.NET Core 2.0授权筛选器导致内部错误-Java 学习之路

授权筛选器将导致.NET Core 2.0 Web应用程序出现内部错误 . 重现问题的步骤非常简单：使用“无身份验证”创建新的.NET Core 2.0 MVC项目，在控制器方法上放置授权过滤器，访问相应的URL并返回“500 Internal Server Error” .

[Authorize]
public IActionResult Contact()
{
    ViewData["Message"] = "Your contact page.";

    return View();
}

.NET Core 1.1中的类似代码将正确返回响应“401 Unauthorized” .

我在这个问题上发布了一个类似的问题：Custom cookie authentication not working after migration from ASP.NET Core 1.1 MVC to 2.0而我仍然不明白问题比我在特定情况下要宽得多 .

例外：

System.InvalidOperationException: No authenticationScheme was specified, and there was no DefaultChallengeScheme found.
   at Microsoft.AspNetCore.Authentication.AuthenticationService.<ChallengeAsync>d__11.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.AspNetCore.Mvc.ChallengeResult.<ExecuteResultAsync>d__14.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.<InvokeResultAsync>d__19.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.<InvokeFilterPipelineAsync>d__17.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.AspNetCore.Mvc.Internal.ResourceInvoker.<InvokeAsync>d__15.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.AspNetCore.Builder.RouterMiddleware.<Invoke>d__4.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware.<Invoke>d__7.MoveNext()

1 回答

1
HTTP 401未授权响应should contain WWW-Authenticate 标头，用于定义访问资源的身份验证方法 .

在未经身份验证的情况下创建的项目中，没有任何默认身份验证方案集 . 这就是身份验证中间件无法构建有效的401响应并选择发送500错误的原因 .

修复非常简单 . 添加任何认证处理程序并设置默认认证方案，例如：
```
public void ConfigureServices(IServiceCollection services)
{
    services.AddMvc();

    services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme).AddJwtBearer();
}
```
使用这样的配置，未经授权的请求将导致401响应并正确设置 WWW-Authenticate 标头：
回复于 2024-04-27T22:41:23+08:00

.NET Core 2.0授权筛选器导致内部错误

1 回答

相关问题