.Net Core 2.0 REST API w/Windows Auth - Preflight 响应 401 Unauthorized

Question

我正在使用 .NET Core 2.0 和 Angular 4 在本地创建网页。我能够让我的前端成功提交 GET 请求，但不能提交 POST。我已经尝试了所有启用 CORS 和 Windows 身份验证的方法，但我总是收到未经授权的错误。我在这里错过了什么才能通过飞行前？我假设它与 Windows 身份验证有关，但我发现的所有内容都只是说我需要 'withCredentials:true' 标头选项。

角度服务

const httpOptions = {
  headers: new HttpHeaders({
    'Content-Type':  'application/json'
  }),
  withCredentials: true
};

@Injectable()
export class TestService {

  constructor(private http: HttpClient) { }

  private baseURL = 'http://localhost:58214/api/{insert_app_name_here}';

  getAllRules() {
    console.log('Getting rules');
    return this.http.get<RuleItem>(this.baseURL).subscribe(res => {
      console.log(res);
    });
  }

  createNewRule(ri: RuleItem) {
    return this.http.post<RuleItem>(this.baseURL, JSON.stringify(ri), httpOptions).subscribe(res => {
      console.log(res);
    }, err => {
      console.log('Error occurred: ', err);
    });
  }

}

.NET CORE 2.0 控制器

// [EnableCors("SitePolicy")]
 [Route("api/[controller]")]
    public class TestController : Controller
    {

        private readonly RuleContext _context;

        public TestController(RuleContext context)
        {
            _context = context;

        }

        [HttpGet]
        public IEnumerable<RuleItem> GetAll()
        {
            return _context.RuleItems.ToList();
        }

        [HttpGet("{id}", Name = "GetRule")]
        public IActionResult GetById(long id)
        {
            var item = _context.RuleItems.FirstOrDefault(r => r.Id == id);
            if (item == null)
            {
                return NotFound();
            }
            return new ObjectResult(item);
        }

        [HttpPost]
        public IActionResult Create(RuleItem item)
        {

            if (item == null)
            {
                return BadRequest();
            }

            _context.RuleItems.Add(item);
            _context.SaveChanges();

            return CreatedAtRoute("GetTodo", new { id = item.Id }, item);
        }

    }

Startup.cs

 public Startup(IConfiguration configuration)
        {
            Configuration = configuration;
        }

        public IConfiguration Configuration { get; }

        // This method gets called by the runtime. Use this method to add services to the container.
        public void ConfigureServices(IServiceCollection services)
        {

            /*
            services.AddCors(options =>
            {
                options.AddPolicy("SitePolicy", builder =>
                {
                    builder.AllowAnyOrigin()
                            .AllowAnyOrigin()
                            .AllowAnyMethod()
                            .AllowCredentials();
                });
            });

            services.AddAuthentication(IISDefaults.AuthenticationScheme);*/

            services.AddMvc();

            var connection = @"Server=servername;Database=dbname;Trusted_Connection=true;MultipleActiveResultSets=True;";
            services.AddDbContext<RuleContext>(options => options.UseSqlServer(connection));
        }

        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IHostingEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }

            // app.UseCors("SitePolicy");

            app.UseMvc();
        }
    }

web.config 如果我以编程方式添加了 CORS，不确定是否需要这个，但这是成功摆脱“没有允许来源标头存在”错误的唯一解决方案

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <system.webServer>
    <httpProtocol>
      <customHeaders>
        <add name="Access-Control-Allow-Origin" value="http://localhost:4200" />
        <add name="Access-Control-Allow-Headers" value="Content-Type" />
        <add name="Access-Control-Allow-Methods" value="GET,POST,PUT,DELETE,OPTIONS" />
        <add name="Access-Control-Allow-Credentials" value="true" />
      </customHeaders>
    </httpProtocol>
  </system.webServer>
</configuration>

编辑 - 进行了以下更改：删除了 web.config 文件，添加了全局 CORS 规则。以下是更改：

public class Startup
{
    public Startup(IConfiguration configuration)
    {
        Configuration = configuration;
    }

    public IConfiguration Configuration { get; }

    // This method gets called by the runtime. Use this method to add services to the container.
    public void ConfigureServices(IServiceCollection services)
    {


        services.AddCors();

        //services.AddAuthentication(IISDefaults.AuthenticationScheme);

        services.AddMvc();

        var connection = @"Server=server;Database=db;Trusted_Connection=true;MultipleActiveResultSets=True;";
        services.AddDbContext<RuleContext>(options => options.UseSqlServer(connection));
    }

    // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
    public void Configure(IApplicationBuilder app, IHostingEnvironment env)
    {
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }

        app.UseCors(builder =>
        {
            builder.AllowAnyOrigin()
                    .AllowAnyOrigin()
                    .AllowAnyMethod()
                    .AllowCredentials();
        });

        app.UseMvc();
    }
}

控制器

 [Route("api/[controller]")]
    public class TestController : Controller
    {

        private readonly RuleContext _context;

        public TestController(RuleContext context)
        {
            _context = context;

        }

        [HttpGet]
        public IEnumerable<RuleItem> GetAll()
        {
            return _context.RuleItems.ToList();
        }

        [HttpGet("{id}", Name = "GetRule")]
        public IActionResult GetById(long id)
        {
            var item = _context.RuleItems.FirstOrDefault(r => r.Id == id);
            if (item == null)
            {
                return NotFound();
            }
            return new ObjectResult(item);
        }

        [HttpPost]
        public IActionResult Create(RuleItem item)
        {

            if (item == null)
            {
                return BadRequest();
            }

            _context.RuleItems.Add(item);
            _context.SaveChanges();

            return CreatedAtRoute("GetTodo", new { id = item.Id }, item);
        }
}

这是我现在收到的错误消息的图像：401 Error

Answer 1

问题最终在于传递 Windows 令牌。未在预检请求中检查令牌，因此失败。