Internet Explorer 11替换了Authorization标头

Question

什么会导致Internet Explorer替换HTTP标头

Authorization : Bearer <server-provided-token>

同

Authorization : Negotiate <some token>

在发出AJAX请求时？

细节

在Internet Explorer中,Authorization: Bearer ...Internet Explorer使用标头发送一些配置为包含标头的AJAX请求Authorization: Negotiate ....

例如,Fiddler显示三个请求中的前两个包含Authorization : Bearer...标题,而第三个请求突然包含Authorization : Negotiate...标题.前两个请求成功,第三个请求失败,因为无法正确验证请求.

所有请求都是使用相同的客户端代码构建的,并且是一个接一个地进行的(在一秒的范围内).我已经验证了Authorization标头Bearer在所有三种情况下都正确包含令牌,直到请求提供给浏览器为止.

另外,我在Chrome中看不到相同的行为; 它只发生在IE中.

要求1

GET http://localhost/myapp/api/User HTTP/1.1
Accept: application/json, text/plain, */*
Authorization: Bearer oEXS5IBu9huepzW6jfh-POMA18AUA8yWZsPfBPZuFf_JJxq-DKIt0JDyPXSiGpmV_cpT8FlL3D1DN-Tv5ZbT73MTuBOd5y75-bsx9fZvOeJgg04JcO0cUajdCH2h5QlMP8TNwgTpHg-TR9FxyPk3Kw6bQ6tQCOkOwIG_FmEJpP89yrOsoYJoCfrAoZ7M4PVcik9F9qtPgXmWwXB2eHDtkls44wITF_yM_rPm5C47OPCvMVTPz30KwoEPi6fHUcL3qHauP-v9uypv2e48TyPHUwLYmNFxyafMhBx4TkovnRcsdLHZiHmSjMq0V9a2Vw70
Referer: http://localhost/client/login.html
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: localhost
DNT: 1
Connection: Keep-Alive

要求2

POST http://localhost/myapp/api/Permissions HTTP/1.1
Referer: http://localhost/client/#/Dashboard
Content-Type: application/json
Authorization: Bearer oEXS5IBu9huepzW6jfh-POMA18AUA8yWZsPfBPZuFf_JJxq-DKIt0JDyPXSiGpmV_cpT8FlL3D1DN-Tv5ZbT73MTuBOd5y75-bsx9fZvOeJgg04JcO0cUajdCH2h5QlMP8TNwgTpHg-TR9FxyPk3Kw6bQ6tQCOkOwIG_FmEJpP89yrOsoYJoCfrAoZ7M4PVcik9F9qtPgXmWwXB2eHDtkls44wITF_yM_rPm5C47OPCvMVTPz30KwoEPi6fHUcL3qHauP-v9uypv2e48TyPHUwLYmNFxyafMhBx4TkovnRcsdLHZiHmSjMq0V9a2Vw70
Accept: application/json, text/plain, */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: localhost
Content-Length: 1419
DNT: 1
Connection: Keep-Alive
Pragma: no-cache

<Post Data Removed>

要求3

GET http://localhost/myapp/api/UserPreferences/Dashboard HTTP/1.1
Referer: http://localhost/client/#/Dashboard
Content-Type: application/json
Authorization: Negotiate YHsGBisGAQUFAqBxMG+gMDAuBgorBgEEAYI3AgIKBgkqhkiC9xIBAgIGCSqGSIb3EgECAgYKKwYBBAGCNwICHqI7BDlOVExNU1NQAAEAAACXsgjiBgAGADMAAAALAAsAKAAAAAYBsR0AAAAPVk1ERVZFTlYtU1JTQ0VSSVM=
Accept: application/json, text/plain, */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Connection: Keep-Alive
DNT: 1
Host: localhost

请求是通过AngularJS $http服务进行的,后端是IIS中托管的ASP.NET Web API.

Answer 1

我们遇到了Internet Explorer缓存凭据的问题.我们可以使用以下脚本解决问题:

document.execCommand('ClearAuthenticationCache', 'false');

见:维基百科

Answer 2

我也遇到过这个问题.

奇怪的是,它在我的开发机器上运行良好,就在我部署它时问题出现了.它再次在Chrome,Firefox等中运行良好.

事实证明,问题是IE检测到该站点位于localintranet区域,因此尝试自动尝试登录(它是由组策略设置的 - 这是一个内部应用程序).

我的解决方法是(幸运的是)它只是在使用不是FQDN的服务器名称(例如myserver)时才自动检测本地Intranet区域 - 而是使用完整的A

Answer 3

我在knockoutjs应用程序中遇到了同样的问题,它在Chrome和Firefox中运行良好但在IE中却没有.

我还使用了Fiddler并注意到第一个ajax调用使用了Bearer,并成功返回.但随后IE开始循环,并通过谈判授权一遍又一遍地发送随后的ajax调用!

在我的情况下,这是IE中的某种计时问题,我通过在渲染同步期间进行加载数据的ajax调用来解决它.

    me.loadLimits = function () {
      $.ajax({
        type: 'GET',
        dataType: 'json',
        contentType: 'application/json',
        url: '/api/workrate/limits',
        headers: me.headers,
        async: false,
        success: function (result) {
    ...