如何在.NET Aspire中配置认证？现有应用JWT授权异常求助

1. 校验Aspire服务转发的请求头传递逻辑 #

Aspire默认会传递请求头，但可能因中间件顺序或自定义配置导致Authorization头被拦截。在API项目的Program.cs中，确保Aspire相关中间件位置正确，且无自定义逻辑移除请求头：

var builder = WebApplication.CreateBuilder(args);

// 优先添加Aspire服务发现
builder.AddServiceDiscovery();

// 配置JWT授权
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidateAudience = true,
            ValidateLifetime = true,
            ValidateIssuerSigningKey = true,
            ValidIssuer = builder.Configuration["Jwt:Issuer"],
            ValidAudience = builder.Configuration["Jwt:Audience"],
            IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(builder.Configuration["Jwt:Key"]))
        };
    });

builder.Services.AddAuthorization();

var app = builder.Build();

app.UseRouting();
app.UseServiceDiscovery();
// 确保认证中间件在授权前，且无前置中间件移除请求头
app.UseAuthentication();
app.UseAuthorization();

app.MapControllers();
app.Run();

2. 修正Swagger请求根地址配置 #

Swagger请求根与API实际地址不一致会导致请求发送至错误端点，需调整Swagger的服务器地址配置：

builder.Services.AddSwaggerGen(c =>
{
    c.SwaggerDoc("v1", new OpenApiInfo { Title = "你的API", Version = "v1" });
});

app.UseSwagger();
app.UseSwaggerUI(c =>
{
    c.SwaggerEndpoint("/swagger/v1/swagger.json", "你的API V1");
    c.RoutePrefix = string.Empty;
    // 强制Swagger使用当前页面的主机地址发送请求，避免跨地址问题
    c.ConfigObject.AdditionalItems["servers"] = new List<OpenApiServer>
    {
        new OpenApiServer { Url = "http://localhost:5085" } // 填写Aspire代理后的API地址
    };
});

3. 验证Aspire服务端点配置 #

在Aspire AppHost项目中，确认API服务的端点配置无自定义请求头拦截逻辑：

var builder = DistributedApplication.CreateBuilder(args);

var api = builder.AddProject<Projects.YourApi>("yourapi")
    .WithHttpEndpoint(port: 5085, scheme: "http");

builder.AddDashboard();
builder.Build().Run();

4. 调试请求头接收情况 #

在API项目中添加中间件，打印所有接收的请求头，确认Authorization头是否被传递：

// 放在UseAuthentication之前
app.Use(async (context, next) =>
{
    foreach (var header in context.Request.Headers)
    {
        Console.WriteLine($"{header.Key}: {header.Value}");
    }
    await next();
});

如果确认头丢失，可在AppHost项目中为API服务添加强制传递请求头的中间件：

var api = builder.AddProject<Projects.YourApi>("yourapi")
    .WithHttpEndpoint(port: 5085)
    .WithMiddleware(async (context, next) =>
    {
        foreach (var header in context.Request.Headers)
        {
            context.Request.Headers.TryAdd(header.Key, header.Value);
        }
        await next();
    });

5. 检查跨域配置（若存在） #

如果Swagger与API存在跨域场景，确保CORS配置允许Authorization头传递：

builder.Services.AddCors(options =>
{
    options.AddPolicy("AllowAll", policy =>
    {
        policy.AllowAnyOrigin()
              .AllowAnyMethod()
              .AllowAnyHeader()
              .WithExposedHeaders("Authorization");
    });
});

app.UseCors("AllowAll");

内容的提问来源于stack exchange，提问作者hwfbcisod