我的应用程序使用cookie和承载身份验证:
var membershipService = configuration.GetValue<string>("MembershipService:BaseUri");
services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
.AddCookie()
.AddJwtBearer(opt =>
{
opt.Audience = "gateway";
opt.Authority = membershipService;
opt.RequireHttpsMetadata = false;
opt.SaveToken = true;
opt.Events = new JwtBearerEvents()
{
OnTokenValidated = (context) =>
{
var accessToken = context.SecurityToken as JwtSecurityToken;
if (accessToken != null)
{
ClaimsIdentity identity = context.Principal.Identity as ClaimsIdentity;
if (identity != null)
{
identity.AddClaim(new Claim("access_token", accessToken.RawData));
}
}
return Task.CompletedTask;
}
};
});
Run Code Online (Sandbox Code Playgroud)
当我发送access_token标题时,一切正常.
但是如果我在第二个请求(第一个带有授权头)的头中没有令牌发送,似乎User对先前的身份验证一无所知.即使我这样做HttpContext.SignInAsync("Cookies", User),下一个请求,例如在按下F5之后,也没有用户进行身份验证.
我错过了什么?