使用 ASP.NET 核心 RC2 404 而不是 403 的承载身份验证

Question

我正在尝试将 Bearer Authentication 与 ASP.NET Core RC2 一起使用。它与用户 authenticad 一起工作并具有角色，但是当用户未被授权时（authenticad 但没有角色）我收到 404 错误而不是预期的 403。

Startup.cs

    public void ConfigureServices(IServiceCollection services)
    {

        services.AddCors(options =>
        {
            options.AddPolicy("CorsPolicy",
                builder =>
                {
                    builder
                        .WithOrigins("*")
                        .AllowAnyHeader()
                        .AllowAnyMethod()
                        .AllowCredentials();
                }
            );
        });

        services.AddIdentity<AppUser, AppRole>().AddEntityFrameworkStores<AppIdentityDbContext, int>();

        services.AddAuthorization();

        services.AddMvc(config => {
            var policy = new AuthorizationPolicyBuilder()
                .AddAuthenticationSchemes(JwtBearerDefaults.AuthenticationScheme)
                .RequireAuthenticatedUser()
                .Build();
            config.Filters.Add(new AuthorizeFilter(policy));
        }).AddJsonOptions(options => 
            options.SerializerSettings.ContractResolver = new CamelCasePropertyNamesContractResolver()
        );
    }

    // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
    public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
    {
        loggerFactory.AddConsole(Configuration.GetSection("Logging"));
        loggerFactory.AddDebug();

        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
            app.UseDatabaseErrorPage();
            app.UseBrowserLink();
        }
        else
        {
            app.UseExceptionHandler("/home/error");
        }

        app.UseStaticFiles();


        var signingKey = GetSigningKey();

        app.UseJwtBearerAuthentication(new JwtBearerOptions()
        {
            AuthenticationScheme = JwtBearerDefaults.AuthenticationScheme,
            AutomaticAuthenticate = true,
            AutomaticChallenge = true,
            TokenValidationParameters = new TokenValidationParameters()
            {
                IssuerSigningKey = signingKey,
                ValidateIssuerSigningKey = true,
                ValidateLifetime = true,
                ValidAudience = "MyAudience",
                ValidIssuer = "MyIssuer"
            }
        });

        app.UseCors(config =>
        {
            config.AllowCredentials();
            config.AllowAnyOrigin();
            config.AllowAnyHeader();
            config.AllowAnyMethod();
        });

        app.UseIdentity();

        app.UseMvc(routes =>
        {
            routes.MapRoute(
                name: "default",
                template: "{controller=Home}/{action=Index}/{id?}");
        });
    }

    public static SecurityKey GetSigningKey()
    {
        var plainTextSecurityKey = "This is my shared, not so secret, secret!";
        return new SymmetricSecurityKey(Encoding.UTF8.GetBytes(plainTextSecurityKey));
    }

Answer 1

使用 app.UseIdentity() 会将 CookieAuthentication 添加到您的应用程序，因此所有未经身份验证的请求都将重定向到 /Account/Login。

可能你没有添加任何路由来处理这个所以它给了你一个 404。

来源：https://github.com/aspnet/Identity/blob/dev/src/Microsoft.AspNetCore.Identity/BuilderExtensions.cs

Answer 2

请检查位置 app.UseIdentity() 以及 MVC 路由 app.UseMvc()。验证码应位于 app.useIdenetity() 下方和 Mvc 路由上方。像这样：app.UseApplicationInsightsExceptionTelemetry();

        app.UseStaticFiles();
        app.UseIdentity();


        app.UseCors(builder =>
           builder.AllowAnyOrigin()
           .AllowAnyHeader()
           .AllowAnyMethod()
           );



        app.UseSwagger();
        app.UseSwaggerUi();

        ConfigureAuth(app);

        app.UseMvc(routes =>
        {
            routes.MapRoute(
                name: "default",
                template: "index");
        });

使用 ASP.NET 核心 RC2 404 而不是 403 的承载身份验证

Bearer Authentication with ASP.NET Core RC2 404 instead of 403

authentication

asp.net-web-api

asp.net-core

.net-core-rc2