Blazor Server：SignInAsync执行正常但浏览器未设置认证Cookie

问题背景 #

构建Blazor Server应用时，通过Minimal API端点实现登录功能，服务端表现正常：

• 自定义CustomAuthenticationStateProvider通过NotifyAuthenticationStateChanged正确更新AuthenticationState
• SignInAsync执行无异常，调试时HttpContext包含正确请求头
• POST请求返回200 OK

但浏览器始终未生成认证Cookie，导致AdminLayout.razor的身份验证检查始终判定用户未认证。

相关代码片段 #

Program.cs（认证配置）

builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddCookie(options =>
    {
        options.LoginPath = "/admin/login";
        options.AccessDeniedPath = "/admin/accessdenied";
        options.Cookie.HttpOnly = true;
        options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
        options.Cookie.SameSite = SameSiteMode.Lax;
    });

builder.Services.AddScoped<AuthenticationStateProvider, CustomAuthenticationStateProvider>();
builder.Services.AddScoped<CustomAuthenticationStateProvider>();
builder.Services.AddHttpContextAccessor();

Program.cs中的Minimal API端点

app.MapPost("/admin/postlogin", async (LoginDto dto, CustomAuthenticationStateProvider authProvider) =>
{
    try
    {
        await authProvider.Login(dto);
        return Results.Ok();
    }
    catch (Exception ex)
    {
        return Results.BadRequest(ex.Message);
    }
});

CustomAuthenticationStateProvider

public class CustomAuthenticationStateProvider(
    IGenericRepository<User> userRepository,
    IHttpContextAccessor httpContextAccessor
) : AuthenticationStateProvider
{
    public override Task<AuthenticationState> GetAuthenticationStateAsync()
    {
        var user = httpContextAccessor.HttpContext?.User ?? new ClaimsPrincipal(new ClaimsIdentity());
        return Task.FromResult(new AuthenticationState(user));
    }

    public async Task Login(LoginDto dto)
    {
        var user = await userRepository.FirstOrDefaultAsync(
            u => u.Username == dto.Username,
            u => u.Profile
        );

        if (user == null || !HashingHelper.VerifyPassword(dto.Password, user.PasswordHash))
            throw new Exception("Invalid username or password");

        var claims = new List<Claim>
        {
            new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()),
            new Claim(ClaimTypes.Name, user.Profile.Name),
            new Claim(ClaimTypes.Role, user.Role)
        };

        var claimsIdentity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme);
        var principal = new ClaimsPrincipal(claimsIdentity);

        var httpContext = httpContextAccessor.EnsureHttpContext();

        await httpContext.SignInAsync(
            CookieAuthenticationDefaults.AuthenticationScheme,
            principal,
            new AuthenticationProperties
            {
                IsPersistent = dto.RememberMe,
                ExpiresUtc = DateTimeOffset.UtcNow.AddMinutes(60)
            });

        NotifyAuthenticationStateChanged(Task.FromResult(new AuthenticationState(principal)));
    }
}

登录组件/页面

private async Task Authenticate()
{
    isLoading = true;
    try
    {
        var response = await Http.PostAsJsonAsync("admin/postlogin", LoginDto);
        if (response.IsSuccessStatusCode)
        {
            navigationManager.NavigateTo("/admin", forceLoad: true);
        }
    }
    finally
    {
        isLoading = false;
    }
}

AdminLayout.razor身份验证检查

@code {
    private bool _isAuthorized;
    private bool _checkedAuth;

    protected override async Task OnInitializedAsync()
    {
        var authState = await AuthStateProvider.GetAuthenticationStateAsync();
        var user = authState.User;

        _isAuthorized = user.Identity != null && user.Identity.IsAuthenticated && user.IsInRole("Admin");

        if (!_isAuthorized)
        {
            Navigation.NavigateTo("/admin/login", true);
        }

        _checkedAuth = true;
    }
}

问题原因分析 #

1. Cookie安全策略与开发环境不兼容
   设置了options.Cookie.SecurePolicy = CookieSecurePolicy.Always，该配置要求Cookie只能通过HTTPS协议传输。如果本地开发使用HTTP（非HTTPS），浏览器会拒绝接收此Cookie，导致无法保存。

2. 认证中间件未添加到请求管道
   仅配置了认证服务，但未将UseAuthentication()和UseAuthorization()中间件添加到请求管道中，导致Cookie认证中间件无法处理响应，无法将认证Cookie写入HTTP响应头。

