由于缺少状态参数，身份验证响应被拒绝

Question

我决定在 asp.net core 2.1 中使用 steam 登录， 我使用 AspNet.Security.OpenId.Steam nuget 包进行连接 ，当调用 sigin 方法时，客户端页面重定向到 steam 并在登录后使用 steam 回调到我的服务器，但未验证请求并被拒绝...

1-in Startup.cs

public void Configure(IApplicationBuilder app, IHostingEnvironment env,IConfiguration configuration,ApplicationDbContext applicationDbContext,ApplicationDbContextBase applicationDbContextBase)
{

            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
                app.UseDatabaseErrorPage();
            }
            else
            {
                app.UseHsts();
            }


            app.UseDeveloperExceptionPage();
            app.UseDatabaseErrorPage();


            app.UseCors(option => option.AllowAnyHeader().AllowAnyMethod().AllowAnyOrigin());
            app.UseStaticFiles();
            app.UseAuthentication();
            app.UseHttpsRedirection();


            AppHttpContext.Configure(app.ApplicationServices.GetRequiredService<IHttpContextAccessor>());

            applicationDbContext.MigrateToLastChange();

        }

2 - 在 service.cs 中

public static IServiceCollection SetupNegatechApi(this IServiceCollection services, IConfiguration configuration)
        {
            //TODO: add services here...

            services.AddMvc()

                .AddJsonOptions(options =>
                {
                    options.SerializerSettings.ContractResolver =
                        new CamelCasePropertyNamesContractResolver();
                    options.SerializerSettings.ReferenceLoopHandling = ReferenceLoopHandling.Ignore;
                });

            //Assign User & Role Model And DbContext To Identity
            services.AddIdentity<ApplicationIdentityUser, ApplicationIdentityRole>().AddDefaultTokenProviders().AddEntityFrameworkStores<ApplicationDbContextBase>();


            //Get Auth Key & Convert To Byte;
            var AuthInfo = configuration.GetSection("Auth").Get<AppSettings>();
            var SSKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(AuthInfo.SecurityKey));


            //Config Identity Password & JWT Config
            services.Configure<IdentityOptions>(options =>
            {
                options.Password.RequiredLength = 6;
                options.Password.RequireNonAlphanumeric = false;
                options.Password.RequireUppercase = false;
                options.Password.RequireLowercase = false;
                options.Password.RequireDigit = false;

            })
            .AddAuthentication(option =>
            {
                option.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                option.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
            })
            .AddJwtBearer(option =>
            {
                option.RequireHttpsMetadata = false;
                option.SaveToken = true;


                option.TokenValidationParameters = new TokenValidationParameters
                {
                    ValidateIssuer = true,
                    ValidateAudience = true,
                    ValidateLifetime = true,
                    ValidateIssuerSigningKey = true,
                    ValidIssuer = AuthInfo.Issuer,
                    ValidAudience = AuthInfo.Audienc,
                    IssuerSigningKey = SSKey,
                    ClockSkew = TimeSpan.Zero
                };
            })
            .AddCookie()
            .AddSteam(op =>
            {
                configuration.Bind(op);
                op.ClaimsIssuer = AuthInfo.Issuer;
                op.SaveTokens = true;
                op.CallbackPath = "/api/Steam/SteamCallBack";
                op.RequireHttpsMetadata = false;
            });

            services.Configure<IISOptions>(op => op.AutomaticAuthentication = false);


            //Register Configuration For Dependncy Injection
            services.AddSingleton<IConfiguration>(configuration);

            services.AddSingleton<IFileProvider>(new PhysicalFileProvider(Path.Combine(Directory.GetCurrentDirectory(), "wwwroot/$gallery")));

            return services;
        }

三合一控制器

    [ApiController]
    [ApiExplorerSettings(GroupName = "public")]
    [Route("api/[controller]/[action]")]
    public class SteamController : BaseController
    {

        [HttpPost]
        public async Task<IActionResult> Signin()
        {
            var auth = new AuthenticationProperties { RedirectUri = "/api/Steam/SteamCallBack" };
            return Challenge(auth,"Steam" );
        }

        [HttpGet]
        public IActionResult SteamCallBack(string state,openid openid)
        {
            //breack point
            return Redirect("http://localhost:3000/profile?id=" + "test");
        }

    }


    public class openid
    {
        public string claimed_id { get; set; }
        public string identity { get; set; }
        public string return_to { get; set; }
        public string response_nonce { get; set; }
        public string assoc_handle { get; set; }
        public string signed { get; set; }
        public string sig { get; set; }
    }

4 英寸 html 文件

<form id="steam_form" action="https://localhost:44315/api/Steam/Signin" method="post">
   //Submit Login form to api server
  <button type="submit"> Login</button>
</form>

5-回调http://s8.picofile.com/file/8365103326/Untitled.png后结果错误

Answer 1

我不知道为什么，但AddSteam 选项高于 OpenID 规则。 如果您仔细观察，您会发现 Steams OpenId 只是名称和一些随机标准。 检查您的表单，将端点更改为your.address/signin 并发布表单：

<form id="steamAuth" action="https://localhost:44315/signin" method="post">
  <input type='hidden' name='Provider' value='Steam'>
  <input type = 'hidden' name='ReturnUrl' value='your.address/returnurl'></form>
  <button type="submit"> Login</button>
</form>

我不确定，但我认为.AddSteam() 选项不包括服务配置中添加的任何设置。

如果您查看repo of this library，您可以看到示例，这里只是AddSteam()，当其他提供者被描述时：

services.AddAuthentication(options => { /* Authentication options */ })
            .AddSteam()
            .AddOpenId("StackExchange", "StackExchange", options =>
            {
                options.Authority = new Uri("https://openid.stackexchange.com/");
                options.CallbackPath = "/signin-stackexchange";
            });