Hangfire基础认证部署后失效：ASP.NET Core 6.0 Web API授权异常

1. 移除重复的Hangfire Dashboard映射 #

代码中同时调用了app.UseHangfireDashboard和app.MapHangfireDashboard()，这会导致两个端点都指向/hangfire，其中MapHangfireDashboard()未配置认证规则，可能引发路由冲突。直接删除app.MapHangfireDashboard();这一行，仅保留带认证配置的UseHangfireDashboard调用即可。

2. 确认部署环境的配置项加载正常 #

检查部署环境的配置文件（如appsettings.Production.json）是否正确设置了Hangfire:Username和Hangfire:Password，或是否通过环境变量注入了这两个值。可临时添加日志输出验证配置是否加载：

var hangfireUser = app.Configuration["Hangfire:Username"];
var hangfirePass = app.Configuration["Hangfire:Password"];
Console.WriteLine($"Hangfire User: {hangfireUser}, Pass: {hangfirePass}");

若输出为空，说明配置项未正确加载，需修正部署时的配置文件或环境变量设置。

3. 检查自定义Basic认证过滤器的实现 #

确保HangfireCustomBasicAuthenticationFilter正确处理Basic认证逻辑，标准实现示例如下：

using Hangfire.Dashboard;
using System.Text;

public class HangfireCustomBasicAuthenticationFilter : IDashboardAuthorizationFilter
{
    public string User { get; set; }
    public string Pass { get; set; }

    public bool Authorize(DashboardContext context)
    {
        var httpContext = context.GetHttpContext();
        var authHeader = httpContext.Request.Headers["Authorization"].FirstOrDefault();

        if (string.IsNullOrEmpty(authHeader) || !authHeader.StartsWith("Basic "))
        {
            httpContext.Response.StatusCode = 401;
            httpContext.Response.Headers["WWW-Authenticate"] = "Basic realm=\"Hangfire Dashboard\"";
            return false;
        }

        try
        {
            var encodedCredentials = authHeader.Substring("Basic ".Length).Trim();
            var credentials = Encoding.UTF8.GetString(Convert.FromBase64String(encodedCredentials)).Split(':', 2);
            if (credentials.Length != 2) return false;

            return credentials[0] == User && credentials[1] == Pass;
        }
        catch
        {
            httpContext.Response.StatusCode = 401;
            httpContext.Response.Headers["WWW-Authenticate"] = "Basic realm=\"Hangfire Dashboard\"";
            return false;
        }
    }
}

重点注意：

• 正确解析Authorization头格式
• 使用UTF8编码解码Base64字符串
• 处理解析失败的异常情况
• 返回401时添加WWW-Authenticate头，触发浏览器认证弹窗

4. 处理部署环境的反向代理头问题 #

若部署在IIS、Nginx等反向代理之后，代理可能修改或移除Authorization头，导致应用无法获取正确认证信息：

• IIS部署：在web.config中添加重写规则，确保Authorization头正确传递：

<system.webServer>
  <rewrite>
    <outboundRules>
      <rule name="Preserve Authorization Header">
        <match serverVariable="HTTP_AUTHORIZATION" pattern=".*" />
        <action type="Rewrite" value="{HTTP_X_ORIGINAL_AUTHORIZATION}" />
        <conditions>
          <add input="{HTTP_X_ORIGINAL_AUTHORIZATION}" pattern=".+" />
        </conditions>
      </rule>
    </outboundRules>
  </rewrite>
</system.webServer>

• 通用反向代理：在Program.cs中配置转发头，让应用识别代理传递的原始请求信息：

builder.Services.Configure<ForwardedHeadersOptions>(options =>
{
    options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
    // 添加代理服务器IP到允许列表，根据实际部署环境调整
    options.KnownProxies.Add(IPAddress.Parse("192.168.1.100"));
});

// 在UseHttpsRedirection之前调用UseForwardedHeaders
app.UseForwardedHeaders();

内容的提问来源于stack exchange，提问作者Tabish Matin