匿名端点重定向到安全 ASP.Net Core Web 应用程序中的登录屏幕

Posted 2023-04-12

【中文标题】匿名端点重定向到安全 ASP.Net Core Web 应用程序中的登录屏幕

【英文标题】：Anonymous endpoint redirects to login screen in secured ASP.Net Core web application

【发布时间】：2022-01-05 08:51:36

【问题描述】：

我有一个最近迁移到 .Net 6.0 的 ASP.Net（Blazor 服务器端）5 Web 应用程序。它有几个私有端点，我们需要添加一个新的公共端点。如果我们浏览到新的公共终结点，系统会将我们重定向到 Azure AD B2C 登录屏幕。我的理解是，在端点方法上添加[AllowAnonymous] 属性应该会覆盖启动配置。

我错过了什么？

Startup.cs：

public virtual void ConfigureServices(IServiceCollection services)
    
      services.AddHttpContextAccessor();
      services.AddHttpClient();
      services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
          .AddMicrosoftIdentityWebApp(configuration.GetSection("AzureAdB2C"));
      services.AddAuthorization();
      services.AddControllersWithViews();
      //Required as MVC must know whether it can rely on the authorization and CORS Middleware during initialization.
      services.AddMvc(options => options.EnableEndpointRouting = false)
          .SetCompatibilityVersion(CompatibilityVersion.Version_3_0);
      #endregion

      services.AddScoped<GlobalsService>();
      services.Configure<AzureADB2C>(configuration.GetSection("AzureADB2C"));
    

public virtual void Configure(IApplicationBuilder app, IWebHostEnvironment env,
        DataProtectionKeysContext dataProtectionKeysContext)
    
      if (env.IsDevelopment())
      
..........................
      
      else
      
        app.Use((ctx, next) =>
        
          return next();
        );
      
      app.UseHttpsRedirection();
      app.UseCookiePolicy();      
      app.UseRouting();
      app.UseAuthentication();
      app.UseAuthorization();      
      app.UseMvcWithDefaultRoute();//Required as MVC must know whether it can rely on the authorization and CORS Middleware during initialization.
      app.UseEndpoints(endpoints =>
      
        endpoints.MapControllerRoute(
                name: "default",
                pattern: "controller=Home/action=Index/id?");
        endpoints.MapControllers();
        endpoints.MapBlazorHub();
        endpoints.MapFallbackToPage("/_Host");
      );
    
  

通过 http://localhost:44300/api/GeneratePDF/get:

访问的公共 api 端点

    [ApiController]
      [Route("api/[controller]")]
      [Authorize]
      public partial class GeneratePdfController : ControllerBase
      
        public GeneratePdfController()
        
        
        [HttpGet(Name = "Get")]
        [AllowAnonymous]
        public async Task<IActionResult> Get()
        
return Ok();
    
    

【问题讨论】：

问题是什么？你在尝试什么，你有什么错误？

我的问题是，当我在浏览器中浏览到端点localhost:44300/api/GeneratePdf/Get url 时，它会将我导航到（Azure AD B2C）登录屏幕，而不是返回 400 http 状态响应。跨度>

【参考方案1】：

你有错误的路由属性，试试这个

         [AllowAnonymous]
        [HttpGet("~/api/GeneratePDF/get")]
         public async Task<IActionResult> Get()

或更改您的控制器路由

      [Route("~/api/[controller]/[action]")]
      public partial class GeneratePdfController : ControllerBase