ASP.NET Core 8登录遇HTTP 500错误（仅IIS环境）

问题描述 #

输入有效凭据提交登录表单后，用户未成功登录，也未跳转到首页或目标URL，仅显示通用500内部服务器错误，日志无有效排查信息。该问题仅在IIS服务器上出现，Visual Studio开发环境运行完全正常。

相关代码片段 #

AccountController登录方法 #

[HttpGet]
[AllowAnonymous]
public IActionResult Login(string returnUrl = null)
{
    if (User.Identity.IsAuthenticated)
    {
        return RedirectToAction("Index", "Home");
    }
    ViewData["ReturnUrl"] = returnUrl;
    return View();
}

[HttpPost]
[AllowAnonymous]
[ValidateAntiForgeryToken]
public async Task<IActionResult> Login(LoginViewModel model, string returnUrl = null)
{
    if (ModelState.IsValid)
    {
        var result = await _signInManager.PasswordSignInAsync(model.Email, model.Password, model.RememberMe, lockoutOnFailure: false);
        if (result.Succeeded)
        {
            _logger.LogInformation("User logged in successfully.");
            return RedirectToLocal(returnUrl);
        }
        else
        {
            ModelState.AddModelError(string.Empty, "Invalid login attempt.");
        }
    }

    // If we got this far, something failed, redisplay form
    return View(model);
}

Program.cs配置 #

using GH.DataContext;
using GH.Models;
using GH.Repository.Abstract;
using GH.Repository.Implementation;
using Microsoft.AspNetCore.Identity;
using Microsoft.EntityFrameworkCore;

var builder = WebApplication.CreateBuilder(args);

// Add services to the container.
builder.Services.AddControllersWithViews();
builder.Services.AddDbContext<ApplicationDbContext>(options => options.UseSqlServer("name=DefaultConnection"));
builder.Services.AddDbContext<InventoriesDbContext>(options => options.UseSqlServer("name=DefaultConnection"));
builder.Services.AddHttpContextAccessor();
builder.Services.AddAuthorization();
builder.Services.AddScoped<IInventoryRepository, InventoryRepository>();
builder.Services.AddIdentity<ApplicationUser, IdentityRole>(options =>
{
    options.Password.RequireDigit = false;
    options.Password.RequireUppercase = false;
    options.Password.RequireLowercase = false;
    options.Password.RequireNonAlphanumeric = false;
})
.AddEntityFrameworkStores<ApplicationDbContext>()
.AddDefaultTokenProviders();

// Configure authentication
builder.Services.ConfigureApplicationCookie(options =>
{
    options.LoginPath = "/Account/Login"; // 登录页面路径
    options.LogoutPath = "/Account/LogOff"; // 登出页面路径
    options.AccessDeniedPath = "/Account/AccessDenied"; // 权限不足页面路径
});

var app = builder.Build();

// Configure the HTTP request pipeline.
if (!app.Environment.IsProduction())
{
    app.UseExceptionHandler("/Home/Error");
    // 默认HSTS有效期为30天，生产环境可按需调整
    app.UseHsts();
}

app.UseHttpsRedirection();
app.UseStaticFiles();

app.UseRouting();

app.UseAuthentication(); // 启用认证中间件
app.UseAuthorization();
app.MapControllerRoute(
    name: "default",
    pattern: "{controller=Home}/{action=Index}/{id?}");

app.Run();

登录视图 #

@using System.Collections.Generic
@using Microsoft.AspNetCore.Http
@using Microsoft.AspNetCore.Authentication
@using GH.Models.AccountViewModels
@using GH.Models
@using Microsoft.AspNetCore.Identity
@model LoginViewModel
@inject SignInManager<ApplicationUser> SignInManager

@{
    Layout = null;
}
<head>
    <link rel="stylesheet" href="~/lib/bootstrap/dist/css/bootstrap.min.css" />
    <link rel="stylesheet" href="~/css/site.css" asp-append-version="true" />
    <link rel="shortcut icon" type="image/png" href="/Images/icon.svg" />

