带有Windows身份验证角度应用程序的.Net核心出现错误

Question

我在 web api .net5 (.net core) 中编写了一个服务，我使用 windows authentication=true 因为我需要当前用户的详细信息。 但当 “windows身份验证”：真， “匿名身份验证”：假， 我的 Angular 应用程序无法访问该服务并返回未经授权的错误： 401 Unauthorized 选项和控制台：

Access to XMLHttpRequest at 'https://localhost:44343/api/smooss' from origin 'http://localhost:4200' has been blocked by CORS

当我设置“anonymousAuthentication”时：true 它确实有效，但我没有用户的详细信息

我的代码如下所示：

客户：

 public CheckISAuthorized() {
    
    const  requestOptions = {
      headers: new HttpHeaders({
       'Authorization': "my-request-token",
      'Access-Control-Allow-Origin': '*',
      'Content-Type': 'application/json'
      })
     };
      
        return this.http.get(`${baseUrl}smooss`,requestOptions );
      }}
    

i have interceptor that adds withCredentials=true:

   

      intercept(request: HttpRequest<any>, next: HttpHandler): Observable<HttpEvent<any>> {
               debugger;
                request = request.clone({
                    withCredentials: true
                    
                });
        
                return next.handle(request);
            }

in server:
startup.cs:

 

    public void ConfigureServices(IServiceCollection services)
            {
                services.AddDbContextPool<SMOOSSContext>(options => options.UseSqlServer(Configuration.GetConnectionString("SmoosDB")));
              
                services.AddControllers();
                services.AddScoped<ISmooseRepository, SmoosRepository>();
                services.AddAuthentication(IISDefaults.AuthenticationScheme);
                services.AddCors(o => o.AddPolicy("MyPolicy", builder =>
                {
                    builder.WithOrigins("http://localhost:4200")
                           .AllowAnyMethod()
                           .AllowAnyHeader()
                            .AllowCredentials();
                }));
    
               
                services.AddSwaggerGen(c =>
                {
                    c.SwaggerDoc("v1", new OpenApiInfo { Title = "Smoos", Version = "v1" });
                });
                services.AddSingleton<IAuthorizationHandler, AppSmoossRequirement>();
                services.AddAuthorization(options =>
                {
                    options.AddPolicy("AppSmooss", policy => policy.Requirements.Add(new AppSmoossRequirement()));
                });
                services.AddSingleton<IHttpContextAccessor, HttpContextAccessor>();
               
            }
    
     public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
            {
                if (env.IsDevelopment())
                {
                    app.UseDeveloperExceptionPage();
                    app.UseSwagger();
                    app.UseSwaggerUI(c => c.SwaggerEndpoint("/swagger/v1/swagger.json", "Smoos v1"));
                }
                
                app.UseRouting();
                app.UseAuthentication();
                app.UseCors("MyPolicy");
                app.UseHttpsRedirection();
                app.UseAuthorization();
               
              }

in controller:

   

     [EnableCors("MyPolicy")]
            [Authorize(Policy = "AppSmooss")]
            [Route("api/smooss")]
            [ApiController]
            public class SmoossApi : ControllerBase

this is the method:

   

      [HttpGet]
                public async Task<List<Smooss>> Get()
                {
        
                    return await SmoosRepository.GetFlights();
                }

Answer 1

所以最后我找到了解决方案 Rena 对这篇文章的评论： github.com/aspnet/CORS/issues/60 问题是来自浏览器的选项调用没有与凭据一起发送，这就是它未经授权的原因。 解决方案是添加一个中间件来处理选项请求 并允许 Windows 和匿名身份验证，以便选项请求成功

中间件：

 public async Task Invoke(HttpContext context)
    {
        if (context.Request.Method != "OPTIONS" && 
       !context.User.Identity.IsAuthenticated)
        {
            context.Response.StatusCode = 401;
            return; //Stop pipeline and return immediately.
        }
        await _next(context);
    }

在launchSettings.json 中：

"iisSettings": {
"windowsAuthentication": true,
"anonymousAuthentication": true ,

我还必须删除客户端的授权标头：

      const  requestOptions = {
      headers: new HttpHeaders({
//this line  is not needed
      // 'Authorization': "my-request-token",
      'Access-Control-Allow-Origin': '*',
      'Content-Type': 'application/json'
      })
      };