使用Services.AddAuthentication()导致ASP.NET Core应用启动终止

问题现象 #

在基于.NET 7 SDK通过dotnet new webapi创建的基础WebAPI项目中，添加自定义Basic认证处理器后，应用在服务器B上启动时会在完成前突然退出，无任何异常信息或日志输出，Windows注册表也无相关记录。本地开发环境及服务器A上运行正常。

添加认证处理器的代码如下：

builder.Services.AddAuthentication()
        .AddScheme<AuthenticationSchemeOptions, BasicAuthenticationHandler>(
            BasicAuthenticationDefaults.AuthenticationScheme, null);

BasicAuthenticationHandler逻辑仅包含：读取Authorization请求头、移除Basic 前缀、Base64解码凭证、校验凭证是否存在于预设的Dictionary<string,string>中。

开启详细日志后，发现进程在执行DPAPI密钥解密步骤后终止，日志片段如下：

[System         ][DBUG][23-11-17T14:27:54.9231+01:00][0][        Microsoft.Extensions.Hosting.Internal.Host]`Hosting starting`
[System         ][INFO][23-11-17T14:27:55.4962+01:00][0][NetCore.DataProtection.KeyManagement.XmlKeyManager]`User profile is available. Using 'C:\Users\p.dicaprio.extblar\AppData\Local\ASP.NET\DataProtection-Keys' as key repository and Windows DPAPI to encrypt keys at rest.`
[System         ][DBUG][23-11-17T14:27:55.5027+01:00][0][ataProtection.Repositories.FileSystemXmlRepository]`Reading data from file 'C:\Users\p.dicaprio.extblar\AppData\Local\ASP.NET\DataProtection-Keys\key-70202a7b-a057-403b-b974-5060170571f3.xml'.`
[System         ][DBUG][23-11-17T14:27:55.5232+01:00][0][NetCore.DataProtection.KeyManagement.XmlKeyManager]`Found key {70202a7b-a057-403b-b974-5060170571f3}.`
[System         ][DBUG][23-11-17T14:27:55.5363+01:00][0][re.DataProtection.KeyManagement.DefaultKeyResolver]`Considering key {70202a7b-a057-403b-b974-5060170571f3} with expiration date 2024-02-15 13:20:05Z as default key.`
[System         ][DBUG][23-11-17T14:27:55.5390+01:00][0][.AspNetCore.DataProtection.TypeForwardingActivator]`Forwarded activator type request from Microsoft.AspNetCore.DataProtection.XmlEncryption.DpapiXmlDecryptor, Microsoft.AspNetCore.DataProtection, Version=7.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60 to Microsoft.AspNetCore.DataProtection.XmlEncryption.DpapiXmlDecryptor, Microsoft.AspNetCore.DataProtection, Culture=neutral, PublicKeyToken=adb9793829ddae60`
[System         ][DBUG][23-11-17T14:27:55.5429+01:00][0][ore.DataProtection.XmlEncryption.DpapiXmlDecryptor]`Decrypting secret element using Windows DPAPI.`

另外，app.Run()已被try/catch(Exception)包裹，但捕获块未输出任何日志。

解决方法 #

联系服务器B的运维提供商，将应用程序所在文件夹添加到Sophos杀毒软件的排除列表后，应用恢复正常启动，完整日志片段如下：

[System         ][DBUG][23-11-21T07:07:43.1380+01:00][0][ore.DataProtection.XmlEncryption.DpapiXmlDecryptor]`Decrypting secret element using Windows DPAPI.`
[System         ][DBUG][23-11-21T07:07:43.1733+01:00][0][.AspNetCore.DataProtection.TypeForwardingActivator]`Forwarded activator type request from Microsoft.AspNetCore.DataProtection.AuthenticatedEncryption.ConfigurationModel.AuthenticatedEncryptorDescriptorDeserializer, Microsoft.AspNetCore.DataProtection, Version=7.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60 to Microsoft.AspNetCore.DataProtection.AuthenticatedEncryption.ConfigurationModel.AuthenticatedEncryptorDescriptorDeserializer, Microsoft.AspNetCore.DataProtection, Culture=neutral, PublicKeyToken=adb9793829ddae60`
[System         ][DBUG][23-11-21T07:07:43.1828+01:00][0][atedEncryption.CngCbcAuthenticatedEncryptorFactory]`Opening CNG algorithm 'AES' from provider 'null' with chaining mode CBC.`
[System         ][DBUG][23-11-21T07:07:43.1842+01:00][0][atedEncryption.CngCbcAuthenticatedEncryptorFactory]`Opening CNG algorithm 'SHA256' from provider 'null' with HMAC.`
[System         ][DBUG][23-11-21T07:07:43.1857+01:00][0][tCore.DataProtection.KeyManagement.KeyRingProvider]`Using key {70202a7b-a057-403b-b974-5060170571f3} as the default key.`
[System         ][DBUG][23-11-21T07:07:43.1890+01:00][0][ataProtection.Internal.DataProtectionHostedService]`Key ring with default key {70202a7b-a057-403b-b974-5060170571f3} was loaded during application startup.`
[System         ][INFO][23-11-21T07:07:43.3196+01:00][0][                        Microsoft.Hosting.Lifetime]`Now listening on: http://0.0.0.0:5000

原因推测 #

Sophos杀毒软件的防护规则拦截了ASP.NET Core DataProtection模块的DPAPI密钥解密操作，导致应用进程被强制终止，因此无法捕获到异常或生成相关日志。

内容的提问来源于stack exchange，提问作者Pietro di Caprio