Web API请求中Cookie会话滑动失效及Set-Cookie头添加问题求助

我之前也碰到过类似的MVC+Web API混合应用的会话滑动问题，结合你给出的排查信息和代码，这里有两个针对性的解决方案：

核心问题分析 #

你提到的*“响应头已发送”*异常，本质是Web API的XHR请求往往会先输出响应内容，之后再触发Cookie更新逻辑时，响应头已经无法修改；另外默认的CookieAuthenticationHandler会话滑动逻辑（就是你贴的ApplyResponseGrantAsync里的代码）只会在登录、身份重新生成等特定场景执行，普通Web API请求不会自动触发。

方案一：自定义CookieAuthenticationProvider，强制触发会话滑动 #

通过重写CookieAuthenticationProvider的OnValidateIdentity方法，在身份验证阶段就判断是否需要滑动会话，确保在响应头发送前完成Cookie更新：

修改你的认证配置代码如下：

app.UseCookieAuthentication(new CookieAuthenticationOptions
{
    AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
    LoginPath = new PathString("/Account/Login"),
    Provider = new CookieAuthenticationProvider
    {
        OnValidateIdentity = async context =>
        {
            // 先执行默认的SecurityStamp验证逻辑
            await SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
                validateInterval: TimeSpan.FromMinutes(15),
                regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager))(context);

            // 针对Web API请求，强制触发会话滑动
            var request = context.OwinContext.Request;
            // 可根据实际情况判断Web API请求：比如路径前缀、X-Requested-With请求头
            if (request.Path.StartsWithSegments(new PathString("/api")) || 
                request.Headers.ContainsKey("X-Requested-With"))
            {
                if (context.Identity != null && context.Identity.IsAuthenticated && context.Options.SlidingExpiration)
                {
                    var currentUtc = context.Options.SystemClock.UtcNow;
                    var issuedUtc = context.Properties.IssuedUtc;
                    var expiresUtc = context.Properties.ExpiresUtc;

                    // 会话滑动判断逻辑：当前时间超过票据签发时间+过期时长的一半时，触发滑动
                    var timeElapsed = currentUtc.Subtract(issuedUtc.Value);
                    var timeRemaining = expiresUtc.Value.Subtract(currentUtc);
                    if (timeRemaining < timeElapsed)
                    {
                        // 更新票据的签发和过期时间
                        var newIssuedUtc = currentUtc;
                        var newExpiresUtc = currentUtc.Add(context.Options.ExpireTimeSpan);
                        context.Properties.IssuedUtc = newIssuedUtc;
                        context.Properties.ExpiresUtc = newExpiresUtc;

                        // 标记需要刷新身份，会自动触发ApplyResponseGrantAsync更新Cookie
                        context.RequireRefresh = true;
                    }
                }
            }
        }
    },
    SlidingExpiration = true,
    ExpireTimeSpan = TimeSpan.FromMinutes(1)
});

这个方案的关键是context.RequireRefresh = true;，它会告知认证中间件需要重新生成并发送Cookie，而且逻辑执行在身份验证阶段，早于响应内容输出，不会出现*“响应头已发送”*异常。

方案二：创建Web API Action Filter，手动更新Cookie #

如果方案一不生效，你可以通过自定义Action Filter，在Web API请求执行后手动处理会话滑动：

1. 实现SlidingSessionFilter #

public class SlidingSessionFilter : ActionFilterAttribute
{
    public override async Task OnActionExecutedAsync(HttpActionExecutedContext actionExecutedContext, CancellationToken cancellationToken)
    {
        var owinContext = actionExecutedContext.Request.GetOwinContext();
        var authManager = owinContext.Authentication;
        var user = authManager.User;

        if (user.Identity.IsAuthenticated)
        {
            var authType = DefaultAuthenticationTypes.ApplicationCookie;
            var ticket = await authManager.AuthenticateAsync(authType);

            if (ticket != null)
            {
                var options = owinContext.Get<CookieAuthenticationOptions>(typeof(CookieAuthenticationOptions).FullName);
                if (options == null) return;

                var currentUtc = options.SystemClock.UtcNow;
                var issuedUtc = ticket.Properties.IssuedUtc;
                var expiresUtc = ticket.Properties.ExpiresUtc;

                if (options.SlidingExpiration && issuedUtc.HasValue && expiresUtc.HasValue)
                {
                    var timeElapsed = currentUtc.Subtract(issuedUtc.Value);
                    var timeRemaining = expiresUtc.Value.Subtract(currentUtc);

                    // 判断是否需要触发会话滑动
                    if (timeRemaining < timeElapsed)
                    {
                        // 更新票据的时间属性
                        ticket.Properties.IssuedUtc = currentUtc;
                        ticket.Properties.ExpiresUtc = currentUtc.Add(options.ExpireTimeSpan);

                        // 重新加密票据并生成Cookie
                        var cookieValue = options.TicketDataFormat.Protect(ticket);
                        var cookieOptions = new CookieOptions
                        {
                            HttpOnly = options.Cookie.HttpOnly,
                            Secure = options.Cookie.Secure,
                            Domain = options.Cookie.Domain,
                            Path = options.Cookie.Path,
                            SameSite = options.Cookie.SameSite
                        };

                        if (ticket.Properties.IsPersistent)
                        {
                            cookieOptions.Expires = ticket.Properties.ExpiresUtc.Value.ToUniversalTime().DateTime;
                        }

                        // 确保响应头未发送时再添加Cookie
                        if (!owinContext.Response.HeadersWritten)
                        {
                            options.CookieManager.AppendResponseCookie(owinContext, options.CookieName, cookieValue, cookieOptions);
                        }
                    }
                }
            }
        }

        await base.OnActionExecutedAsync(actionExecutedContext, cancellationToken);
    }
}

2. 注册Filter到Web API配置 #

public static void Register(HttpConfiguration config)
{
    // 其他Web API配置...
    config.Filters.Add(new SlidingSessionFilter());
}

这个方案直接在Web API请求完成后检查会话状态，手动更新Cookie，通过!owinContext.Response.HeadersWritten判断避免异常。

额外注意事项 #

• 确保你的SPA发起XHR请求时设置了withCredentials: true（同域请求默认可能已生效，但跨域时必须设置），否则浏览器不会保存Set-Cookie头。
• 所有需要触发会话滑动的Web API控制器/方法都要标记[Authorize]特性，只有已认证的请求才需要处理。
• 确认Owin中间件顺序正确：UseCookieAuthentication必须在UseWebApi之前注册，否则认证逻辑不会生效。

内容的提问来源于stack exchange，提问作者Mike Perrenoud