.ExpireTimeSpan = TimeSpan.FromMinutes(20);

                });

配置方法

app.UseAuthentication();
app.ValidateRequest(Configuration);

在validaterequest中间件

中

public Task Invoke(HttpContext context)
        {
                context.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme,
                   principal,
                   new AuthenticationProperties
                   {
                       ExpiresUtc = DateTime.UtcNow.AddSeconds(expiration),
                       IsPersistent = true,
                       AllowRefresh = true,
                       IssuedUtc = DateTime.UtcNow,
                   });
return _next.Invoke(context);
}


[MiddlewareFilter(typeof(validaterequestPipeline))]
    public class HomeController : Controller
    {
      [Authorize]
        [HttpGet]
        public IActionResult Index()
        {
        }
   }

Answer 1

登录在http/localhost上正常运行，但一旦在https/subdomain.domain.com上，它就无法正常工作。改变就是这样做

services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme).AddCookie(options =>
{
    options.LoginPath = new PathString("/account/signin");
    options.SlidingExpiration = true;
    options.ExpireTimeSpan = TimeSpan.FromMinutes(20);
    options.Cookie.SameSite = SameSiteMode.None;
});

options.Cookie.SameSite = SameSiteMode.None;

Asp.net Core 2.0基于Cookie的身份验证

1 个答案: