You need to enable JavaScript to run this app.
优惠活动
大模型
产品
解决方案
定价
更多

.NET权限授权中Cookie溢出问题及解决方案咨询

avatar
云原生阿岚
2026-8-9
解决.NET Identity Cookie因权限过多导致的溢出问题

我实现了一个自定义授权机制，通过存储过程校验用户访问权限，代码如下：

protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, OptekRequirement requirement)
{
    // Log as a warning so that it's very clear in sample output which authorization policies 
    // Check the user's age
    var userName = context.User.Identity.Name;

    if (userName != null)
    {
        var permissions = _dbContext.OptekAuthorizedto.FromSqlRaw($"EXECUTE VerifyAuthorizationRule '{userName}','{requirement.Rule}'").ToList();
        var permission = permissions.FirstOrDefault();

        if (permission != null)
        {
            context.Succeed(requirement);
        }
        else
        {
            _logger.LogInformation("Not Authorized");
        }
    }         

    return Task.CompletedTask;
}

数据库中权限定义示例如下：

public static class Invoice
{
      public const string View = "Permissions.Invoice.View";
      public const string Create = "Permissions.Invoice.Create";
      public const string Edit = "Permissions.Invoice.Edit";
      public const string Delete = "Permissions.Invoice.Delete";
}

系统共有560个页面的权限，通过给用户分配角色、为角色绑定权限的方式管理。当给角色添加过多权限时，会出现无法登录的503错误，减少部分权限后系统恢复正常。推测是.NET将所有权限写入Cookie导致Cookie溢出，请求解决该问题。

从HttpRequest中获取的Set-Cookie信息如下：

Set cookie: .AspNetCore.Identity.ApplicationC1=CfDJ8HcqA48u9dlJhQCS1I7dylHXAGtk-B2f164O4jmKJz339TbUPtGAKoDc8RRUbf9k7JlXkPxPxtwYyrSeD80XNjHUEVSzIOIhkvvrTInvXFibgYFmygMAbJAYNw6-Ff9VyB4evNnvIe0mmZGsTp-3ZjCdxXTvecWmhli_raq84Zl9alytSiNv2Mo8FVM72D0PylAYDEf9h9iiZWGncrHR7YsbhJ1hk9WiyBx0kDxWmM1W9SLEi4rjevmibSdU_QkQd-Dg2kEBTLWlW38KgX0tkqDHbuz7ZPQOMT_EYebZyK3yY15PVR8Yjygmq2vZvkIT69-EwHY7jIOKUCt7MGlK312mm8QoB5kPDnSJHMxvyuVzcbSu-gt1aNrrryo65gV134HX4_JFcuSdWeby7f0aeRNGPQJ4flUn4A-t18AGoIdweshiNb4JNlvXmUy_tBzph7gE1dlfIwfckksw5nDsJPzg5JXECPVajpheUGgETSejtIp1f5kyu18RKW7b0NL5e2TbN3PPCeo_lWEW1MGYYhxwZbfJ6BXhmb9M_KzQWqNeSQEndwi5jJ9u-rIW4q2roTg4lZ3B5sc81lTsbW9Jxg2mv4NvdVifBvb5l1dU4ccBvdADcFapY67OWN0C6BqVzl7rVegXJ4jfcmSL_LFiOzDQlrVsxGu2YyBMZcuDLqmWs2QzHU4NVyWgcz_Rkr-YgfDMsP2upaLLB5wJ0Iv33Pyg81QJ-LdsR6qvUvi2OYGsma9tIjBvalgK61PiJESdCpzKG4ZiZMaY6vQ1Zs9ZDZKJqJacWS-aszMc5ALl89jhaz6ROkmlF_Qg_CJ64yJUK5_BtOI_SSjQzNHD8Y1PeNUdy_Y-eTqS1IbQyyjSLOX3WNb_KqOJYlNAtA8cqPrgxzkfjvs0IG-gRfPSF1_9sw5EHbpAuM1zpPO5hxzda3_9vcEt-qubjyRIx3u95hM8EtzKJPb89h6_O6lyW57AQxHH7ui1zLt4AE4e0eL7k_c5-hi09eAzP0FgR_HyGyGGJW9szl41PJFDbb7Plr02vcJKRaPBbfxDnyqhw573SOkIZLDgELRgkDVoiNsgKGTFcxZTxx8JtETXsQ9g2lm1BwxVxADvM68rAMQjjpMzLHkk768RGk6anJ48fErKNVK4nn5Ex7N4hIx0fpQDPLWG46BNDVOemTx3x6z4JgjM5EtsRG6QoFIT-4Z453rrFazUt-84QXvCAy1KV85LYkRXD9TrUmheAgWVca_da5WcPYrB3TsNOqOzqv2aGr44ONyaXjmxmXhDtQjGBk-NN-ueIfSGtzrI2UuGFbh5w6cvXvM5obYMNDP07B0jF8hy7Lu5OG3PyH4T7Buk5fLS5c1R6ZYPbrzTLNUIBwkIzGb8_AeOV-L4fFbbtLiPFNKBqSVr9jQSkxE35cgF-rSvzfuC5-wRgJSUO2mnag4XysMNLYZSwLKSir6eaDPuzyYfJ8q0IbqUZRNn8fnuIaHSIUB_tRJqmxOlfUIohiUeXOyvoMwyL1iTevK6joghgvO8nQteXMfNPUNHs2bg7u0br_mUeEVAxargeszimtDD1xgcC5o3urUPtxbgk1a_Ks3hvVzdHW4_p4RLWrmwm4IiZb3zZayYYGy90uiHOQpCXtXeFKLq5qLU7SVJ7Jl-__8Q8S_JXvsIrq8DSuhQ-lyqbSUuS6k3emb9124Y2D5j4al67N53cm8-ho-7J-bDGD4PWRGsb_lNZr6tr4OIZRkFiICgwDVhDSCzTqyXFz6kGyTpnN1g0u_DCndiiM8gBDAFQy1AWqcI4RptSclWyyvt_IqQMq1CVQ-fRxppifUJf8fN5nEmOSwnJW7y7FBRuHorSvo9SAnf7NlZCeoMmmF0-Lq1ZmqR7CbUlbnI6vAfmFiGhybMXPoBt1ogCbNpskGIgDGBmPMPYyYLfvXphvEvDH8hXBRHhaDjFjLYsnvuzFgIMBASyaBiUGAc8gOvrwSfd81U2tDUSiSiMa7n84n2gnoXhEvR33blF197HJsAknK6HANNQZsaJ7gNhkIZeKK5VmC2BHcoWMv-MqDXngPGzNPj8pNb0hXsB5QiuafRoNI8FGTFwEyc6KIad7jBnbs4vt_7bHlXri79YIlAABwfpJdk7ZQFuMcpYASkWT7mhwwpysyn021YVj_w2iASPwdRh_vJDTbMcGWZsrBYM5E7SbHPDC4w8T_7aX6Z4eSo1ENDfp-G54b9VA3Bz-D_XIk7D-_F59jFUyH8-KmhA2qPBr6Ictyb89ZJboTmUdxRDs3wojbcztfYDFBd1ICn90IsS1a8Ffq9KnxhfudIKtxZRd99mlssRxXR0e5J4V-wq5xtAvkT-PPCcQTon1tKj7kLlTCqbzZl1neU1yoZ_7jAmETyB5_CyBRfz9omCHKLe3Bp_dIKJlFLukKetHslc1USxFS2gkLvuhdwn2HxnF3bdYMKfJ1sj9D8V4_AHm5cKvrOpXFEmwO_nvP3hL6_YJbc4ApKxZdR4UaZGBXl9Uh3eaCiwmccOmtVKx9fjQySj7QCcXB-rsW1YivE1qCyrlDrd7vSDvD4pSRJEmJ4ySMhdN_zpZKIuM4257Ji04yiERGiMgCZQJASlP5WwLAbbewSyJt8sBmaAAxLDWKxTB_1LUaaOLzoILqqSj3cj0wof4uHWEawXWd56qGIwvMcgsrvx3GqNwwvPk276fed4ZjlTltitc-YHsM7gw3tE8DuKgPbbR__nRRhmMadVBhoNkUayyF3doErQ7iEVrWVmlmx8nyLEhjQJxPA554CRObkZA37HVsIlj2bHm0SCyY6o8GD860uuArktUA8U50UwbgRj-TUZjiDOcdGemqVfgsUCCE45SmlVGlsyk-JUOu1G68RwPXBZSTr_9oD7SIaZfjW3kaDQ6h3jjf6zeXM525OWCTHp-_hdAnqvDMpoyag5QIJwNN2cnsmHZH8M3GIzABPBvdTJaR78LyhA1fDMDZGZt5eB_Iyin8fYjzjx7Db5kpm1mOeV_sG0cOhYtv_P4Qajm3FvQjctK8_I4fx3TAgZ6q_vQxn8v2muJswVdOWzYBJI5dJ-Ys_RglKU1xS0P9ZOLceP_dvGZvsRrs54gI0PkITKhr_4JZ5yW9nd0RoTEglFCzA90hhUjX2p8Up1D6kREwUpqK96AZzSkpHBVU30RGP7caoqk3dLUS03u9v7A-rzIH3QpmAZ8IQbBDUf2VTJziwaX4wPfiHf3gktCKYxfjm-QFIiLgwKj9r6VI_N33-bqjGXcwfkQwEw5nKyWAt74IKM2RpIIYRxocF0rR2lg0K5YQA_mTx1hLqfKp8--EsUujZqU3IOC-lwvWtDQjubcguc0soKSBzrwD-pdz9dtPv2yOHEH3W9L6ODNUnvKjhHID-YRjjXoTN5e3ndRfo0I31T8GcIazi5Ud53fIrB6fVdYfFxBYlSlibxQyUFp7hgrK5GlMrYQNzTANHvuYIkuWgQ6QMUlnEUdYgjkxj_Oyn9J8NsAgMV4FsQlOk-vD3DVBNbwtjGBD-xaTOXaHgSnk0F-W93gMZtwu8Tk5s1FXVpPIjR-FnmfofMeXHwoNp2EhEE4p1IP6vkSuMKRV5lEYNnPJiCpJUsU-5X3j_Ugoz6fufx9MfeZlhmH6FbxhfFoX2EJfA7JEhoTaFlTYW65d0YGe_ndHyOHyNpLXWlG2phFWTswHQ4QYMONGCLVkmui9cgbcXR-dscSwUG3rOFcdTHPgposqm6CVs2X1YIqRG_JwINlGnsdKjMBscyaeg-H-Oa2XKklfqNcTDLe2WULrH2MiswQG6bF1nZ-wt7gP_a4YYfvR1eBSKAMMjn5NK7X0SQqlehsIAgwAm1Ds5OdjgHFaVaYFVjdnPLdxubpxydPCumYHmO8pPSI2CbsGWYoX7g7hXbrevzRCYpTUNu29S4cTZ3fq; expires=Thu, 04 May 2023 16:59:48 GMT; path=/; secure; samesite=lax; httponly

