在.NET Core 8中为两个区域设置Cookie并实现权限控制

1. 配置双Cookie认证方案 #

在Program.cs的服务配置阶段，添加两个独立的Cookie认证方案，分别对应管理员和普通用户，通过Cookie名称区分会话：

builder.Services.AddAuthentication()
.AddCookie("AdminAuth", options =>
{
    options.Cookie.Name = "AdminSession";
    options.LoginPath = "/Admin/Login/Index";
    options.AccessDeniedPath = "/Admin/Login/AccessDenied";
    options.ExpireTimeSpan = TimeSpan.FromHours(8);
})
.AddCookie("CustomerAuth", options =>
{
    options.Cookie.Name = "CustomerSession";
    options.LoginPath = "/Customer/Login/Index";
    options.AccessDeniedPath = "/Customer/Login/AccessDenied";
    options.ExpireTimeSpan = TimeSpan.FromHours(24);
});

2. 绑定授权策略与认证方案 #

为两个区域创建专属授权策略，确保只有对应认证方式的登录用户才能访问：

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("AdminPolicy", policy =>
    {
        policy.AuthenticationSchemes.Add("AdminAuth");
        policy.RequireAuthenticatedUser();
        // 可额外添加角色验证：policy.RequireRole("Admin");
    });

    options.AddPolicy("CustomerPolicy", policy =>
    {
        policy.AuthenticationSchemes.Add("CustomerAuth");
        policy.RequireAuthenticatedUser();
        // 可额外添加角色验证：policy.RequireRole("Customer");
    });
});

3. 为Area控制器添加授权标记 #

管理员区域（Admin） #

除登录控制器外，其余控制器添加管理员授权策略：

[Area("Admin")]
[Authorize(Policy = "AdminPolicy")]
public class HomeController : Controller
{
    // 管理员面板业务逻辑
}

// 登录控制器无需授权
[Area("Admin")]
public class LoginController : Controller
{
    public IActionResult Index() => View();

    [HttpPost]
    public async Task<IActionResult> Login(LoginViewModel model)
    {
        // 管理员账号验证逻辑...
        
        // 使用AdminAuth方案创建登录Cookie
        var claims = new List<Claim>
        {
            new Claim(ClaimTypes.Name, model.Username),
            new Claim(ClaimTypes.Role, "Admin")
        };
        var identity = new ClaimsIdentity(claims, "AdminAuth");
        await HttpContext.SignInAsync("AdminAuth", new ClaimsPrincipal(identity));

        return RedirectToAction("Index", "Home");
    }

    public async Task<IActionResult> Logout()
    {
        await HttpContext.SignOutAsync("AdminAuth");
        return RedirectToAction("Index");
    }
}

普通用户区域（Customer） #

同理，除登录控制器外，其余控制器添加用户授权策略：

[Area("Customer")]
[Authorize(Policy = "CustomerPolicy")]
public class HomeController : Controller
{
    // 用户网站业务逻辑
}

// 登录控制器无需授权
[Area("Customer")]
public class LoginController : Controller
{
    public IActionResult Index() => View();

    [HttpPost]
    public async Task<IActionResult> Login(LoginViewModel model)
    {
        // 普通用户账号验证逻辑...
        
        // 使用CustomerAuth方案创建登录Cookie
        var claims = new List<Claim>
        {
            new Claim(ClaimTypes.Name, model.Username),
            new Claim(ClaimTypes.Role, "Customer")
        };
        var identity = new ClaimsIdentity(claims, "CustomerAuth");
        await HttpContext.SignInAsync("CustomerAuth", new ClaimsPrincipal(identity));

        return RedirectToAction("Index", "Home");
    }

    public async Task<IActionResult> Logout()
    {
        await HttpContext.SignOutAsync("CustomerAuth");
        return RedirectToAction("Index");
    }
}

4. 启用认证授权中间件 #

在Program.cs的管道配置中，确保认证、授权中间件顺序正确（置于路由配置之前）：

app.UseAuthentication();
app.UseAuthorization();

// 保留原有路由配置
app.MapAreaControllerRoute(
    name: "Admin",
    areaName: "Admin",
    pattern: "Admin/{controller=Login}/{action=Index}/{id?}");

app.MapAreaControllerRoute(
    name: "Customer",
    areaName: "Customer",
    pattern: "Customer/{controller=Home}/{action=Index}/{id?}");

app.MapControllerRoute(
    name: "default",
    pattern: "{controller=Home}/{action=Index}/{id?}");

5. 默认路由访问限制（可选） #

若默认路由（非Area控制器）也需禁止未授权访问，可给对应控制器添加授权标记：

[Authorize(Policy = "CustomerPolicy")]
public class HomeController : Controller
{
    // 默认首页逻辑
}

内容的提问来源于stack exchange，提问作者Hassan Moradi Fard