</head>
<div class="container py-5 h-100">
    <div class="row d-flex justify-content-center align-items-center h-100">
        <div class="col-12 col-md-8 col-lg-6 col-xl-5">
            <div class="card text-black" style="border-radius: 1rem; background-color:#B8B8B8">
                <div class="card-body p-5 text-center">
                    <title>Inicio de Sesión</title>
                    <div class="row">
                        <div class="col-md-20">
                            <section>
                                <form asp-controller="Account" asp-action="Login" asp-route-returnurl="@ViewData["ReturnUrl"]" method="post" class="form-horizontal" role="form">
                                    <img src="~/Images/LogoHD.png" class="logo" />
                                    <hr />
                                    <div asp-validation-summary="ModelOnly" class="text-danger"></div>
                                    <div class="form-group">
                                        <label class="col-md-2 control-label">Correo</label>
                                        <div class="col-md-15">
                                            <input asp-for="Email" class="form-control" />
                                            <span asp-validation-for="Email" class="text-danger"></span>
                                        </div>
                                    </div>
                                    <br />
                                    <div class="form-group">
                                        <label class="col-md-5 control-label">Contraseña</label>
                                        <div class="col-md-15">
                                            <input asp-for="Password" class="form-control" />
                                            <span asp-validation-for="Password" class="text-danger"></span>
                                        </div>
                                    </div>
                                    <div class="form-group">
                                        <div class="col-md-offset-2 col-md-15">
                                            <br />
                                            <button data-mdb-button-init data-mdb-ripple-init class="btn btn-outline-dark btn-lg px-5" type="submit">Ingresar</button>
                                        </div>
                                    </div>
                                    <div class="col-md-offset-2 col-md-15">
                                    <p>
                                          <a asp-action="Register" asp-route-returnurl="@ViewData["ReturnUrl"]">¿Sin usuario? Regístrate aquí.</a>
                                    </p>
                                    </div>

                                </form>
                            </section>
                        </div>
                    </div>
                </div>
            </div>
        </div>
    </div>
</div>

已排查项 #

• 日志：仅记录500错误，无登录失败的详细错误信息
• 数据库连接：运行正常，开发环境可正常注册用户
• Identity配置：确认UserManager和SignInManager已通过依赖注入正确配置
• 已启用匿名身份验证和表单身份验证

解决方案 #

1. 排查环境权限与配置差异 #

• 应用程序池权限：检查IIS站点对应的应用程序池身份，确保该账户拥有数据库访问权限，以及网站根目录的读写权限（用于Cookie存储、日志生成等）。
• 连接字符串验证：确认生产环境appsettings.json中的DefaultConnection配置正确，或者在IIS管理器中为站点配置了正确的连接字符串（站点 -> 配置 -> 连接字符串）。

2. 增强异常捕获与日志 #

• 临时启用详细错误页面：在Program.cs中修改环境判断逻辑，临时在生产环境启用开发者异常页面，以便查看具体错误信息（排查完成后改回）：

  // 替换原环境判断代码
  if (app.Environment.IsProduction())
  {
      // 临时启用开发者页面排查
      app.UseDeveloperExceptionPage();
      app.UseHsts();
  }
  else
  {
      app.UseDeveloperExceptionPage();
  }
  

• 添加异常捕获逻辑：在Login的POST方法中增加try-catch块，记录详细异常日志：

  [HttpPost]
  [AllowAnonymous]
  [ValidateAntiForgeryToken]
  public async Task<IActionResult> Login(LoginViewModel model, string returnUrl = null)
  {
      try
      {
          if (ModelState.IsValid)
          {
              var result = await _signInManager.PasswordSignInAsync(model.Email, model.Password, model.RememberMe, lockoutOnFailure: false);
              if (result.Succeeded)
              {
                  _logger.LogInformation("用户登录成功。");
                  return RedirectToLocal(returnUrl);
              }
              else
              {
                  ModelState.AddModelError(string.Empty, "无效的登录尝试。");
              }
          }
  
          // 登录失败，重新显示表单
          return View(model);
      }
      catch (Exception ex)
      {
          _logger.LogError(ex, "登录过程中发生异常");
          ModelState.AddModelError(string.Empty, "登录时发生错误，请稍后重试");
          return View(model);
      }
  }
  

3. 调整Identity Cookie配置 #

针对IIS环境优化Cookie设置，避免因Cookie属性导致的异常：

builder.Services.ConfigureApplicationCookie(options =>
{
    options.LoginPath = "/Account/Login";
    options.LogoutPath = "/Account/LogOff";
    options.AccessDeniedPath = "/Account/AccessDenied";
    // HTTPS环境下强制Cookie为Secure
    options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
    // 设置SameSite属性适配生产环境
    options.Cookie.SameSite = SameSiteMode.Lax;
    // 确保Cookie路径正确
    options.Cookie.Path = "/";
});

4. 检查IIS模块与认证设置 #

• 确认服务器已安装ASP.NET Core托管捆绑包，版本与项目使用的.NET版本匹配。
• 在IIS站点的身份验证设置中，禁用表单身份验证（ASP.NET Core Identity使用Cookie认证，无需IIS表单认证），仅保留匿名身份验证。

5. 验证ReturnUrl处理逻辑 #

确保RedirectToLocal方法对外部URL做了拦截，避免因无效ReturnUrl抛出异常：

private IActionResult RedirectToLocal(string returnUrl)
{
    if (!string.IsNullOrEmpty(returnUrl) && Url.IsLocalUrl(returnUrl))
    {
        return Redirect(returnUrl);
    }
    // 无效或空ReturnUrl时跳转到首页
    return RedirectToAction(nameof(HomeController.Index), "Home");
}

内容的提问来源于stack exchange，提问作者Adrian Lopez