ASP.NET Core Web API谷歌登录：GetExternalLoginInfoAsync返回Null求助

核心问题分析 #

导致GetExternalLoginInfoAsync()返回Null的主要原因有以下几点：

1. 错误的State参数传递
   你前端手动构造谷歌授权URL时，使用LoginProvider作为state参数，但ASP.NET Core Identity的外部登录流程中，state必须包含由SignInManager.ConfigureExternalAuthenticationProperties()生成的会话标识，缺少这个标识，后端无法关联外部登录的临时会话数据，直接返回Null。

2. Cookie认证配置不完整
   虽然你添加了.AddCookie()，但Identity的ExternalScheme需要专门的Cookie配置来存储外部登录的临时信息，默认配置可能无法正确跨域或保存会话数据。

3. 前端手动拼接授权URL的风险
   你自行拼接谷歌授权URL，容易遗漏必要参数（如正确的state、scope的编码等），导致谷歌返回的回调数据无法被ASP.NET Core正确解析。

4. 回调Action的匿名访问权限
   如果ExternalLoginCallback Action没有允许匿名访问，会被默认的JwtBearer认证拦截，导致无法读取会话中的外部登录信息。

分步解决方案 #

1. 修正后端ExternalLogin方法，直接返回Challenge结果 #

不要返回properties让前端拼接URL，直接由ASP.NET Core生成正确的谷歌跳转地址：

[AllowAnonymous]
public IActionResult ExternalLogin(string provider, string returnUrl)
{
    // 使用Url.Action生成正确的回调地址，避免硬编码
    var redirectUrl = Url.Action(nameof(ExternalLoginCallback), "Account", new { returnUrl });
    var properties = _signInManager.ConfigureExternalAuthenticationProperties(provider, redirectUrl);
    
    // 直接触发认证挑战，ASP.NET Core会自动跳转到谷歌授权页面
    return Challenge(properties, provider);
}

2. 简化前端逻辑，直接跳转后端ExternalLogin接口 #

不需要手动拼接谷歌URL，直接访问后端的ExternalLogin接口即可：

const handleExternalLogin = async () => {
    const returnUrl = encodeURIComponent('/admin-dashboard');
    const url = `${externalLogin}?provider=Google&returnUrl=${returnUrl}`;
    window.location.href = url;
};

3. 完善Program.cs中的认证配置 #

明确配置IdentityConstants.ExternalScheme的Cookie，确保会话数据能正确保存：

builder.Services.AddAuthentication(options =>
{
    options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
    options.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddJwtBearer(o =>
{
    o.TokenValidationParameters = new TokenValidationParameters
    {
        ValidIssuer = builder.Configuration["Jwt:ValidIssuer"],
        ValidAudience = builder.Configuration["Jwt:ValidAudience"],
        IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(builder.Configuration["Jwt:Secret"])),
        ValidateIssuer = true,
        ValidateAudience = true,
        ValidateLifetime = false,
        ValidateIssuerSigningKey = true
    };
})
// 专门配置ExternalScheme的Cookie
.AddCookie(IdentityConstants.ExternalScheme, options =>
{
    options.Cookie.Name = ".AspNetCore.External";
    options.Cookie.SameSite = SameSiteMode.Lax; // 跨域场景下可改为SameSiteMode.None，同时设置Secure
    options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
    options.ExpireTimeSpan = TimeSpan.FromMinutes(5);
    options.Cookie.Path = "/";
})
.AddGoogle(opt =>
{
    opt.ClientId = builder.Configuration["GoogleLoginProvider:ClientId"];
    opt.ClientSecret = builder.Configuration["GoogleLoginProvider:ClientSecret"];
    opt.SignInScheme = IdentityConstants.ExternalScheme;
    // 确保请求谷歌的scope包含必要的信息
    opt.Scope.Add("email");
    opt.Scope.Add("profile");
});

