.NET 6 + React 集成微软外部登录时出现Correlation failed错误

我有一个.NET 6后端应用，正在尝试从React单页应用（SPA）集成微软外部登录功能。后端已实现ExternalLogin和ExternalLoginCallback接口，且在Program.cs中完成了身份认证相关配置。但在微软登录页面填写账号密码后，返回错误："error": "An error was encountered while handling the remote login."，调试时发现内部错误信息为"Correlation failed"，求解决办法。

后端接口代码 #

[HttpPost]
[AllowAnonymous]
public IActionResult ExternalLogin([FromBody] ExternalLoginModel model)
{
    // 请求重定向到外部登录提供程序
    var redirectUrl = $"https://localhost:44366/api/Accounts/ExternalLoginCallback?returnUrl={model.ReturnUrl}";
    var properties = _signInManager.ConfigureExternalAuthenticationProperties(model.Provider, redirectUrl);
    properties.AllowRefresh = true;
    return Challenge(properties, model.Provider);
}

[HttpGet("ExternalLoginCallback")]
[AllowAnonymous]
public async Task<IActionResult> ExternalLoginCallback(string returnUrl = null, string remoteError = null)
{
    if (remoteError != null)
    {
        // 处理外部认证错误
        return BadRequest($"Error from external provider: {remoteError}");
    }

    // 从外部登录提供程序获取用户登录信息
    var info = await _signInManager.GetExternalLoginInfoAsync();
    if (info == null)
    {
        // 如果用户没有账户，提示创建账户
        return BadRequest("External login information not found.");
    }

    // 如果用户已有登录记录，使用该外部登录提供程序登录
    var result = await _signInManager.ExternalLoginSignInAsync(info.LoginProvider, info.ProviderKey, isPersistent: false, bypassTwoFactor: true);
    if (result.Succeeded)
    {
        // 登录成功后，重定向到returnUrl或默认页面
        return Redirect(returnUrl ?? "/");
    }
    return null;
}

Program.cs配置代码 #

builder.Services.AddIdentityCore<User>()
.AddRoles<IdentityRole>()
.AddEntityFrameworkStores<DbCon>()
.AddSignInManager()
.AddTokenProvider(TokenOptions.DefaultProvider, typeof(DataProtectorTokenProvider<User>))
.AddTokenProvider(TokenOptions.DefaultEmailProvider, typeof(EmailTokenProvider<User>))
.AddTokenProvider(TokenOptions.DefaultPhoneProvider, typeof(PhoneNumberTokenProvider<User>))
.AddTokenProvider(TokenOptions.DefaultAuthenticatorProvider, typeof(AuthenticatorTokenProvider<User>));

builder.Services.AddAuthentication(options =>
{
options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
options.DefaultChallengeScheme = CookieAuthenticationDefaults.AuthenticationScheme;
})
.AddCookie(options =>
{
options.Cookie.Name = IdentityConstants.ApplicationScheme;
options.Cookie.HttpOnly = true;
options.ExpireTimeSpan = TimeSpan.FromMinutes(60);
options.LoginPath = "/Account/Login";
options.AccessDeniedPath = "/Account/AccessDenied";
options.SlidingExpiration = true;
})
.AddJwtBearer(x =>
{
x.RequireHttpsMetadata = true;
x.SaveToken = true;
x.TokenValidationParameters = new TokenValidationParameters
{
    ValidateIssuer = true,
    ValidIssuer = builder.Configuration["JWTSettings:Issuer"],
    ValidateIssuerSigningKey = true,
    IssuerSigningKey = new SymmetricSecurityKey(
        Encoding.ASCII.GetBytes(builder.Configuration["JWTSettings:Key"]
    )),
    ValidAudience = builder.Configuration["JWTSettings:Audience"],
    ValidateAudience = true,
    ValidateLifetime = true,
    ClockSkew = TimeSpan.FromMinutes(1)
};
x.Events = new JwtBearerEvents
{
    OnAuthenticationFailed = context =>
    {
        if (context.Exception.GetType() == typeof(SecurityTokenExpiredException))
        {
            context.Response.Headers.Add("Token-Expired", "true");
        }
        return Task.CompletedTask;
    }
};
})
.AddMicrosoftAccount(microsoftOptions =>
{
microsoftOptions.ClientId = builder.Configuration["AzureAd:ClientId"];
microsoftOptions.ClientSecret = builder.Configuration["AzureAd:ClientSecret"];
microsoftOptions.SignInScheme = 
Microsoft.AspNetCore.Identity.IdentityConstants.ExternalScheme;
});

// 外部认证所需的Cookie策略
builder.Services.Configure<CookiePolicyOptions>(options =>
{
// 此lambda用于判断给定请求是否需要用户同意非必要Cookie
options.CheckConsentNeeded = context => false;
options.MinimumSameSitePolicy = SameSiteMode.Unspecified;
});

解决"Correlation failed"错误的常见方案 #

1. 修正Cookie配置 #

外部登录的关联验证依赖IdentityConstants.ExternalScheme对应的Cookie，需调整SameSite策略以适配跨域场景：

• 修改Cookie策略配置：

builder.Services.Configure<CookiePolicyOptions>(options =>
{
    options.CheckConsentNeeded = context => false;
    options.MinimumSameSitePolicy = SameSiteMode.Lax;
});

• 单独为外部认证Cookie配置规则：

.AddCookie(IdentityConstants.ExternalScheme, options =>
{
    options.Cookie.Name = IdentityConstants.ExternalScheme;
    options.Cookie.HttpOnly = true;
    options.Cookie.SameSite = SameSiteMode.Lax;
    options.Cookie.SecurePolicy = CookieSecurePolicy.Always; // 生产环境强制HTTPS
})

2. 确保重定向地址合法 #

• 重定向URL必须是绝对路径，且与Azure门户中配置的"重定向URI"完全一致（包含协议、端口、路径）。
• 用Url.Action生成安全的重定向地址，避免手动拼接：

var redirectUrl = Url.Action(nameof(ExternalLoginCallback), "Accounts", new { returnUrl = model.ReturnUrl }, Request.Scheme);

3. 适配跨域场景（SPA与后端分离） #

• 后端配置CORS时允许凭据传递：

builder.Services.AddCors(options =>
{
    options.AddPolicy("AllowReactApp", policy =>
    {
        policy.WithOrigins("https://localhost:3000") // 替换为你的React应用地址
              .AllowAnyHeader()
              .AllowAnyMethod()
              .AllowCredentials();
    });
});
app.UseCors("AllowReactApp"); // 需放在UseAuthentication之前

• React端发起请求时启用凭据：

fetch('/api/Accounts/ExternalLogin', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    credentials: 'include',
    body: JSON.stringify({ Provider: 'Microsoft', ReturnUrl: '/' })
});

4. 配置DataProtection持久化密钥 #

关联验证依赖DataProtection加密Cookie，多实例或跨环境场景下需配置持久化密钥：

builder.Services.AddDataProtection()
    .PersistKeysToFileSystem(new DirectoryInfo(@"C:\YourKeyPath")) // 替换为实际存储路径
    .SetApplicationName("YourAppUniqueName");

5. 同步服务器时间 #

服务器与微软认证服务器时间差过大可能导致关联验证失败，确保服务器时间与NTP服务器同步。

内容的提问来源于stack exchange，提问作者AirFlight