解决方案

  • 移除Cookie中的权限存储
    你的授权逻辑已经通过存储过程实时校验权限，完全不需要把权限写入Cookie。修改登录时的Claims生成代码，只保留用户ID、用户名等核心标识，删除所有权限相关的Claim。这样Cookie体积会大幅缩小，从根源解决溢出问题。

  • 启用Cookie分块功能
    如果必须保留部分权限在Cookie中，可开启ASP.NET Core的Cookie分块，将大Cookie拆分为多个小Cookie，规避浏览器单Cookie大小限制（通常为4KB）。在Program.cs中配置：

    services.ConfigureApplicationCookie(options =>
{
    options.CookieManager = new ChunkingCookieManager();
    // 可设置单Cookie最大大小，默认4096字节
    options.Cookie.MaxSize = 4096;
});

  • 服务器端存储权限
    登录成功后将用户权限存入分布式缓存（如Redis、MemoryCache），用用户ID作为缓存Key。后续授权时直接从缓存读取权限，Cookie仅存储用户标识。示例代码：

    // 登录时存储权限
var permissions = await GetUserPermissionsFromDb(userId);
await _distributedCache.SetStringAsync($"UserPermissions:{userId}", 
    JsonSerializer.Serialize(permissions),
    new DistributedCacheEntryOptions { AbsoluteExpirationRelativeToNow = TimeSpan.FromHours(8) });

// 授权Handler中读取权限
var permissionsJson = await _distributedCache.GetStringAsync($"UserPermissions:{userId}");
var permissions = JsonSerializer.Deserialize<List<string>>(permissionsJson);

  • 优化权限粒度
    560个页面权限过于细碎，可按模块或功能组合并权限。例如将Permissions.Invoice.View/Create/Edit/Delete合并为Permissions.Invoice.FullAccess，减少权限数量的同时简化管理，间接降低Cookie体积。

内容的提问来源于stack exchange，提问作者o i

相关产品推荐
方舟 Agent Plan

超全模态模型 × Harness 升级，最新支持 Deepseek-V4.1-Flash、GLM-5.3 系列、Doubao-Seedream-5.0-pro、Kimi-K3 (部分)， 限时 9.9 元起

产品介绍相关文档
相关产品推荐
方舟 Agent Plan

超全模态模型 × Harness 升级，最新支持 Deepseek-V4.1-Flash、GLM-5.3 系列、Doubao-Seedream-5.0-pro、Kimi-K3 (部分)， 限时 9.9 元起

产品介绍相关文档
火山引擎 最新活动
全面开放
Doubao-Seedance-2.5全新模型升级

模型再升级,30秒超长叙事, 模态参考扩容

HOT
方舟Codingplan

模型自由，工具不限，最新支持 Deepseek-V4 系列、GLM-5.3 系列

HOT
方舟Agent plan

超全模态模型 × Harness 升级，最新支持 Deepseek-V4.1-Flash、GLM-5.3 系列

HOT
新用户特惠专场

大模型19元起，Al应用9.9元畅享，新人首购爆款尽享优惠

最近更新时间：2026.08.09 22:56:30