4. 修复回调函数的空引用问题 #

原代码中else分支直接访问info会导致空引用异常，同时添加JWT生成逻辑适配API场景：

[AllowAnonymous]
public async Task<IActionResult> ExternalLoginCallback([FromQuery] string returnUrl)
{
    var info = await _signInManager.GetExternalLoginInfoAsync();
    if (info == null)
    {
        return BadRequest(new MessageViewModel
        {
            IsSuccess = false,
            Message = "无法获取外部登录会话信息"
        });
    }

    // 尝试直接登录已有用户
    var signInResult = await _signInManager.ExternalLoginSignInAsync(
        info.LoginProvider, 
        info.ProviderKey, 
        isPersistent: false, 
        bypassTwoFactor: true);

    if (signInResult.Succeeded)
    {
        var user = await _userManager.GetUserAsync(info.Principal);
        var jwtToken = GenerateJwtToken(user); // 实现你的JWT生成逻辑
        return Ok(new MessageViewModel
        {
            IsSuccess = true,
            Message = "登录成功",
            Data = jwtToken
        });
    }

    // 获取用户邮箱，用于创建新用户
    var email = info.Principal.FindFirstValue(ClaimTypes.Email);
    if (string.IsNullOrEmpty(email))
    {
        return BadRequest(new MessageViewModel
        {
            IsSuccess = false,
            Message = "无法获取用户邮箱信息"
        });
    }

    var userExists = await _userManager.FindByEmailAsync(email);
    if (userExists == null)
    {
        userExists = new Users
        {
            UserName = email,
            Email = email,
            FirstName = info.Principal.FindFirstValue(ClaimTypes.GivenName),
            LastName = info.Principal.FindFirstValue(ClaimTypes.Surname),
            EmailConfirmed = true // 谷歌登录默认已验证邮箱
        };

        var createResult = await _userManager.CreateAsync(userExists);
        if (!createResult.Succeeded)
        {
            return BadRequest(new MessageViewModel
            {
                IsSuccess = false,
                Message = $"创建用户失败：{string.Join(", ", createResult.Errors.Select(e => e.Description))}"
            });
        }
    }

    // 绑定外部登录到用户
    var addLoginResult = await _userManager.AddLoginAsync(userExists, info);
    if (!addLoginResult.Succeeded)
    {
        return BadRequest(new MessageViewModel
        {
            IsSuccess = false,
            Message = $"绑定外部登录失败：{string.Join(", ", addLoginResult.Errors.Select(e => e.Description))}"
        });
    }

    // 登录新用户并返回JWT
    await _signInManager.SignInAsync(userExists, isPersistent: false);
    var newJwtToken = GenerateJwtToken(userExists);
    return Ok(new MessageViewModel
    {
        IsSuccess = true,
        Message = "用户创建并登录成功",
        Data = newJwtToken
    });
}

// 示例JWT生成方法
private string GenerateJwtToken(Users user)
{
    var claims = new List<Claim>
    {
        new Claim(ClaimTypes.NameIdentifier, user.Id),
        new Claim(ClaimTypes.Email, user.Email),
        new Claim(ClaimTypes.Name, user.UserName)
    };

    var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(builder.Configuration["Jwt:Secret"]));
    var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);

    var token = new JwtSecurityToken(
        issuer: builder.Configuration["Jwt:ValidIssuer"],
        audience: builder.Configuration["Jwt:ValidAudience"],
        claims: claims,
        expires: DateTime.Now.AddHours(2),
        signingCredentials: creds);

    return new JwtSecurityTokenHandler().WriteToken(token);
}

5. 确保中间件顺序正确 #

在Program.cs中，中间件顺序必须符合以下要求：

app.UseHttpsRedirection();
app.UseStaticFiles();

// 认证中间件必须放在授权中间件之前
app.UseAuthentication();
app.UseAuthorization();

app.MapControllers();

内容的提问来源于stack exchange，提问作者Neeraj