使用CookieAuthenticationDefaults与OpenIddict在Angular客户端认证时Cookie未生效求助

问题描述 #

在Angular客户端应用中尝试通过OpenIddict结合CookieAuthenticationDefaults.AuthenticationScheme实现认证，但Cookie始终无法完成认证。

代码片段 #

登录接口代码 #

[HttpPost("login")]
[AllowAnonymous]
public async Task<IActionResult> Login(LoginRequestDTO model)
{
    var user = await _context.Users.Where(x => x.Username == model.Username).FirstOrDefaultAsync();

    if(user == null)
    {
        return Ok(GenericResponse<bool>.Failure("Invalid Username or Password!", Models.Enums.ApiStatusCode.RecordNotFound));
    }
    else
    {
        if(user.Password != model.Password)
        {
            return Ok(GenericResponse<bool>.Failure("Invalid Username or Password!", Models.Enums.ApiStatusCode.RecordNotFound));
        }
        else
        {
            var claims = new List<Claim>
            {
                new Claim(ClaimTypes.Name, model.Username)
            };

            var claimsIdentity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme);

            await HttpContext.SignInAsync(new ClaimsPrincipal(claimsIdentity));

            return Redirect(model.ReturnUrl);
        }
    }
}

认证服务配置代码 #

builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddCookie(CookieAuthenticationDefaults.AuthenticationScheme, options =>
    {
        //options.LoginPath = "/login";
        options.Events = new CookieAuthenticationEvents()
        {
            OnRedirectToLogin = (context) =>
            {
                context.HttpContext.Response.Redirect("http://localhost:4200/login" + context.RedirectUri.Split("Login")[1]);
                return Task.CompletedTask;
            }
        };
    });

可能的问题及解决方法 #

• 跨域Cookie配置缺失
  Angular运行在localhost:4200，若API在不同端口/域名，未正确配置Cookie跨域属性会导致客户端无法携带Cookie。需修改Cookie认证选项：

  options.Cookie.SameSite = SameSiteMode.None;
  options.Cookie.SecurePolicy = CookieSecurePolicy.None; // 生产环境建议改为Always
  options.Cookie.HttpOnly = true;
  

  同时API需配置CORS允许携带凭证：

  builder.Services.AddCors(options =>
  {
      options.AddPolicy("AllowAngular", policy =>
      {
          policy.WithOrigins("http://localhost:4200")
                .AllowAnyHeader()
                .AllowAnyMethod()
                .AllowCredentials();
      });
  });
  // 中间件中启用CORS：app.UseCors("AllowAngular");
  

  Angular端请求时需设置withCredentials: true：

  this.http.post('/api/login', loginData, { withCredentials: true }).subscribe(...);
  

• SignInAsync未显式指定认证方案
  虽然ClaimsIdentity指定了Scheme，但显式传递认证方案给SignInAsync能避免上下文匹配问题：

  await HttpContext.SignInAsync(
      CookieAuthenticationDefaults.AuthenticationScheme, 
      new ClaimsPrincipal(claimsIdentity)
  );
  

• 跨域Redirect导致Cookie丢失
  登录成功后直接Redirect到Angular地址，跨域场景下浏览器可能忽略Set-Cookie响应头。建议返回JSON结果由前端自行跳转：

  return Ok(new { success = true, redirectUrl = model.ReturnUrl });
  

• OpenIddict集成不完整
  代码仅配置了Cookie认证，未包含OpenIddict核心配置。需补充OpenIddict服务注册与中间件：

  builder.Services.AddOpenIddict()
      .AddServer(options =>
      {
          options.SetAuthorizationEndpointUris("/connect/authorize")
                 .SetTokenEndpointUris("/connect/token")
                 .AllowPasswordFlow()
                 .AllowAuthorizationCodeFlow()
                 .UseAspNetCore()
                 .EnableTokenEndpointPassthrough()
                 .DisableAccessTokenEncryption();
      })
      .AddValidation(options =>
      {
          options.UseLocalServer();
          options.UseAspNetCore();
      });
  

  确保中间件顺序正确：app.UseAuthentication() → app.UseAuthorization() → OpenIddict相关中间件。

• 密码明文对比的安全问题
  代码直接对比明文密码存在严重安全风险，应使用哈希算法存储验证：

  // 注册时哈希密码
  user.Password = BCrypt.Net.BCrypt.HashPassword(model.Password);
  // 登录时验证
  if(!BCrypt.Net.BCrypt.Verify(model.Password, user.Password))
  {
      return Ok(GenericResponse<bool>.Failure("Invalid Username or Password!", Models.Enums.ApiStatusCode.RecordNotFound));
  }
  

内容的提问来源于stack exchange，提问作者Muhammad Umair