Docker配置Duende IdentityServer 6遇Cookie警告问题求助

我的系统包含：

• Duende IdentityServer 6容器（idp）
• 基于Duende.BFF的BFF模式React客户端应用（cli）

应用必须运行在HTTP环境中，前端会部署带TLS的负载均衡器，因此内部通信只能用HTTP。

简化版Docker Compose配置：

services:
  idp:
    build: ./<Identity-folder>
    ports:
      - "5000:80"
    environment:
      - ...
  cli:
    build: ./<Client-folder>
    ports:
      - "5002:80"
    environment:
      - AUTHORITY=http://idp
      - REQUIREHTTPSMETADATA=false

点击客户端登录时出现以下警告：

cli-1  | warn: Microsoft.AspNetCore.Http.ResponseCookies[1]
cli-1  |       The cookie '.AspNetCore.OpenIdConnect.Nonce.CfDJ8F-b95I6wSdJpaLTwuHEFX_Az_Khhb2aOJ7MvLT7345b_zt-x9cVcuNtMmP6mAWRwuExmttQyom3HinNzSetJ19_I766jjXwwT4S9mdj9uj1qlrnd_fxy401UYZmdIwak7aeuoC5Re98QlcaH5V48Uahv_Hcvo6RjQEEigx9eCqY-UM3oBAuVA2nLhvxt8W1KV6WS9lvN2TeL1jVzZrSuCXAj7nJAvlgT1ovdTxN_3K4_m3Q60kYrrceGCz8RYhiftDLF5yNGIsDssQHFz0ReBo' has set 'SameSite=None' and must also set 'Secure'.
cli-1  | warn: Microsoft.AspNetCore.Http.ResponseCookies[1]
cli-1  |       The cookie '.AspNetCore.Correlation.yYUba7j9MG6EzwnzfS00gE9OOov4yFFE742naXtZFoY' has set 'SameSite=None' and must also set 'Secure'.

IdP的program.cs相关配置 #

...
builder.Services.AddRazorPages();

var cert = SigningCredentialConfiguration.GetFromFile(gConfig);

builder.Services
    .AddIdentityServer(options =>
    {
        options.Events.RaiseErrorEvents = true;
        options.Events.RaiseInformationEvents = true;
        options.Events.RaiseFailureEvents = true;
        options.Events.RaiseSuccessEvents = true;

        options.EmitStaticAudienceClaim = true;

        options.KeyManagement.Enabled = false;

        options.Authentication.CheckSessionCookieSameSiteMode = SameSiteMode.Strict;
    })
    .AddInMemoryIdentityResources(InMemoryConfig.IdentityResources)
    .AddInMemoryApiScopes(InMemoryConfig.ApiScopes)
    .AddInMemoryClients(InMemoryConfig.Clients)
    .AddAspNetIdentity<AppUser>()
    .AddSigningCredential(cert);
...

InMemoryConfig.Clients配置 #

...
new Client
{
    ClientId = "client",
    ClientSecrets = { new Secret("secret".Sha256()) },

    AllowedGrantTypes = GrantTypes.Code,

    RedirectUris = { "http://localhost:5002/signin-oidc", "http://cli/signin-oidc" },
    FrontChannelLogoutUri = "http://localhost:5002/signout-oidc",
    PostLogoutRedirectUris = { "http://localhost:5002/signout-callback-oidc" },

    AllowOfflineAccess = true,
    AllowedScopes = { "openid", "profile", ... },
    AllowPlainTextPkce = true,
},
...

客户端应用program.cs配置 #

...
builder.Services
    .AddAuthentication(options =>
    {
        options.DefaultScheme = "cookie";
        options.DefaultChallengeScheme = "oidc";
        options.DefaultSignOutScheme = "oidc";
    })
    .AddCookie("cookie", options =>
    {
        options.Cookie.Name = "__Host-bff";
        options.Cookie.SameSite = SameSiteMode.Strict; // Strict

        options.Cookie.SecurePolicy = CookieSecurePolicy.None;
        options.Cookie.IsEssential = true;
    })
    .AddOpenIdConnect("oidc", options =>
    {
        options.Authority = gConfig.Authority;
        options.RequireHttpsMetadata = gConfig.RequireHttpsMetadata;

        options.ClientId = "client";
        options.ClientSecret = "secret";
        options.ResponseType = "code";
        options.ResponseMode = "query";
      
        options.GetClaimsFromUserInfoEndpoint = true;
        options.MapInboundClaims = false;
        options.SaveTokens = true;

        options.Scope.Clear();
        options.Scope.Add("openid");
        options.Scope.Add("profile");
        options.Scope.Add("offline_access");
    });
...

这些警告来自OpenIdConnect中间件生成的nonce和correlation cookie，它们默认设置了SameSite=None但未配置Secure。由于内部使用HTTP，无法强制启用Secure，需调整OpenIdConnect的Cookie配置：

客户端配置调整 #

在客户端的AddOpenIdConnect配置中，添加nonce和correlation cookie的专属设置，指定SameSite模式为Lax或Strict，同时关闭Secure要求：

.AddOpenIdConnect("oidc", options =>
{
    // 原有配置保持不变...

    // 配置Nonce Cookie
    options.NonceCookie.SameSite = SameSiteMode.Lax;
    options.NonceCookie.SecurePolicy = CookieSecurePolicy.None;

    // 配置Correlation Cookie
    options.CorrelationCookie.SameSite = SameSiteMode.Lax;
    options.CorrelationCookie.SecurePolicy = CookieSecurePolicy.None;
});

IdP配置调整 #

同时需要确保IdentityServer的认证Cookie适配HTTP环境，在IdP的AddIdentityServer配置后添加Cookie认证配置：

builder.Services.AddIdentityServer(options =>
{
    // 原有配置保持不变...
})
.AddAspNetIdentity<AppUser>()
// 添加认证Cookie适配配置
.AddCookieAuthentication(options =>
{
    options.Cookie.SameSite = SameSiteMode.Lax;
    options.Cookie.SecurePolicy = CookieSecurePolicy.None;
})
.AddSigningCredential(cert);

调整后即可消除警告，保证HTTP环境下Cookie正常工作。注意生产环境通过负载均衡器走HTTPS时，需将SecurePolicy改回CookieSecurePolicy.Always。

内容的提问来源于stack exchange，提问作者macosta