升级前端i18next相关模块后遭遇Antiforgery SSL请求错误求助

依赖版本变更 #

将前端i18next相关模块升级至最新版本，具体版本变化如下：

"i18next": "^21.8.10" => "^23.11.2"
"i18next-http-backend": "^1.4.1" => "^2.5.0"
"react-i18next": "^11.17.2" => "^14.1.0"
"babel-plugin-i18next-extract": "^0.8.3" => "^0.10.0"

升级后出现的错误 #

System.InvalidOperationException: The antiforgery system has the configuration value AntiforgeryOptions.Cookie.SecurePolicy = Always, but the current request is not an SSL request.
   at Microsoft.AspNetCore.Antiforgery.DefaultAntiforgery.CheckSSLConfig(HttpContext context)
   at Microsoft.AspNetCore.Antiforgery.DefaultAntiforgery.GetAndStoreTokens(HttpContext httpContext)
   at Statsh.Server.Controllers.Api.ContextController.Index() in D:\TnPulses\SuiviRepos\29-02-24\Statsh\Statsh.Server\Controllers\Api\ContextController.cs:line 24
   at lambda_method1394(Closure , Object )
   at Microsoft.AspNetCore.Mvc.Infrastructure.ActionMethodExecutor.AwaitableObjectResultExecutor.Execute(IActionResultTypeMapper mapper, ObjectMethodExecutor executor, Object controller, Object[] arguments)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeActionMethodAsync>g__Logged|12_1(ControllerActionInvoker invoker)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeNextActionFilterAsync>g__Awaited|10_0(ControllerActionInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Rethrow(ActionExecutedContextSealed context)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.InvokeInnerFilterAsync()
--- End of stack trace from previous location ---
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeNextResourceFilter>g__Awaited|25_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.Rethrow(ResourceExecutedContextSealed context)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.InvokeFilterPipelineAsync()
--- End of stack trace from previous location ---
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeAsync>g__Logged|17_1(ResourceInvoker invoker)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeAsync>g__Logged|17_1(ResourceInvoker invoker)
   at Microsoft.AspNetCore.Routing.EndpointMiddleware.<Invoke>g__AwaitRequestTask|6_0(Endpoint endpoint, Task requestTask, ILogger logger)
   at Microsoft.AspNetCore.Authorization.AuthorizationMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
   at Statsh.Server.Middleware.ExceptionMiddleware.InvokeAsync(HttpContext context) in D:\TnPulses\SuiviRepos\29-02-24\Statsh\Statsh.Server\Middleware\ExceptionMiddleware.cs:line 25
   at Microsoft.AspNetCore.ResponseCompression.ResponseCompressionMiddleware.InvokeCore(HttpContext context)
   at Swashbuckle.AspNetCore.SwaggerUI.SwaggerUIMiddleware.Invoke(HttpContext httpContext)
   at Swashbuckle.AspNetCore.Swagger.SwaggerMiddleware.Invoke(HttpContext httpContext, ISwaggerProvider swaggerProvider)
   at Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware.Invoke(HttpContext context)

相关后端C#配置 #

推测错误与后端以下配置有关：

services.AddAntiforgery(o =>
{
    o.Cookie.SameSite = SameSiteMode.None;
    o.Cookie.SecurePolicy = CookieSecurePolicy.Always;
    o.SuppressXFrameOptionsHeader = true;
});

services.ConfigureExternalCookie(options =>
{
    options.Cookie.SameSite = SameSiteMode.None;
    options.Cookie.SecurePolicy = CookieSecurePolicy.None;
});

services.Configure<CookiePolicyOptions>(options =>
{
    options.MinimumSameSitePolicy = SameSiteMode.None;
    options.Secure = CookieSecurePolicy.Always;
});

解决思路 #

• 区分环境配置：开发环境将AntiforgeryOptions.Cookie.SecurePolicy改为CookieSecurePolicy.None，生产环境保留Always。本地开发用HTTP时不会触发错误，线上HTTPS环境仍保持安全规则。
• 检查前端请求协议：排查升级后的i18next-http-backend是否新增了强制HTTPS的配置，导致本地HTTP请求被判定为非SSL请求。调整该模块配置适配开发环境。
• 临时调整全局Cookie策略：开发阶段可将CookiePolicyOptions.Secure改为CookieSecurePolicy.None测试是否解决问题，上线前恢复为Always。
• 修正后端协议识别：如果部署环境出现该问题，需配置后端正确识别真实请求协议（比如ASP.NET Core中配置ForwardedHeadersOptions），避免反向代理导致的协议误判。

内容的提问来源于stack exchange，提问作者Bardelman