![](/img/trans.png)
[英]SignInManager.PasswordSignInAsync() succeeds, but User.Identity.IsAuthenticated is false
[英]OWIN authentication succeeds but User.Identity.IsAuthenticated is false
我開發了一個使用 OWIN 身份驗證的站點。 一切正常,但突然間,沒有任何代碼更改,站點身份驗證停止工作。 當我輸入用戶名和密碼時,對SignInManager.PasswordSignInAsync
的調用成功,但User.Identity.IsAuthenticated
仍然是false
。
這是 Startup.Auth.cs:
public partial class Startup
{
// For more information on configuring authentication, please visit https://go.microsoft.com/fwlink/?LinkId=301864
public void ConfigureAuth(IAppBuilder app)
{
// Configure the db context, user manager and signin manager to use a single instance per request
app.CreatePerOwinContext<ApplicationUserManager>(ApplicationUserManager.Create);
app.CreatePerOwinContext<ApplicationRoleManager>(ApplicationRoleManager.Create);
app.CreatePerOwinContext<ApplicationSignInManager>(ApplicationSignInManager.Create);
// Enable the application to use a cookie to store information for the signed in user
// and to use a cookie to temporarily store information about a user logging in with a third party login provider
// Configure the sign in cookie
app.UseCookieAuthentication(new CookieAuthenticationOptions
{
AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
LoginPath = new PathString("/Account/Login"),
Provider = new CookieAuthenticationProvider
{
// Enables the application to validate the security stamp when the user logs in.
// This is a security feature which is used when you change a password or add an external login to your account.
OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
validateInterval: TimeSpan.FromMinutes(30),
regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager))
}
});
app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);
// Enables the application to temporarily store user information when they are verifying the second factor in the two-factor authentication process.
app.UseTwoFactorSignInCookie(DefaultAuthenticationTypes.TwoFactorCookie, TimeSpan.FromMinutes(5));
// Enables the application to remember the second login verification factor such as phone or email.
// Once you check this option, your second step of verification during the login process will be remembered on the device where you logged in from.
// This is similar to the RememberMe option when you log in.
app.UseTwoFactorRememberBrowserCookie(DefaultAuthenticationTypes.TwoFactorRememberBrowserCookie);
// Uncomment the following lines to enable logging in with third party login providers
//app.UseMicrosoftAccountAuthentication(
// clientId: "",
// clientSecret: "");
//app.UseTwitterAuthentication(
// consumerKey: "",
// consumerSecret: "");
//app.UseFacebookAuthentication(
// appId: "",
// appSecret: "");
//app.UseGoogleAuthentication(new GoogleOAuth2AuthenticationOptions()
//{
// ClientId = "",
// ClientSecret = ""
//});
}
}
這里是執行身份驗證的地方:
public override Task<SignInStatus> PasswordSignInAsync(string userName, string password, bool isPersistent, bool shouldLockout)
{
var result = base.PasswordSignInAsync(userName, password, isPersistent, shouldLockout).Result;
if (result == SignInStatus.Success)
{
ApplicationUser user = this.UserManager.FindAsync(userName, password).Result;
user.LastLoggedOn = DateTime.Now;
if (!user.FirstLoggedOn.HasValue)
user.FirstLoggedOn = user.LastLoggedOn;
this.UserManager.UpdateAsync(user);
}
return Task.FromResult(result);
}
需要注意的一件事。 我在其他站點中使用了完全相同的代碼,並且所有身份驗證都在工作。 只有一個網站有這個問題。
這是 Accountcontroller 的 Login 方法:
//
// POST: /Account/Login
[HttpPost]
[AllowAnonymous]
[ValidateAntiForgeryToken]
public async Task<JsonResult> Login(LoginViewModel model, string returnUrl)
{
if (!ModelState.IsValid)
{
var mensaje = GetModelErrorMessages();
return Json(mensaje, JsonRequestBehavior.AllowGet);
}
if (String.IsNullOrEmpty(returnUrl))
returnUrl = "/";
// This doesn't count login failures towards account lockout
// To enable password failures to trigger account lockout, change to shouldLockout: true
var result = await SignInManager.PasswordSignInAsync(model.Username, model.Password, model.RememberMe, shouldLockout: false);
switch (result)
{
case SignInStatus.Success:
return Json(returnUrl, JsonRequestBehavior.AllowGet);
case SignInStatus.LockedOut:
return Json("ERROR: El usuario está bloqueado.", JsonRequestBehavior.AllowGet);
case SignInStatus.RequiresVerification:
return Json(Url.Action("SendCode", new { ReturnUrl = returnUrl, model.RememberMe }));
case SignInStatus.Failure:
default:
var mensaje = "ERROR: Nombre de usuario o contraseña incorrectos.";
return Json(mensaje, JsonRequestBehavior.AllowGet);
}
}
如您所見,這將返回 JSON。 該 JSON 包含用於重定向到其他 URL 的返回 url,如以下腳本所示:
function performLogin(loginUrl)
{
runWaitMe('#loginform', "Ingresando...");
$.ajax({
type: 'POST',
url: loginUrl,
data: $('#frmLogin').serialize()
}).done(function (data) {
if (displayError(data))
hideWaitMe('#loginform');
else
location.href = data;
}).fail(function (jqXHR) {
hideWaitMe('#loginform');
showError(jqXHR);
});
}
我再說一遍,我開發的所有站點中都有相同的代碼,並且適用於所有站點。
也許對於這種情況,cookie 無法保存。
我可以檢查什么?
問候海梅
事實證明,即使身份驗證成功, User.Identity.IsAuthenticated
仍然是 false,直到下一個請求。
如果我打算用User.Identity.IsAuthenticated
屬性做一些事情,我需要做一個重定向。
檢查您的 cookie 是否設置了安全參數並且您的站點僅是 http。
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.