.NET 8 Blazor Wasm自定义JWT认证异常：受保护页面返回401

核心原因 #

.NET 8 Blazor Wasm在认证流程上做了默认行为调整：启用了自动身份验证重定向拦截，未认证请求受保护资源时会直接返回401错误，而非交由路由组件的<NotAuthorized>逻辑处理——这也是你觉得比.NET 7复杂的根本原因。

具体排查与解决步骤 #

1. 修正Program.cs中的认证配置 #

如果使用OIDC模式集成JWT，需禁用自动重定向，让Blazor路由接管未授权逻辑：

builder.Services.AddOidcAuthentication(options =>
{
    options.ProviderOptions.Authority = "你的认证服务地址";
    options.ProviderOptions.ClientId = "你的客户端ID";
    // 关键：清空自动重定向路径，禁用默认拦截
    options.AuthenticationPaths.LogInPath = "";
    options.AuthenticationPaths.LogOutPath = "";
    options.AuthenticationPaths.AccessDeniedPath = "";
})
.AddAccountClaimsPrincipalFactory<CustomUserClaimsPrincipalFactory>();

如果是纯自定义JWT认证（非OIDC），需确保注册自定义AuthenticationStateProvider并配置HttpClient：

builder.Services.AddAuthorizationCore();
builder.Services.AddHttpClient("API", client => client.BaseAddress = new Uri(builder.HostEnvironment.BaseAddress))
    .AddHttpMessageHandler<BaseAddressAuthorizationMessageHandler>();
builder.Services.AddScoped(sp => sp.GetRequiredService<IHttpClientFactory>().CreateClient("API"));

// 注册自定义认证状态提供者
builder.Services.AddScoped<AuthenticationStateProvider, CustomAuthenticationStateProvider>();

2. 确保CustomAuthenticationStateProvider实现正确 #

自定义认证状态提供者必须在用户未登录时返回匿名用户状态，不能抛出异常或返回无效状态：

public class CustomAuthenticationStateProvider : AuthenticationStateProvider
{
    private readonly HttpClient _httpClient;

    public CustomAuthenticationStateProvider(HttpClient httpClient)
    {
        _httpClient = httpClient;
    }

    public override async Task<AuthenticationState> GetAuthenticationStateAsync()
    {
        var token = await GetStoredTokenAsync(); // 从本地存储读取JWT
        if (string.IsNullOrEmpty(token))
        {
            // 返回匿名用户，触发<NotAuthorized>
            return new AuthenticationState(new ClaimsPrincipal(new ClaimsIdentity()));
        }

        // 验证Token有效性，无效则返回匿名
        try
        {
            var claims = ParseTokenClaims(token);
            return new AuthenticationState(new ClaimsPrincipal(new ClaimsIdentity(claims, "jwt")));
        }
        catch
        {
            return new AuthenticationState(new ClaimsPrincipal(new ClaimsIdentity()));
        }
    }

    // 辅助方法：从本地存储取Token、解析Token声明等
    private async Task<string> GetStoredTokenAsync()
    {
        // 实现从localStorage/sessionStorage读取Token的逻辑
    }

    private IEnumerable<Claim> ParseTokenClaims(string token)
    {
        // 实现解析JWT声明的逻辑
    }
}

3. 检查Routes.razor的配置 #

确认<NotAuthorized>正确嵌套在<AuthorizeRouteView>内部，没有被其他逻辑覆盖：

<Router AppAssembly="@typeof(App).Assembly">
    <Found Context="routeData">
        <AuthorizeRouteView RouteData="@routeData" DefaultLayout="@typeof(MainLayout)">
            <NotAuthorized>
                <!-- 你的未授权内容，比如跳转登录页或提示 -->
                <LoginPage />
            </NotAuthorized>
            <Authorizing>
                <p>正在验证身份...</p>
            </Authorizing>
        </AuthorizeRouteView>
        <FocusOnNavigate RouteData="@routeData" Selector="h1" />
    </Found>
    <NotFound>
        <PageTitle>页面不存在</PageTitle>
        <LayoutView Layout="@typeof(MainLayout)">
            <p>抱歉，无法找到你请求的页面。</p>
        </LayoutView>
    </NotFound>
</Router>

4. 处理API请求的401拦截 #

如果页面调用后端API，需禁用HttpClient的自动401重定向，避免API返回的401直接导致页面报错：

builder.Services.AddHttpClient("API", client => client.BaseAddress = new Uri(builder.HostEnvironment.BaseAddress))
    .AddHttpMessageHandler(sp =>
    {
        var handler = new BaseAddressAuthorizationMessageHandler(sp.GetRequiredService<AuthenticationStateProvider>());
        // 允许匿名请求，手动处理401
        handler.AllowAnonymous = true;
        return handler;
    });

关于.NET 7与.NET 8的差异 #

.NET 7中Blazor Wasm默认由路由组件处理未授权逻辑，不会直接返回401；而.NET 8为了对齐后端API的认证流程，默认开启了自动拦截机制，因此需要手动配置还原之前的行为。

内容的提问来源于stack exchange，提问作者coolblue2000