MVC 身份 cookie 跨子域进行身份验证

Posted 2023-03-27

【中文标题】MVC 身份 cookie 跨子域进行身份验证

【英文标题】：MVC Identity cookie is authenticated across subdomains

【发布时间】：2019-02-25 12:50:14

【问题描述】：

所以在我的谷歌搜索中，我遇到了很多人在努力启用跨域支持 fir Identity。但是不知何故，我将此作为标准。 应用程序设置是我们有一个域，每个客户都有一个子域。我们为每位客户上传一个新的网络应用程序。

问题似乎是，如果我在xxx.foo.com登录，我也在yyy.foo.com登录。

我似乎找不到任何关于关闭此功能的信息。 与标准模板相比，身份设置没有太大变化。 下面是 Startup.Auth.cs 代码：

public void ConfigureAuth(IAppBuilder app)

    // Configure the db context, user manager and signin manager to use a single instance per request
    app.CreatePerOwinContext(DataContext.Create);
    app.CreatePerOwinContext<UserManager>(UserManager.Create);
    app.CreatePerOwinContext<ApplicationSignInManager>(ApplicationSignInManager.Create);
    app.CreatePerOwinContext<ApplicationRoleManager>(ApplicationRoleManager.Create);

    // Enable the application to use a cookie to store information for the signed in user
    // and to use a cookie to temporarily store information about a user logging in with a third party login provider
    // Configure the sign in cookie
    app.UseCookieAuthentication(new CookieAuthenticationOptions
    
        AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
        //LoginPath = new PathString("/Account/BadRights"),
        LoginPath = new PathString("/Account/Login"),
        Provider = new CookieAuthenticationProvider
        
            // Enables the application to validate the security stamp when the user logs in.
            // This is a security feature which is used when you change a password or add an external login to your account.  
            OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<UserManager, User>(
                validateInterval: TimeSpan.FromMinutes(10),
                regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager))
        ,
    );            
    app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);

    // Enables the application to temporarily store user information when they are verifying the second factor in the two-factor authentication process.
    app.UseTwoFactorSignInCookie(DefaultAuthenticationTypes.TwoFactorCookie, TimeSpan.FromMinutes(5));

    // Enables the application to remember the second login verification factor such as phone or email.
    // Once you check this option, your second step of verification during the login process will be remembered on the device where you logged in from.
    // This is similar to the RememberMe option when you log in.
    app.UseTwoFactorRememberBrowserCookie(DefaultAuthenticationTypes.TwoFactorRememberBrowserCookie);

非常感谢任何关于我应该寻找的帮助或提示。

【参考方案1】：

您必须构建身份服务器才能使用SSO 登录。

你可以找到详情here

【讨论】：

这似乎是针对 .net 核心还是我遗漏了什么？

@Chimera 问题很相似，看懂了怎么办。