Question

早安，我很困惑为什么即使我在控制器上使用[Authorize]属性，它也不会检查用户是否已登录并仍然作为授权成功而通过。我正在遵循Microsoft HERE和HERE的基本身份和授权教程。我能够进行基本身份验证，创建用户并登录等所有内容，但是授权仅允许来宾通过，系统错误地将其识别为成功。我使用chrome进行测试，所以我什至使用私有模式并在存储信息时清除了cookie和缓存。我完全迷住了，不知道该怎么办。

Microsoft.AspNetCore.Authorization.DefaultAuthorizationService：信息：授权成功。

是在调试控制台日志中获得的授权成功消息。

下面是Startup.cs

 public class Startup
    {
        public Startup(IConfiguration configuration)
        {
            Configuration = configuration;
        }

        public IConfiguration Configuration { get; }

        // This method gets called by the runtime. Use this method to add services to the container.
        public void ConfigureServices(IServiceCollection services)
        {
            services.Configure<CookiePolicyOptions>(options =>
            {
                // This lambda determines whether user consent for non-essential cookies is needed for a given request.
                options.CheckConsentNeeded = context => true;
                options.MinimumSameSitePolicy = SameSiteMode.None;
            });

            services.AddRazorPages();
            services.AddControllersWithViews();

            services.AddAuthorization(options =>
            {
                options.DefaultPolicy = new AuthorizationPolicyBuilder().RequireAuthenticatedUser().Build();

            });


            services.AddDbContext<DevContext>(options => options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection")));
            services.AddDbContext<UserContext>(options => options.UseSqlServer(Configuration.GetConnectionString("UserContextConnection")));
            services.AddIdentity<User, IdentityRole>().AddEntityFrameworkStores<UserContext>().AddDefaultTokenProviders();
            services.AddAuthentication(IISDefaults.AuthenticationScheme);




            services.ConfigureApplicationCookie(options =>
            {
                //Cokie Settings
                options.Cookie.HttpOnly = true;
                options.ExpireTimeSpan = TimeSpan.FromDays(150);
                //If the LoginPath isn't set, ASP.NET Core defaults the path to Account/Login.
                // options.LoginPath = "/Account/Login";
                // options.AccessDeniedPath = "/Account/AccessDenied";
                options.LoginPath = $"/Identity/Account/Login";
                options.LogoutPath = $"/Identity/Account/Logout";
                options.AccessDeniedPath = $"/Identity/Account/AccessDenied";
                options.SlidingExpiration = true;
            });

           // services.AddSingleton<IEmailSender, EmailSender> ();
        }

        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
                app.UseDatabaseErrorPage();
            }
            else
            {
                app.UseExceptionHandler("/Home/Error");
                app.UseHsts();
            }

            app.UseHttpsRedirection();
            app.UseStaticFiles();
            app.UseRouting();
            app.UseCookiePolicy();
            app.UseAuthentication();
            app.UseAuthorization();


            app.UseEndpoints(endpoints =>
            {
                endpoints.MapRazorPages();
                endpoints.MapControllers();
                endpoints.MapControllerRoute("default", "{controller=Home}/{action=Index}/{id?}");
                endpoints.MapDefaultControllerRoute().RequireAuthorization();
            }
            );


        }
    }

下面是User.cs，将其保留为空白，因为基本演示没有任何自定义字段，并且仍然有效。所以我不确定那是问题所在。

public class User : IdentityUser
    {

    }

这是具有[Authorize]属性的Home Controller

 public class HomeController : Controller
    {
        public IActionResult Index()
        {
            return View();
        }

        [Authorize]
        public IActionResult Information()
        {
            ViewData["Message"] = "Test Information Page";

            return View();
        }

        [Authorize]
        public IActionResult About()
        {
            ViewData["Message"] = "Your application description page.";

            return View();
        }
        [Authorize]
        public IActionResult Contact()
        {
            ViewData["Message"] = "Your contact page.";

            return View();
        }
        [Authorize]
        public IActionResult Privacy()
        {
            return View();
        }

        [ResponseCache(Duration = 0, Location = ResponseCacheLocation.None, NoStore = true)]
        public IActionResult Error()
        {
            return View(new ErrorViewModel { RequestId = Activity.Current?.Id ?? HttpContext.TraceIdentifier });
        }
    }

Answer 1

我认为您的问题是这一行：

services.AddAuthentication(IISDefaults.AuthenticationScheme);

这意味着您的应用程序将使用Windows登录名而不是您创建的cookie来对您进行身份验证。

由于您使用的是基于Cookie的身份验证方案，因此我将其更改为此：

services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme) .AddCookie();

请参见以下指南：

https://docs.microsoft.com/en-us/aspnet/core/security/authentication/cookie?view=aspnetcore-3.0

我还将添加用于创建和处理防伪令牌的功能，以保护您的应用程序免受交叉伪造的侵害。

更新（解决方案）：

此实现是已经添加的usign Identity，因此无需调用AddAuthentication（）

与此类似的问题：github.com/aspnet/AspNetCore/issues/4656

即使用户未登录，授权属性仍然成功通过

1 个答案: