.NET Core 6 Web API角色授权时会话未配置异常求助

1. 注册Session服务 #

在Program.cs中先配置Session服务，必须放在授权相关服务之前：

builder.Services.AddSession(options =>
{
    // 可按需设置Session过期时间，示例设为30分钟
    options.IdleTimeout = TimeSpan.FromMinutes(30);
    options.Cookie.HttpOnly = true;
    options.Cookie.IsEssential = true;
});

// 接着注册授权策略与自定义处理器
builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("SessionBasedPolicy", policy =>
        policy.Requirements.Add(new SessionBasedAuthorizationRequirement(/* 传入你的角色枚举值 */)));
});
builder.Services.AddScoped<IAuthorizationHandler, SessionBasedAuthorizationHandler>();
// 务必注册IHttpContextAccessor
builder.Services.AddHttpContextAccessor();

2. 调整中间件顺序 #

管道配置中UseSession必须在UseAuthorization之前执行，否则授权处理器无法访问Session：

app.UseHttpsRedirection();
app.UseStaticFiles();

// 先启用Session中间件
app.UseSession();

app.UseRouting();

// 再启用授权中间件
app.UseAuthorization();

app.MapControllers();
app.MapFallbackToFile("index.html"); // React应用的路由 fallback

3. 跨域场景允许凭证传递 #

如果React前端与API后端跨域部署，需要配置CORS允许携带Cookie/Session：

builder.Services.AddCors(options =>
{
    options.AddPolicy("AllowReactApp", policy =>
    {
        policy.WithOrigins("http://localhost:3000") // 替换为你的React应用实际地址
              .AllowAnyHeader()
              .AllowAnyMethod()
              .AllowCredentials();
    });
});

// 管道中需在UseRouting前启用CORS
app.UseCors("AllowReactApp");

4. 优化授权处理器的HttpContext获取方式 #

可以直接从AuthorizationHandlerContext的Resource属性获取HttpContext，无需依赖IHttpContextAccessor：

protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, SessionBasedAuthorizationRequirement requirement)
{
    var httpContext = context.Resource as HttpContext;
    if (httpContext == null)
    {
        context.Fail();
        return Task.CompletedTask;
    }

    string role = httpContext.Session.GetString("Role");
    if (role == null)
    {
        context.Fail();
        return Task.CompletedTask;
    }

    if (role == requirement.Role.ToString())
    {
        context.Succeed(requirement);
    }
    else
    {
        context.Fail();
    }

    return Task.CompletedTask;
}

内容的提问来源于stack exchange，提问作者Dakata RM