Azure中Blazor Cookie认证丢失请求查询参数问题排查

我的应用嵌入在其他应用的iframe中，由宿主应用处理授权并传递认证Cookie，请求格式为https://myapp/resource?clientId=1234&transactionId=12345。两个应用都部署在Azure上，但每次尝试对传入请求进行认证时，请求的查询参数会丢失。本地运行完全正常，但Azure环境下必现该问题。

以下是相关代码：

应用配置代码（Program.cs） #

public static void Main(string[] args)
{
    Logger? logger = LogManager.Setup().LoadConfigurationFromAppSettings().GetCurrentClassLogger();
    logger.Debug("Init main");

    try
    {
        WebApplicationBuilder builder = WebApplication.CreateBuilder(args);
        //logging
        builder.Logging.ClearProviders();
        builder.Host.UseNLog();

        builder.Services.AddAuthentication(options =>
                {
                    options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                })
                .AddCookie(options =>
                {
                    options.LoginPath = "/";
                    options.EventsType = typeof(SecureCookieAuthenticationEvents);
                    options.AccessDeniedPath = "/access-denied";
                });

        builder.Services.AddRazorComponents().AddInteractiveServerComponents();
        builder.Services.AddCascadingAuthenticationState();

        builder.Services.AddDbContext<ConfigurationContext>();
        builder.Services.AddHttpContextAccessor();
        builder.Services.AddAuthorizationBuilder()
                .AddPolicy("CookiePolicy", policy =>
                {
                    policy.Requirements.Add(new SecureCookieRequirement());
                });
        builder.Services.AddScoped<IAuthorizationHandler, SecureCookieAuthorizationHandler>();
        .
                .
                .
        builder.Services.AddScoped<SecureCookieAuthenticationEvents>();
        WebApplication app = builder.Build();

        if (!app.Environment.IsDevelopment())
        {
            app.UseExceptionHandler("/Error");
            app.UseHsts();
        }

        app.UseAuthentication();
        app.UseAuthorization();

        app.UseMiddleware<CookieAuthenticationMiddleware>();

        app.UseHttpsRedirection();
        app.UseStaticFiles();
        app.UseMiddleware<ReverseProxyMiddleware>();
        app.UseAntiforgery();

        app.MapRazorComponents<App>().AddInteractiveServerRenderMode();

        app.Run();
    }
    catch (Exception e)
    {
        logger.Error(e, "Program stopped bue to problem");
        throw;
    }
    finally
    {
        LogManager.Shutdown();
    }
}

CookieAuthenticationMiddleware代码 #

public async Task Invoke(HttpContext context)
{
    this.logger.LogInformation("incoming claims:");
    foreach (Claim claim in context.User.Claims)
    {
        this.logger.LogInformation($"{claim.Type}:{claim.Value}");
    }
    if (context.User.Identity is { IsAuthenticated: false } || context.User.HasClaim(claim => claim.Type == ClaimTypes.Anonymous))
    {
        string clientId = context.Request.Query["clientId"].FirstOrDefault() ?? "";
        string cookie = context.Request.Cookies["CPFCookie"] ?? "";
        List<Claim> claims = new List<Claim>
                {
                    new Claim("clientId", clientId),
                    new Claim("CPFCookie", cookie),
                    new Claim(ClaimTypes.Name, "SecureUser")
                };

        this.logger.LogInformation("new claims:");
        foreach (Claim claim in claims)
        {
            this.logger.LogInformation($"{claim.Type}:{claim.Value}");
        }
        ClaimsIdentity claimsIdentity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme);

        await context.SignInAsync(
            CookieAuthenticationDefaults.AuthenticationScheme,
            new ClaimsPrincipal(claimsIdentity)
        );
    }

    await this.next(context);
}

SecureCookieAuthenticationEvents代码 #

public override async Task SigningIn(CookieSigningInContext context)
{
    ClaimsPrincipal? user = context.Principal;
    if (context.HttpContext.Request.Path.Value == "/_blazor"
        || user is null
        || string.IsNullOrEmpty(user.FindFirstValue("CPFCookie"))
        || string.IsNullOrEmpty(user.FindFirstValue("clientId")))
    {
        List<Claim> ac = new List<Claim>
        {
            new Claim(ClaimTypes.Anonymous, "true")
        };
        ClaimsIdentity anonymous = new(ac, context.Principal?.Identity?.AuthenticationType);
        context.Principal = new ClaimsPrincipal(anonymous);
        return;
    }
    this.logger.LogInformation("SigningIn...");
    bool validated = this.ValidationLogic(context);
    this.logger.LogInformation($"{context.Request.GetDisplayUrl()}");
    this.logger.LogInformation($"{context.HttpContext.Request.Path}");
    IEnumerable<Claim> claims = user.Claims.Append(new Claim("CPFCookieValidated", validated.ToString()));
    ClaimsIdentity identity = new(claims, context.Principal?.Identity?.AuthenticationType);
    context.Principal = new ClaimsPrincipal(identity);
    await base.SigningIn(context);
}

我已经尝试了多种解决方案，当前版本在本地环境运行正常，但Azure环境下问题依然存在。

内容的提问来源于stack exchange，提问作者user1627733