错误请求仅在远程计算机上使用IE 11返回,用于传递凭据的XHR

Question

我一直在试图弄清楚在将XHR制作成需要Windows身份验证的MS Web API时我缺少的部分.

此请求适用于Chrome和IE 11以及远程控制台(不是服务器)上的Chrome.问题是远程盒子上的IE 11.

根据开发工具,IE提出了3个请求.前两个请求通过授权:Negotiate标头并返回401s(CORS的预检？).但是,第三个返回400.它似乎无法以我不理解的方式进行身份验证,特别是因为其他浏览器和本地测试工作.

API是一个自托管的OWIN控制台应用程序.这是创业公司:

public void Configuration(IAppBuilder appBuilder)
{
    appBuilder.UseCors(CorsOptions.AllowAll);

    var listener = (HttpListener)appBuilder.Properties["System.Net.HttpListener"];

    if (listener != null)
    {
        listener.AuthenticationSchemeSelectorDelegate = request =>
        {
            if (string.Compare(request.HttpMethod, "OPTIONS", StringComparison.OrdinalIgnoreCase) == 0)
            {
                return AuthenticationSchemes.Anonymous;
            }
            else
            {
                return AuthenticationSchemes.IntegratedWindowsAuthentication;
            }
        };
    }

    var config = new HttpConfiguration();
    config.Routes.MapHttpRoute("DefaultApi", "api/{controller}/{action}/{id}", new { id = RouteParameter.Optional });
    appBuilder.UseWebApi(config);
}

这是客户端XHR调用:

var request = new XMLHttpRequest();
request.open('GET', 'http://xxxx:9000/api/test/something', true);
request.timeout = 10000;
request.withCredentials = true;
request.onload = function() {
    if (request.status >= 200 && request.status < 400) {
        console.log('done');
    } else {
        console.error('error');
    }
};

request.onerror = function() {
    // There was a connection error of some sort
};

request.send();

和API控制器:

[Authorize]
[RoutePrefix("api/test")]
public class TestController : ApiController
{
    [HttpGet]
    [ActionName("something")]
    public IHttpActionResult Something()
    {
        return Ok();
    }
}

2返回401的请求和返回400的请求:

First 401:

   Request URL: http://xxxx:9000/xxxx
   Request Method: GET
   Status Code: 401 / Unauthorized

Request Headers
   Accept: */*
   Accept-Encoding: gzip, deflate
   Accept-Language: en-US
   Authorization: Negotiate [token]
   Connection: Keep-Alive
   Host: xxxx:9000
   Referer: http://xxxx/xxxx.html
   User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3)

Response Headers

   Content-Length: 0
   Date: Fri, 22 Dec 2017 14:03:09 GMT
   Server: Microsoft-HTTPAPI/2.0
   WWW-Authenticate: Negotiate [token]

-------------
Second 401

   Request URL: http://xxxx:9000/xxxx
   Request Method: GET
   Status Code: 401 / Unauthorized

Request Headers

   Accept: */*
   Accept-Encoding: gzip, deflate
   Accept-Language: en-US
   Authorization: Negotiate [token]
   Connection: Keep-Alive
   Host: xxxx:9000
   Referer: http://xxxx/xxxx.html
   User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3)

Response Headers

   Content-Length: 0
   Date: Fri, 22 Dec 2017 14:03:09 GMT
   Server: Microsoft-HTTPAPI/2.0
   WWW-Authenticate: Negotiate [token]

-----------
400

   Request URL: http://xxxx:9000/xxxx
   Request Method: GET
   Status Code: 400 / Bad Request

Request Headers

   Accept: */*
   Accept-Encoding: gzip, deflate
   Accept-Language: en-US
   Authorization: Negotiate [token]
   Connection: Keep-Alive
   Host: xxxx:9000
   Referer: http://xxxx/xxxx.html
   User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; InfoPath.3)

Response Headers

   Content-Length: 0
   Date: Fri, 22 Dec 2017 14:03:12 GMT
   Server: Microsoft-HTTPAPI/2.0

Answer 1

值得信赖的网站

我的猜测是，远程计算机受到域策略的限制，并且您的站点在该计算机上不被视为受信任的站点。

将您的网站添加（或要求添加，如果 IT 设置策略）适当的安全区域（本地 Intranet 或受信任的站点），问题应该得到解决。

文档模式

当您这样做时，还要看看他们是否正在推送任何旧的文档模式以供 IE11 运行）。

为 WebAPI 启用 CORS

我看到您已经调用UseCors了 OWIN's IAppBuilder，但您还可以尝试在实例上启用 CORS HttpConfiguration：

config.EnableCors(new EnableCorsAttribute("*", "*", "GET, POST, OPTIONS, PUT, DELETE"));