使用IIS服务器IP访问时ASP.NET Identity Owin登录失效问题

问题详情 #

• 服务器本地用localhost访问时登录正常，使用服务器IP地址访问时，登录后持续跳转回登录页面
• 登录接口返回"Success"，但移除Home控制器Index方法的[Authorize]特性后可正常进入首页，恢复特性后仍跳转登录页
• localhost登录后，局部视图能显示用户名；关闭[Authorize]且登录成功后，视图不显示用户名，推测Request.IsAuthenticated返回false，大概率是Cookie无法正确绑定（当前网站仅用IP访问，无域名）

相关代码 #

Startup.ConfigureAuth 方法 #

public void ConfigureAuth(IAppBuilder app)
{
        // Configure the db context, user manager and role manager to use a single instance per request
        app.CreatePerOwinContext(ApplicationDbContext.Create);
        app.CreatePerOwinContext<ApplicationUserManager>(ApplicationUserManager.Create);
        app.CreatePerOwinContext<ApplicationSignInManager>(ApplicationSignInManager.Create);
        
        bool isLocal = HttpContext.Current.Request.IsLocal;

        if (!isLocal)
        {
            app.UseCookieAuthentication(new CookieAuthenticationOptions
            {
                AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
                LoginPath = new PathString("/Account/Login"),
                CookieName = "Gen",
                
                CookieSecure = CookieSecureOption.Always,
                SlidingExpiration = true,
            });
        }
        else
        {
            app.UseCookieAuthentication(new CookieAuthenticationOptions
            {
                AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
                LoginPath = new PathString("/Account/Login"),
                
                CookieName = "Gen",
                CookieSecure = CookieSecureOption.Always,
                SlidingExpiration = true,
            });
        }
}

登录局部视图代码 #

@using Microsoft.AspNet.Identity

@if (Request.IsAuthenticated)
{
    using (Html.BeginForm("LogOff", "Account", new { area = "" }, FormMethod.Post, new { id = "logoutForm", @class = "navbar-right" }))
    {
        <span class="loginLink">@Html.ActionLink("Hello " + User.Identity.GetUserName() + "! ", "Index", "Manage", routeValues: new { area = "" }, htmlAttributes: new { title = "Manage" })</span>
        <span> | </span>
        <span class="loginLink"><a href="javascript:document.getElementById('logoutForm').submit()">Log off</a></span>
    }
}
else
{
    <ul class="nav navbar-nav navbar-right" style="margin-right:2em;">
        <!-- <li>@Html.ActionLink("Register", "Register", "Account", routeValues: null, htmlAttributes: new { id = "registerLink" })</li> -->
        @Html.ActionLink("Log in", "Login", "Account", routeValues: null, htmlAttributes: new { id = "loginLink" })
    </ul>
}

解决方法 #

1. 修正CookieSecure配置
   当前CookieSecure设为Always，意味着Cookie仅通过HTTPS传输。如果用IP访问时走的是HTTP协议，浏览器会拒绝保存Cookie，导致认证状态丢失。建议根据请求协议动态设置：

   CookieSecure = app.Request.IsSecureConnection ? CookieSecureOption.Always : CookieSecureOption.Never
   

   测试环境如果是HTTP，可直接暂时改为CookieSecureOption.Never，生产环境再切换回Always。

2. 指定Cookie的Domain属性
   因为用IP访问，需要显式绑定Cookie到服务器IP，确保Cookie能被正确识别：
   在CookieAuthenticationOptions中添加：

   CookieDomain = "你的服务器IP地址" // 例如 "192.168.1.100"
   

3. 统一Cookie配置，移除不必要的分支判断
   当前代码中isLocal分支的Cookie配置完全一致，而且HttpContext.Current.Request.IsLocal在ConfigureAuth阶段可能无法正确获取请求上下文，导致判断失效。建议合并配置，简化代码：

   app.UseCookieAuthentication(new CookieAuthenticationOptions
   {
       AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
       LoginPath = new PathString("/Account/Login"),
       CookieName = "Gen",
       CookieSecure = app.Request.IsSecureConnection ? CookieSecureOption.Always : CookieSecureOption.Never,
       CookieDomain = "你的服务器IP地址",
       CookiePath = "/",
       SlidingExpiration = true,
   });
   

4. 验证Cookie的Path属性
   显式设置CookiePath = "/"，确保Cookie在整个站点范围内有效，避免路由路径导致的Cookie无法读取问题。

内容的提问来源于stack exchange，提问作者Eric