Cookie身份验证ASP.NET核心

Question

我可以使用MemoryCache在ITicketStore存储的AuthenticationTicket？

背景:我的网络应用程序使用Cookie身份验证:

app.UseCookieAuthentication(new CookieAuthenticationOptions
{
    AutomaticAuthenticate = true,
    AutomaticChallenge = true,
    LoginPath = new PathString("/Authentication/SignIn"),
    LogoutPath = new PathString("/Authentication/SignOut"),
    ReturnUrlParameter = "/Authentication/SignIn"
});

我的web api使用访问令牌(OAuth2)处理授权过程.

有时(在某些浏览器上)会抛出以下异常:

发生了未处理的异常:chunked cookie不完整.仅发现预期的2个块中的1个,总共4021个字符.可能已超出客户端大小限制.

cookie显然太大了.这很奇怪,因为我没有使用很多说法.所有这些都是默认声明(nameidentifier,nonce,exp等).我现在想实现我自己ITicketStore的SessionStore上CookieAuthenticationOptions.的AuthenticationTicket将被存储在一个MemoryCache(像这样在样品).我对这整个主题都很陌生,并且不确定,如果这是一个好的方法,并且它MemoryCache是一个有效的解决方案.

Answer 1

我可以使用MemoryCache在ITicketStore存储的AuthenticationTicket？

当然,这是我用了近一年的实现.

app.UseCookieAuthentication(new CookieAuthenticationOptions
{
    AuthenticationScheme = "App.Cookie",
    AutomaticAuthenticate = true,
    AutomaticChallenge = true,
    LoginPath = new PathString("/Authentication/SignIn"),
    LogoutPath = new PathString("/Authentication/SignOut"),
    ReturnUrlParameter = "/Authentication/SignIn",
    SessionStore = new MemoryCacheStore(cache)
});

在实施MemoryCacheStore这个样子的,它遵循的例子,你共享:

public class MemoryCacheStore : ITicketStore
{
    private const string KeyPrefix = "AuthSessionStore-;
    private readonly IMemoryCache _cache;

    public MemoryCacheStore(IMemoryCache cache)
    {
        _cache = cache;
    }

    public async Task<string> StoreAsync(AuthenticationTicket ticket)
    {
        var key = KeyPrefix + Guid.NewGuid();
        await RenewAsync(key, ticket);
        return key;
    }

    public Task RenewAsync(string key, AuthenticationTicket ticket)
    {
        // https://github.com/aspnet/Caching/issues/221
        // Set to "NeverRemove" to prevent undesired evictions from gen2 GC
        var options = new MemoryCacheEntryOptions
        {
            Priority = CacheItemPriority.NeverRemove
        };
        var expiresUtc = ticket.Properties.ExpiresUtc;

        if (expiresUtc.HasValue)
        {
            options.SetAbsoluteExpiration(expiresUtc.Value);
        }    

        options.SetSlidingExpiration(TimeSpan.FromMinutes(60));

        _cache.Set(key, ticket, options);

        return Task.FromResult(0);
    }

    public Task<AuthenticationTicket> RetrieveAsync(string key)
    {
        AuthenticationTicket ticket;
        _cache.TryGetValue(key, out ticket);
        return Task.FromResult(ticket);
    }

    public Task RemoveAsync(string key)
    {
        _cache.Remove(key);
        return Task.FromResult(0);
    }
}