.NET7降级至.NET6后Cookie认证授权问题求助

问题原因 #

降级到.NET6后出现授权错误，核心原因是**.NET6要求必须明确指定默认的认证方案**，而.NET7会自动处理默认方案的设置。原代码中仅添加了Cookie认证方案，但未将其设为默认，导致系统找不到要使用的认证方案。

修改后的Program.cs代码 #

using MCI.Data;
using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.EntityFrameworkCore;
using System;

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddSession();
builder.Services.AddRazorPages();
builder.Services.AddHttpContextAccessor();

// 关键修改：指定默认认证方案为自定义的"MyLockIdentity"
builder.Services.AddAuthentication("MyLockIdentity")
    .AddCookie("MyLockIdentity", options =>
    {
        options.Cookie.Name = "MyLockIdentity";
        options.LoginPath = "/inside/Lock";
        options.AccessDeniedPath = "/AccessDenied";
        // Admin will logout after 10 minutes.
        options.ExpireTimeSpan = TimeSpan.FromMinutes(10);
    });

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("AuthorizAdmin", policy => policy.RequireRole("Admin"));
});

var ConString = builder.Configuration.GetConnectionString("constring").ToString();
builder.Services.AddDbContext<AppDbContext>(options => options.UseSqlServer(ConString));

var app = builder.Build();

// Configure the HTTP request pipeline.
if (!app.Environment.IsDevelopment())
{
    app.UseExceptionHandler("/Error");
    // The default HSTS value is 30 days. You may want to change this for production scenarios.
    app.UseHsts();
}

app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseSession();
app.UseRouting();
app.UseAuthentication();    
app.UseAuthorization();

app.MapRazorPages();

app.Run();

关键修改点说明 #

• 指定默认认证方案：将AddAuthentication()改为AddAuthentication("MyLockIdentity")，直接把自定义的Cookie认证方案设为系统默认的认证、挑战方案。也可以通过如下方式更明确配置：

  builder.Services.AddAuthentication(options =>
  {
      options.DefaultAuthenticateScheme = "MyLockIdentity";
      options.DefaultChallengeScheme = "MyLockIdentity";
      options.DefaultSignInScheme = "MyLockIdentity";
  }).AddCookie("MyLockIdentity", options => { ... });
  

• 移除冗余的AddMvc()：AddRazorPages()已经包含了Razor Pages所需的Mvc核心服务，无需重复添加。

这样修改后，项目在.NET6环境下就能和.NET7中一样正常处理Cookie认证授权了。

内容的提问来源于stack exchange，提问作者Hammad Maqbool