Blazor（.NET 8）身份验证登录异常及Claims为空问题咨询

环境与需求 #

• 使用环境：Blazor.Bootstrap 1.11.1、blazor-dragdrop 2.6.1、.NET 8.0
• 核心需求：实现正确的用户登录流程，并保持登录状态

第一种实现（直接通过HttpContextAccessor调用SignInAsync）的问题 #

实现代码 #

public async Task Login(IHttpContextAccessor httpContextAccessor, string username, string password)
{
    List<Claim> claims = new List<Claim> { new Claim(ClaimTypes.Name, username) };

    ClaimsIdentity identity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme);

    ClaimsPrincipal user = new ClaimsPrincipal(identity);
    await httpContextAccessor.HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, user);
    NotifyAuthenticationStateChanged(Task.FromResult(new AuthenticationState(user)));
}

错误信息 #

Error: System.InvalidOperationException: OnStarting cannot be set because the response has already started.
at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.ThrowResponseAlreadyStartedException(String value)
at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.OnStarting(Func2 callback, Object state) at Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationHandler.InitializeHandlerAsync() at Microsoft.AspNetCore.Authentication.AuthenticationHandler1.InitializeAsync(AuthenticationScheme scheme, HttpContext context)
at Microsoft.AspNetCore.Authentication.AuthenticationHandlerProvider.GetHandlerAsync(HttpContext context, String authenticationScheme)
at Microsoft.AspNetCore.Authentication.AuthenticationService.SignInAsync(HttpContext context, String scheme, ClaimsPrincipal principal, AuthenticationProperties properties)

问题原因 #

1. HttpContext生命周期不匹配：Blazor组件的渲染/交互时机与HTTP响应周期脱节，当执行SignInAsync时，HTTP响应可能已经开始发送，此时无法再修改响应头（比如添加认证Cookie），导致抛出"响应已启动"的错误。
2. 认证逻辑协同错误：自定义AuthenticationStateProvider与ASP.NET Core Cookie认证中间件未正确协同，直接调用SignInAsync后手动通知状态变更的方式不符合Blazor认证规范。

第二种实现（仅通过自定义AuthenticationStateProvider处理）的问题 #

实现代码 #

public class CustomAuthenticationStateProvider : AuthenticationStateProvider
{
    public async Task Login(string username, string password)
    {
        // 省略验证逻辑，假设验证通过
        List<Claim> claims = new List<Claim> { new Claim(ClaimTypes.Name, username) };
        ClaimsIdentity identity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme);
        ClaimsPrincipal userPrincipal = new ClaimsPrincipal(identity);

        NotifyAuthenticationStateChanged(Task.FromResult(new AuthenticationState(userPrincipal)));
    }
}

调用代码 #

[Inject]
private AuthenticationStateProvider CustomStateProvider { get; set; }
...
AuthenticationState authState = await CustomStateProvider.GetAuthenticationStateAsync();

问题现象 #

authState.Identity.Claims.Count = 0，未正确获取到设置的Claim。

问题原因 #

1. 状态未持久化：仅通过NotifyAuthenticationStateChanged设置的认证状态是内存临时状态，页面刷新或组件重新初始化后会丢失，且自定义Provider未从Cookie或其他持久化存储中读取身份信息。
2. ClaimsIdentity构造问题：指定的CookieAuthenticationDefaults.AuthenticationScheme是给ASP.NET Core中间件使用的，自定义Provider未实现从该Scheme对应的Cookie中解析身份的逻辑，默认的GetAuthenticationStateAsync仍返回匿名身份。

正确实现方案（结合Cookie认证与自定义AuthenticationStateProvider） #

1. 调整Program.cs配置（.NET 8采用Program.cs替代Startup） #

确保中间件顺序正确，配置Cookie认证与AuthenticationStateProvider协同：

var builder = WebApplication.CreateBuilder(args);

// 添加HttpContext访问服务
builder.Services.AddHttpContextAccessor();
// 注册自定义AuthenticationStateProvider
builder.Services.AddScoped<AuthenticationStateProvider, CustomAuthenticationStateProvider>();

// 配置Cookie认证
builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddCookie(options =>
    {
        options.Cookie.Name = "auth_token";
        options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
        options.LoginPath = "/login";
        options.Cookie.MaxAge = TimeSpan.FromMinutes(30);
        options.AccessDeniedPath = "/access-denied";
        options.Cookie.SameSite = SameSiteMode.Lax;
    });

builder.Services.AddAuthorization();
builder.Services.AddCascadingAuthenticationState();

// 添加Blazor交互式服务（根据项目类型选择Server或WebAssembly）
builder.Services.AddRazorComponents()
    .AddInteractiveServerComponents();

var app = builder.Build();

