我正在向一个遗留的ASP.NET 4应用程序添加一个Angular应用程序和Web (编辑:Core2.0)。遗留应用程序使用窗体身份验证,这一点我无法更改。我希望Web API检测到用户已经登录,并设置声明等(或替代方案)来授权后续的Web API请求。
我试图读取Web API中的身份验证cookie,但无法解密它,我相信是因为ASP.NET Core2.0不理解ASP.NET 4 cookie加密。我已经尝试了机器密钥等的web配置设置,但没有成功。我在这里有什么选择?
发布于 2017-08-29 22:15:56
配置您的ASP.NET网站:
app.UseCookieAuthentication(new CookieAuthenticationOptions
{
AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
CookieName = ".AspNetCore.ApplicationCookie",
TicketDataFormat = new AspNetTicketDataFormat(
new DataProtectorShim(
DataProtectionProvider.Create(new DirectoryInfo(@"c:\shared-auth-ticket-keys\"))
.CreateProtector("Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationMiddleware", "Cookies", "v2"))),
CookieManager = new ChunkingCookieManager(),
LoginPath = new PathString("/Account/Login"),
Provider = new CookieAuthenticationProvider
{
OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
validateInterval: TimeSpan.FromMinutes(30),
regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager))
}
});然后您的核心2应用程序,它们应该使用相同的文件夹来共享身份验证票证和相同的身份验证方法:
public void ConfigureServices(IServiceCollection services)
{
services.AddCookieAuthentication(options => {
options.AuthenticationScheme = "Cookie",
options.LoginPath = "/Account/Login";
options.CookieName = ".AspNet.SharedCookie";
options.AutomaticAuthenticate = true;
options.AutomaticChallenge = true;
options.TicketDataFormat = ew AspNetTicketDataFormat(
new DataProtectorShim(
DataProtectionProvider.Create(new DirectoryInfo(@"c:\shared-auth-ticket-keys\"))
.CreateProtector("Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationMiddleware",
"Cookies", "v2")))
});
}
public void Configure(IApplicationBuilder app)
{
app.UseAuthentication();
}文档:https://docs.microsoft.com/en-us/aspnet/core/security/authentication/cookie?tabs=aspnetcore2x
https://stackoverflow.com/questions/45940907
复制相似问题