3. CustomAuthenticationStateProvider实现逻辑缺陷
   当前GetAuthenticationStateAsync直接依赖HttpContextAccessor获取用户，但Blazor Server后续的SignalR连接不会携带完整HttpContext，且该实现未与Cookie认证系统正确集成，导致登录状态无法在Blazor组件中持久化。

解决方案 #

1. 调整Cookie安全策略适配开发环境 #

根据环境动态设置Cookie安全策略，开发环境放宽限制：

builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddCookie(options =>
    {
        options.LoginPath = "/admin/login";
        options.AccessDeniedPath = "/admin/accessdenied";
        options.Cookie.HttpOnly = true;
        // 开发环境使用SameAsRequest，生产环境再设为Always
        options.Cookie.SecurePolicy = builder.Environment.IsDevelopment() 
            ? CookieSecurePolicy.SameAsRequest 
            : CookieSecurePolicy.Always;
        options.Cookie.SameSite = SameSiteMode.Lax;
    });

2. 添加认证中间件到请求管道 #

在Program.cs中，将认证和授权中间件添加到路由中间件之前：

// 必须放在路由端点配置之前
app.UseAuthentication();
app.UseAuthorization();

// 配置Minimal API端点
app.MapPost("/admin/postlogin", async (LoginDto dto, CustomAuthenticationStateProvider authProvider) =>
{
    try
    {
        await authProvider.Login(dto);
        return Results.Ok();
    }
    catch (Exception ex)
    {
        return Results.BadRequest(ex.Message);
    }
});

3. 修复CustomAuthenticationStateProvider实现 #

添加用户缓存，适配Blazor Server的SignalR连接场景：

public class CustomAuthenticationStateProvider(
    IGenericRepository<User> userRepository,
    IHttpContextAccessor httpContextAccessor
) : AuthenticationStateProvider
{
    private ClaimsPrincipal _cachedUser = new ClaimsPrincipal(new ClaimsIdentity());

    public override Task<AuthenticationState> GetAuthenticationStateAsync()
    {
        // 初始请求从HttpContext获取，后续使用缓存用户
        if (_cachedUser.Identity?.IsAuthenticated != true)
        {
            var httpUser = httpContextAccessor.HttpContext?.User;
            if (httpUser?.Identity?.IsAuthenticated == true)
            {
                _cachedUser = httpUser;
            }
        }
        return Task.FromResult(new AuthenticationState(_cachedUser));
    }

    public async Task Login(LoginDto dto)
    {
        var user = await userRepository.FirstOrDefaultAsync(
            u => u.Username == dto.Username,
            u => u.Profile
        );

        if (user == null || !HashingHelper.VerifyPassword(dto.Password, user.PasswordHash))
            throw new Exception("Invalid username or password");

        var claims = new List<Claim>
        {
            new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()),
            new Claim(ClaimTypes.Name, user.Profile.Name),
            new Claim(ClaimTypes.Role, user.Role)
        };

        var claimsIdentity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme);
        var principal = new ClaimsPrincipal(claimsIdentity);

        var httpContext = httpContextAccessor.EnsureHttpContext();

        await httpContext.SignInAsync(
            CookieAuthenticationDefaults.AuthenticationScheme,
            principal,
            new AuthenticationProperties
            {
                IsPersistent = dto.RememberMe,
                ExpiresUtc = DateTimeOffset.UtcNow.AddMinutes(60)
            });

        // 更新缓存并通知状态变更
        _cachedUser = principal;
        NotifyAuthenticationStateChanged(Task.FromResult(new AuthenticationState(principal)));
    }
}

4. 优化登录组件跳转逻辑 #

移除forceLoad: true，让Blazor自动感知认证状态变化：

private async Task Authenticate()
{
    isLoading = true;
    try
    {
        var response = await Http.PostAsJsonAsync("/admin/postlogin", LoginDto);
        if (response.IsSuccessStatusCode)
        {
            navigationManager.NavigateTo("/admin");
        }
        else
        {
            var errorMsg = await response.Content.ReadAsStringAsync();
            // 处理登录失败提示
        }
    }
    finally
    {
        isLoading = false;
    }
}

验证步骤 #

1. 确保开发环境使用HTTPS，或已调整Cookie安全策略为SameAsRequest；
2. 登录后查看浏览器Application -> Cookies，确认生成认证Cookie；
3. 跳转至/admin页面，验证AdminLayout能正确识别已登录用户。

内容的提问来源于stack exchange，提问作者Yekopoie