ASP.NET MVC自定义HttpContext.User对象在Azure App Service中为null

问题现象 #

ASP.NET MVC项目中，自定义HttpContext.User对象在本地环境及IIS中可正常工作，但部署到Azure App Service后该对象为null。尝试将HttpContext.Current.User转换为ICustomPrincipal时，抛出空引用错误：

Object reference not set to an instance of an object.

尝试在PostAuthenticateRequest事件中创建自定义主体，应用程序出现异常行为。

相关代码 #

HttpModule代码 #

public void Init(HttpApplication application) 
{
    _httpApplication = application; 
    _httpApplication.AuthenticateRequest += OnAuthenticateRequest; 
}

public void OnAuthenticateRequest(object sender, System.EventArgs e) 
{ 
     _customclass.Process(_httpApplication.Context);
}

_customClass的Process方法 #

private HttpContext _context;

public void Process(HttpContext context)
{ 
    _context = context; 
    var authenticationTicket = GetCurrentAuthenticationTicket();

    if (authenticationTicket == null)
    { 
        var userEmail = GetEmail(); 
        CreatePrincipalAndSetAsCurrentUser(userEmail); 
        authenticationCookie = CreateAuthTicket(CustomIdentityObject); 
       _context.Response.AppendCookie(authenticationCookie); 
    } 
    else if (authenticationTicket.Expired) 
    { 
        RedirectAndEndResponse("~/Logout.aspx"); 
    } 
    else 
    { 
        CreatePrincipalAndSetAsCurrentUser(authenticationTicket); 
    } 
} 

CreatePrincipalAndSetAsCurrentUser相关代码 #

private ICustomPrincipal CustomPrincipal 
{
    get { return _context.User as ICustomPrincipal ; } 
    set { _context.User = value; } 
}

解决方案 #

1. 检查Azure App Service身份验证设置

   • 登录Azure门户，进入目标App Service的「身份验证」选项，确认未启用与自定义认证冲突的内置身份验证服务（如Azure AD、Facebook登录等），这类服务可能会提前覆盖HttpContext.User。

2. 调整事件注册时机与上下文处理逻辑

   • Azure App Service的请求管道执行顺序与本地IIS存在差异，建议将自定义主体的设置逻辑移至PostAuthenticateRequest事件，并提前初始化空主体避免null引用：

     public void Init(HttpApplication application) 
     {
         application.PostAuthenticateRequest += OnPostAuthenticateRequest; 
     }
     
     public void OnPostAuthenticateRequest(object sender, System.EventArgs e) 
     { 
         var app = sender as HttpApplication;
         if (app?.Context == null) return;
     
         // 提前初始化空主体，避免后续转换时出现null
         if (app.Context.User == null)
         {
             app.Context.User = new GenericPrincipal(new GenericIdentity(string.Empty), Array.Empty<string>());
         }
         _customclass.Process(app.Context);
     }
     

3. 修正Cookie属性适配Azure环境

   • Azure App Service对Cookie的安全属性要求更严格，创建认证Cookie时需设置正确的SameSite和Secure属性：

     authenticationCookie.SameSite = SameSiteMode.Lax;
     authenticationCookie.Secure = context.Request.IsSecureConnection;
     

4. 避免缓存HttpApplication实例

   • 不要在模块中缓存HttpApplication对象，而是在事件处理方法中直接从sender获取当前实例，确保上下文的正确性：

     public void OnAuthenticateRequest(object sender, System.EventArgs e) 
     { 
         var app = sender as HttpApplication;
         if (app != null)
         {
             _customclass.Process(app.Context);
         }
     }
     

内容的提问来源于stack exchange，提问作者Sam P