cors 身份验证类型错误 windows - Visual Studio 2019

Question

我开始了一个 .NET CORE 5 项目

而我选择了windows型式认证

类型验证图像

而这种类型的项目在客户端给我一个 CORS 错误（反应）

但是如果我选择无而不是 windows，我不会收到错误

这是来自客户端的调用：

const res = await fetch(`https://localhost:44373/weatherforecast`)

我需要这种类型的项目，因为我想使用 AD 身份验证

我尝试将其添加到 fetch 调用中：

const res = await fetch(`https://localhost:44300/weatherforecast`,{credentials: 'include'})

并更改启动：

using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.HttpsPolicy;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Hosting;
using Microsoft.Extensions.Logging;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;

namespace WebApplication3
{
    public class Startup
    {
        public Startup(IConfiguration configuration)
        {
            Configuration = configuration;
        }

        public IConfiguration Configuration { get; }

        // This method gets called by the runtime. Use this method to 
add services to the container.
        public void ConfigureServices(IServiceCollection services)
        {
            services.AddControllers();
            services.AddCors(options =>
            {
                options.AddPolicy("MyMyAllowCredentialsPolicy",
                    policy =>
                    {
                        policy.WithOrigins("https://localhost:44300")
                               .AllowCredentials();
                    });
            });
        }

        // This method gets called by the runtime. Use this method to 
configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, 
IWebHostEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }

            app.UseHttpsRedirection();

            app.UseCors();

            app.UseRouting();

             app.UseAuthorization();

            app.UseEndpoints(endpoints =>
            {
                endpoints.MapControllers();
            });
        }
    }
}

Answer 1

我还创建了一个新的 .net 6 web api 项目与 Z0F4137ED1502B5045DZ083CAA2 身份验证。 我也有一个前端项目。

这是我的代码，它对我有用。 在我的Program.cs中，我添加了 Cors 策略，其他策略默认生成。

using Microsoft.AspNetCore.Authentication.Negotiate;

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddCors(options =>
{
    options.AddPolicy("mypolicy",
        policy =>
        {
            policy.WithOrigins("http://localhost:8848").AllowCredentials();
                   //.AllowCredentials();
        });
});
// Add services to the container.

builder.Services.AddControllers();
// Learn more about configuring Swagger/OpenAPI at https://aka.ms/aspnetcore/swashbuckle
builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen();


builder.Services.AddAuthentication(NegotiateDefaults.AuthenticationScheme)
   .AddNegotiate();

builder.Services.AddAuthorization(options =>
{
    // By default, all incoming requests will be authorized according to the default policy.
    options.FallbackPolicy = options.DefaultPolicy;
});

var app = builder.Build();
// Configure the HTTP request pipeline.
if (app.Environment.IsDevelopment())
{
    app.UseSwagger();
    app.UseSwaggerUI();
}
app.UseHttpsRedirection();
app.UseCors("mypolicy");
app.UseAuthentication();
app.UseAuthorization();
app.MapControllers();
app.Run();

而我使用ajax发送请求，缺少withCredentials会导致401错误：

$("#btn2").click(function(event) {
                $.ajax({
                    url: "https://localhost:7272/WeatherForecast",
                    type: "get",
                    xhrFields: {
                        withCredentials: true
                    },
                    success: function(data) {
                        alert(data);
                        console.info(data);
                    }
                })
            });

还有一点需要注意的是，在私密模式下打开客户端网站时，还是会遇到401，而在正常的window中打开网站一切正常。 那是因为私有模式不包含我认为的身份验证信息。