用户声明更新在 ASP.NET 身份中没有影响？

Question

用户登录后，我需要在 web api 中更新用户声明。 但在更新用户声明后，它仍会返回以前的值。 以下代码用于在用户登录后更新活动用户组。

/// <summary>
/// The class AppUser
/// </summary>
public class AppUser : ClaimsPrincipal
{
    /// <summary>
    /// Initializes a new instance of the <see cref="AppUser"/> class.
    /// </summary>
    /// <param name="principal">The principal.</param>
    public AppUser(ClaimsPrincipal principal)
        : base(principal)
    {
    }

    /// <summary>
    /// Gets the name.
    /// </summary>
    /// <value>
    /// The name.
    /// </value>
    public string Name
    {
        get
        {
            return this.FindFirst(ClaimTypes.Name).Value;
        }
    }

    /// <summary>
    /// Gets the name of the user.
    /// </summary>
    /// <value>
    /// The name of the user.
    /// </value>
    public string UserName
    {
        get
        {
            return this.FindFirst("UserName").Value;
        }
    }

    /// <summary>
    /// Gets the active group.
    /// </summary>
    /// <value>
    /// The active group.
    /// </value>
    public string ActiveGroup
    {
        get
        {
            return ((ClaimsIdentity)this.Identity).FindFirst("ActiveGroup").Value;
        }
    }

    /// <summary>
    /// Gets the email.
    /// </summary>
    /// <value>
    /// The email.
    /// </value>
    public string Email
    {
        get
        {
            return this.FindFirst("Email").Value;
        }
    }
}


/// <summary>
/// The class BaseController
/// </summary>
public class BaseController : ApiController
{
    /// <summary>
    /// Gets the current user.
    /// </summary>
    /// <value>
    /// The current user.
    /// </value>
    public AppUser CurrentUser
    {
        get
        {
            return new AppUser(this.User as ClaimsPrincipal);
        }
    }
}



public class AccountController : BaseController
{

    [HttpPost]
    [Route("UpdateUserGroup")]
    public int UpdateUserGroup(string userGroup)
    {
        var user = User as ClaimsPrincipal;
        var identity = user.Identity as ClaimsIdentity;
        identity.RemoveClaim(identity.FindFirst("ActiveGroup"));
        identity.AddClaim(new Claim("ActiveGroup", this.GetRoleNameByPresenter(userGroup)));
        return 1;
    }
 }

Answer 1

问题在于声明用于身份验证过程，并且是身份验证令牌/cookie 的一部分。如果您想删除当前用户的声明，则需要确保客户端获得新的令牌/cookie。

如果您正在使用您的 api 运行例如不记名令牌，那么您需要生成一个新令牌并将该令牌从您的 UpdateUserGroup() 返回给客户端。客户端在下次向 api 发出请求时需要使用新令牌。