跨域获取会话失败：mysite与shop.mysite单点登录问题排查

背景 #

我负责维护PHP站点mysite.com和ASP.NET站点shop.mysite.com，需实现单点登录功能。已在ASP.NET站点开发IsUserLoggedIn接口，用于返回用户登录状态、用户名及角色数组。

ASP.NET 接口实现代码 #

[HttpGet]
[AllowAnonymous]
public async Task<IActionResult> IsUserLoggedIn()
{
    try
    {
            if (HttpContext.Request.Headers["api-key"][0] != configuration["ApiKey"])
            {
                HttpContext.Response.StatusCode = 200;
                return Json(new { authenticated = "no key", roleId = "" });
            }

            if (HttpContext.User.Identity.IsAuthenticated)
            {
                var user = await userOperations.GetUser.Execute(HttpContext.User);
                var companyUser = await companyRepository.GetUser(user.Id, user.ActiveCompanyId);

                var roles = new List<String>();
                if (companyUser.Company.CustomerRoles != null)
                {
                    roles.AddRange(companyUser.Company.CustomerRoles);
                }

                if (companyUser.UserCompanies != null)
                {
                    foreach (var company in companyUser.UserCompanies)
                    {
                        if (company.CustomerRoles != null)
                        {
                            roles.AddRange(company.CustomerRoles);
                        }
                    }
                }

                HttpContext.Response.StatusCode = 200;
                return Json(new { authenticated = "yes", User = user, roleId = roles });
            }
            else
            {
                HttpContext.Response.StatusCode = 200;
                return Json(new { authenticated = "not auth", roleId = "" });
            }
    }
    catch (AuthenticationException e)
    {
        HttpContext.Response.StatusCode = 200;
        return Json(new { authenticated = "error", roleId = "", e });
    }
}

直接访问接口的正常结果 #

登录shop.mysite.com后，在新标签页访问该接口（携带api-key请求头），返回预期的认证结果：

{
  "authenticated": "yes",
  "user": {
    "id": 17085,
    "username": "cdavis",
    "verified": true,
    "activeCompanyId": "TEST001"
  },
  "roleId": [
    "NGFE"
  ]
}

PHP站点的Fetch调用代码 #

在mysite.com中通过JavaScript的fetch方法调用该接口，代码如下：

async function checkUserLoggedIn() {
    try {
        const response = await fetch('https://' + custom_script_vars.api_url + '/User/IsUserLoggedIn', {
            method: 'GET',
            headers: {
                'api-key': custom_script_vars.api_key,
            },
            credentials: 'include',
        });
        
        console.log('Response status:', response.status);

        if (response.ok) {
            const jsonData = await response.json();
            console.log('User logged in:', jsonData);

            const phpEndpoint = custom_script_vars.theme_directory + '/set-session.php';

            await fetch(phpEndpoint, {
                method: 'POST',
                headers: {
                    'Content-Type': 'application/json',
                },
                body: JSON.stringify({ companyResourcesSessionUserLoggedIn: jsonData }),
            });
            console.log('User logged in:', jsonData);
        } else {
            console.error('Failed to check user login status:', response.status);
        }
    } catch (error) {
        console.error('Error during user login check:', error);
    }
}

Fetch调用的异常结果 #

上述fetch调用返回未认证的结果：

{
  "authenticated": "not auth",
  "roleId": ""
}

疑问 #

我是否在执行不被允许的操作？已在Chrome和Edge浏览器测试，结果一致。猜测fetch调用和直接在标签页访问接口的行为不同，希望了解此类场景的替代实现方案。

内容的提问来源于stack exchange，提问作者Chris Davis