ASP.NET Core(React)部署IIS遇404.15错误，Account/Login请求存疑

已查阅大量相关问题帖，尝试各种修改仍无法解决，十分困惑。

问题现象 #

• 应用在IIS Express上运行正常，但部署到IIS后出现404.15查询字符串过长错误
• 应用无任何控制器或视图，完全通过SignalR通信，却会自动请求Account\Login路径（代码中未配置该路径）
• IIS Express环境下也会发送Account/Login请求，但不会导致应用崩溃

已排查的关键点 #

问题根源锁定在Program.cs的授权配置：
原配置（IIS Express可正常认证用户，IIS部署后报错）：

builder.Services.AddAuthentication(NegotiateDefaults.AuthenticationScheme).AddNegotiate();
builder.Services.AddAuthorization(options => options.FallbackPolicy = options.DefaultPolicy);

若修改授权配置为以下内容，应用不再崩溃，但无法完成Windows用户登录：

builder.Services.AddAuthentication(NegotiateDefaults.AuthenticationScheme).AddNegotiate();
builder.Services.AddAuthorization(options => options.FallbackPolicy = null);

已按多方建议配置web.config，但无效。附上完整web.config和Program.cs代码，恳请提供排查思路。

Edit 1 - web.config #

<?xml version="1.0" encoding="utf-8"?>
<configuration>
<system.webServer>
    <security>
        <requestFiltering removeServerHeader="true">
            <requestLimits maxUrl="4096" maxQueryString="5000"></requestLimits>
        </requestFiltering>
    </security>
<httpProtocol>
    <customHeaders>
        <remove name="X-Powered-By" />
        <add name="X-Frame-Options" value="DENY" />
    </customHeaders>
</httpProtocol>
<handlers>
    <add name="aspNetCore" path="*" verb="*" modules="AspNetCoreModuleV2" resourceType="Unspecified" />
</handlers>
<aspNetCore processPath="bin\x86\Debug\net6.0-windows\PPSim.Web.exe" arguments="" stdoutLogEnabled="true" stdoutLogFile="\.\logs\stdout" startupTimeLimit="3600" requestTimeout="23:00:00" hostingModel="inprocess">
  <environmentVariables>
    <environmentVariable name="ASPNETCORE_HTTPS_PORT" value="443" />
    <environmentVariable name="ASPNETCORE_ENVIRONMENT" value="Development" />
    </environmentVariables>
</aspNetCore>
</system.webServer>
<system.web>
    <httpRuntime enableVersionHeader="false" maxQueryStringLength="32768" maxUrlLength="65536" />
</system.web>
</configuration>

Edit 2 - Program.cs #

var builder = WebApplication.CreateBuilder(args);

#region Services

builder.Services.AddAuthentication(NegotiateDefaults.AuthenticationScheme).AddNegotiate();
builder.Services.AddAuthorization(options => options.FallbackPolicy = options.DefaultPolicy);

builder.Services.AddAntiforgery(options =>
{
    options.HeaderName = CsrfConstants.CsrfHeaderName;
    options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
    options.Cookie.SameSite = SameSiteMode.Strict;
});

builder.Services.AddDbContext<ApplicationDbContext>(options =>
    options.UseSqlite(builder.Configuration.GetConnectionString("DefaultConnection")));

builder.Services.AddIdentity<ApplicationUser, IdentityRole>()
    .AddEntityFrameworkStores<ApplicationDbContext>()
    .AddDefaultTokenProviders();

var settings = new JsonSerializerSettings { ContractResolver = new SignalRContractResolver() };
var serializer = JsonSerializer.Create(settings);
builder.Services.AddSingleton(serializer);

builder.Services.AddHsts(options =>
{
    options.Preload = true;
    options.IncludeSubDomains = true;
    options.MaxAge = TimeSpan.FromDays(60);
});

builder.Services.AddSingleton<IUserSettingsWrapper, UserSettingsWrapper>();
builder.Services.AddSingleton<ISignalREventsPusher, SignalRDataPusher>();


builder.Services.AddSignalR().AddNewtonsoftJsonProtocol(options =>
{
    options.PayloadSerializerSettings.ContractResolver = new CustomCamelCasePropertyNamesContractResolver();
    options.PayloadSerializerSettings.ReferenceLoopHandling = ReferenceLoopHandling.Ignore;
    options.PayloadSerializerSettings.PreserveReferencesHandling = PreserveReferencesHandling.Objects;
});

builder.Services.AddSingleton<IUserIdProvider, NameUserIdProvider>();
builder.Services.AddLogging(loggingBuilder =>
{            loggingBuilder.AddConfiguration(builder.Configuration.GetSection("Logging"));
    loggingBuilder.AddConsole();
    loggingBuilder.AddDebug();
});

builder.Services.AddCors(options =>
    {
        options.AddPolicy("CORSPermission", policy =>
        {
            policy.AllowAnyHeader()
                .AllowAnyMethod()
                .SetIsOriginAllowed(host => true)
                .AllowCredentials();
        });
    });

#endregion

var app = builder.Build();

#region Configure

var antiforgery = app.Services.GetRequiredService<IAntiforgery>();

app.Use((context, next) =>
{
    var requestPath = context.Request.Path.Value;
    
    if (string.Equals(requestPath, "/", StringComparison.OrdinalIgnoreCase)
        || string.Equals(requestPath, "/index.html", StringComparison.OrdinalIgnoreCase))
    {
        var tokenSet = antiforgery.GetAndStoreTokens(context);
        context.Response.Cookies.Append(CsrfConstants.CsrfCookiesName, tokenSet.RequestToken!,
            new CookieOptions
            {
                HttpOnly = false,
                Secure = true, // 15018: Cookie generated by application does not contain the “Secure flag” attribute
                SameSite = SameSiteMode.Strict
            });
    }

    return next(context);
});

if (!app.Environment.IsDevelopment())
{
}
else
{
    app.UseHsts();
    //app.UseExceptionHandler("/Home/Error");
}

app.UseStaticFiles();

app.UseHttpsRedirection();
app.UseRouting();
app.UseCors("CORSPermission");

app.UseAuthentication();
app.UseAuthorization();
app.UseFileServer();

#endregion

app.MapFallbackToFile("index.html");

app.UseEndpoints(endpoints =>
{
    endpoints.MapHub<SimulatorHub>("/SimulatorHub",
        options => options.Transports = GetTransportToUse(app.Environment)).RequireCors("CORSPermission");
});

app.Run();

内容的提问来源于stack exchange，提问作者Alag