// 中间件顺序：静态文件 → 路由 → 认证 → 授权 → Blazor组件
if (!app.Environment.IsDevelopment())
{
    app.UseExceptionHandler("/Error");
    app.UseHsts();
}

app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseRouting();

app.UseAuthentication();
app.UseAuthorization();

// 映射Blazor根组件
app.MapRazorComponents<App>()
    .AddInteractiveServerRenderMode();

app.Run();

2. 实现自定义AuthenticationStateProvider #

继承RevalidatingServerAuthenticationStateProvider，实现从Cookie读取身份+登录/登出逻辑：

public class CustomAuthenticationStateProvider : RevalidatingServerAuthenticationStateProvider
{
    private readonly IHttpContextAccessor _httpContextAccessor;
    private readonly ILogger<CustomAuthenticationStateProvider> _logger;

    public CustomAuthenticationStateProvider(IHttpContextAccessor httpContextAccessor, ILoggerFactory loggerFactory)
        : base(loggerFactory)
    {
        _httpContextAccessor = httpContextAccessor;
        _logger = loggerFactory.CreateLogger<CustomAuthenticationStateProvider>();
    }

    // 登录方法：验证凭证+设置Cookie+通知状态变更
    public async Task Login(string username, string password)
    {
        if (!ValidateCredentials(username, password))
        {
            throw new UnauthorizedAccessException("用户名或密码错误");
        }

        var claims = new List<Claim>
        {
            new Claim(ClaimTypes.Name, username)
            // 可添加角色、权限等其他Claim
        };

        var identity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme);
        var principal = new ClaimsPrincipal(identity);

        // 通过AuthenticationService设置认证Cookie
        await _httpContextAccessor.HttpContext.SignInAsync(
            CookieAuthenticationDefaults.AuthenticationScheme,
            principal,
            new AuthenticationProperties { IsPersistent = true });

        // 通知Blazor应用更新认证状态
        NotifyAuthenticationStateChanged(Task.FromResult(new AuthenticationState(principal)));
    }

    // 登出方法
    public async Task Logout()
    {
        await _httpContextAccessor.HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
        NotifyAuthenticationStateChanged(Task.FromResult(new AuthenticationState(new ClaimsPrincipal(new ClaimsIdentity()))));
    }

    // 定期验证认证状态有效性
    protected override async Task<bool> ValidateAuthenticationStateAsync(AuthenticationState authenticationState, CancellationToken cancellationToken)
    {
        var httpContext = _httpContextAccessor.HttpContext;
        if (httpContext == null) return false;

        return httpContext.User.Identity.IsAuthenticated;
    }

    // 自定义凭证验证逻辑（替换为实际业务逻辑）
    private bool ValidateCredentials(string username, string password)
    {
        return username == "admin" && password == "password";
    }
}

3. 登录组件调用示例 #

@page "/login"
@inject CustomAuthenticationStateProvider AuthStateProvider
@inject NavigationManager NavigationManager

<EditForm Model="@loginModel" OnValidSubmit="@HandleLogin">
    <DataAnnotationsValidator />
    <ValidationSummary />

    <div class="mb-3">
        <label class="form-label">用户名</label>
        <InputText class="form-control" @bind-Value="loginModel.Username" />
    </div>
    <div class="mb-3">
        <label class="form-label">密码</label>
        <InputText type="password" class="form-control" @bind-Value="loginModel.Password" />
    </div>
    <button type="submit" class="btn btn-primary">登录</button>
</EditForm>

@code {
    private LoginModel loginModel = new LoginModel();

    private async Task HandleLogin()
    {
        try
        {
            await AuthStateProvider.Login(loginModel.Username, loginModel.Password);
            NavigationManager.NavigateTo("/");
        }
        catch (UnauthorizedAccessException ex)
        {
            // 处理登录失败提示
            Console.WriteLine(ex.Message);
        }
    }

    public class LoginModel
    {
        [Required(ErrorMessage = "请输入用户名")]
        public string Username { get; set; }

        [Required(ErrorMessage = "请输入密码")]
        public string Password { get; set; }
    }
}

关键注意事项 #

• 中间件顺序：必须保证UseAuthentication()和UseAuthorization()在MapRazorComponents之前执行，确保认证逻辑在Blazor处理请求前生效。
• HttpContext有效性：在Blazor Server模式下，仅在初始请求或组件交互的请求上下文中可操作HttpContext，登录操作需在表单提交等触发请求的场景中执行。
• 状态持久化：仅内存状态无法跨页面刷新保持登录，必须结合Cookie认证持久化身份信息，自定义Provider需从Cookie中读取并返回用户身份。

内容的提问来源于stack exchange，提问作者Eitan