如何在ASP.NET Core中获取更多异常详情？Blazor服务端问题排查

从堆栈跟踪可明确：异常是在Cookie认证登录流程中创建Claim实例时，传入的value参数为null。调用链指向远程认证（如OAuth/OpenID Connect）回调后，系统尝试将第三方身份转换为本地Cookie身份的环节。

以下是几种具体的日志增强方案，帮你捕获空值Claim的具体来源：

1. 提升认证相关组件的日志级别 #

在appsettings.json的Serilog配置中，将认证和Claims相关的日志级别设为Debug或Verbose，直接捕获框架级的详细流程：

"Serilog": {
  "MinimumLevel": {
    "Default": "Information",
    "Override": {
      "Microsoft.AspNetCore.Authentication": "Debug",
      "System.Security.Claims": "Debug"
    }
  }
}

这会输出认证过程中所有Claim的生成、传递细节，能快速定位哪个环节出现了空值。

2. 自定义Claims转换中间件，主动检查空值 #

实现IClaimsTransformation，在Claims流转过程中逐个检查并记录空值Claim：

public class ClaimValidationLogger : IClaimsTransformation
{
    private readonly ILogger<ClaimValidationLogger> _logger;

    public ClaimValidationLogger(ILogger<ClaimValidationLogger> logger)
    {
        _logger = logger;
    }

    public Task<ClaimsPrincipal> TransformAsync(ClaimsPrincipal principal)
    {
        foreach (var identity in principal.Identities)
        {
            foreach (var claim in identity.Claims)
            {
                if (string.IsNullOrWhiteSpace(claim.Value))
                {
                    _logger.Warning("检测到空值Claim：Type={ClaimType}, Issuer={Issuer}", claim.Type, claim.Issuer);
                }
            }
        }
        return Task.FromResult(principal);
    }
}

在Program.cs中注册该服务：

builder.Services.AddScoped<IClaimsTransformation, ClaimValidationLogger>();

3. 包装AuthenticationService，记录SignIn前的完整Claims #

通过装饰器模式拦截SignInAsync调用，在执行登录前输出用户的所有Claims详情：

public class LoggingAuthService : IAuthenticationService
{
    private readonly IAuthenticationService _innerService;
    private readonly ILogger<LoggingAuthService> _logger;

    public LoggingAuthService(IAuthenticationService innerService, ILogger<LoggingAuthService> logger)
    {
        _innerService = innerService;
        _logger = logger;
    }

    public async Task<AuthenticateResult> AuthenticateAsync(HttpContext context, string scheme)
        => await _innerService.AuthenticateAsync(context, scheme);

    public async Task ChallengeAsync(HttpContext context, string scheme, AuthenticationProperties properties)
        => await _innerService.ChallengeAsync(context, scheme, properties);

    public async Task ForbidAsync(HttpContext context, string scheme, AuthenticationProperties properties)
        => await _innerService.ForbidAsync(context, scheme, properties);

    public async Task SignInAsync(HttpContext context, string scheme, ClaimsPrincipal principal, AuthenticationProperties properties)
    {
        _logger.Debug("即将执行SignIn，Scheme={Scheme}，用户Claims详情：", scheme);
        foreach (var identity in principal.Identities)
        {
            foreach (var claim in identity.Claims)
            {
                _logger.Debug("Claim: Type={Type}, Value={Value}, Issuer={Issuer}", 
                    claim.Type, 
                    claim.Value ?? "【NULL】", 
                    claim.Issuer);
            }
        }

        await _innerService.SignInAsync(context, scheme, principal, properties);
    }
}

注册时替换默认的IAuthenticationService：

builder.Services.AddScoped<IAuthenticationService>(sp =>
{
    var innerService = sp.GetRequiredService<AuthenticationService>();
    var logger = sp.GetRequiredService<ILogger<LoggingAuthService>>();
    return new LoggingAuthService(innerService, logger);
});

• 检查远程认证提供商（如Azure AD、Google）返回的Claims，是否存在空值字段
• 核对本地Claim映射代码（如AddOpenIdConnect中的ClaimActions配置），是否生成了空Value的Claim
• 排查Finbuckle.MultiTenant组件的租户Claims处理逻辑，是否引入了空值

内容的提问来源于stack exchange，提问作者Ivan Debono