.net Duende Software Backend for Frontend cookie未在Firefox上找到

wkftcu5l  于 2023-03-24  发布在  .NET
关注(0)|答案(2)|浏览(420)

我使用Duende Software和Backend for Frontend Pattern,
在本地使用Edge / Chrome / Firefox时一切都很好,
当我将我的解决方案部署到我的服务器上时,在Edge / Chrome上一切正常,但对于Firefox(111.0(64位)),我有这个例外:

System.Exception: An error was encountered while handling the remote login.
 ---> System.Exception: Correlation failed.
   --- End of inner exception stack trace ---
   at Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler`1.HandleRequestAsync()
   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)

在日志中,我看到这是因为我没有饼干:
.AspNetCore.Correlation.1GVEGnaW7Z81J1EaVhD_zICu3gQNfSktAd9fhpH1tfg' cookie not found.
cookie在Firefox上似乎消失了。
下面是我的客户端解决方案中的Program.cs代码(实际上它是基于Duende Software Github Quickstarts JS with backend的示例):

using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using Duende.Bff.Yarp;
using JavaScriptClient;
using Microsoft.AspNetCore.Authorization;
using Serilog;

var builder = WebApplication.CreateBuilder(args);

JwtSecurityTokenHandler.DefaultMapInboundClaims = false;
builder.Services.AddAuthorization();

builder.Services
    .AddBff()
    .AddRemoteApis();

builder.Services
    .AddAuthentication(options =>
    {
        options.DefaultScheme = "Cookies";
        options.DefaultChallengeScheme = "oidc";
        options.DefaultSignOutScheme = "oidc";
    })
    .AddCookie("Cookies")
    .AddOpenIdConnect("oidc", options =>
    {
        options.Authority = "http://myIdentityProvider.com";
        options.ClientId = "MyCliendId";
        options.ClientSecret = "MySecret";
        options.ResponseType = "code";
        options.ResponseMode = "query";
        options.Scope.Add("MyScope");
    });

var app = builder.Build();
if (app.Environment.IsDevelopment())
{
    app.UseDeveloperExceptionPage();
}

app.UseDefaultFiles();
app.UseStaticFiles();

app.UseRouting();
app.UseAuthentication();

app.UseBff();

app.UseAuthorization();

app.UseEndpoints(endpoints =>
{
    endpoints.MapBffManagementEndpoints();

    // Uncomment this for Controller support
    //endpoints.MapControllers()
    //    .AsBffApiEndpoint();
    //

    endpoints.MapGet("/local/identity", LocalIdentityHandler)
        .AsBffApiEndpoint();

    endpoints.MapRemoteBffApiEndpoint("/remote", "https://localhost:6001")
        .RequireAccessToken(Duende.Bff.TokenType.User);
});

app.Run();

[Authorize] 
static IResult LocalIdentityHandler(ClaimsPrincipal user, HttpContext context)
{
    var name = user.FindFirst("name")?.Value ?? user.FindFirst("sub")?.Value;
    return Results.Json(new { message = "Local API Success!", user = name });
}
c9x0cxw0

c9x0cxw01#

您需要使用HTTPS,因为否则重要的cookie将被阻止,因为我们现在在cookie上设置了相同的属性。

g2ieeal7

g2ieeal72#

尝试使用以下cookie选项:

.AddCookie(CookieAuthenticationDefaults.AuthenticationScheme, options => {
    options.Cookie.SameSite = SameSiteMode.Strict;
})

这里有两个有趣的观点:

  • .NET堆栈默认使用SameSite=None cookie,而上述设置是最安全的选项,可以最好地防止跨站点请求伪造。
  • 它还提供了更方便的开发人员体验。Cookie规则在HTTP和HTTPS上的行为相同,因此开发人员不会感到困惑。

如果您感兴趣,RFC6265规范解释了更多关于相同站点行为的内容。

相关问题