Authentication 什么会导致处理程序被忽略?
我们换了一台新服务器,我的Thinktecture IdentityModel坏了 这是一个超级简化的复制示例。这项工作从VisualStudio本地运行,但部署到处理程序显然没有处理的服务器上Authentication 什么会导致处理程序被忽略?,authentication,thinktecture-ident-model,message-handlers,Authentication,Thinktecture Ident Model,Message Handlers,我们换了一台新服务器,我的Thinktecture IdentityModel坏了 这是一个超级简化的复制示例。这项工作从VisualStudio本地运行,但部署到处理程序显然没有处理的服务器上 using System.Web.Http; using System.Web.Mvc; using System.Web.Optimization; using System.Web.Routing; using Thinktecture.IdentityModel.Tokens.Http; name
using System.Web.Http;
using System.Web.Mvc;
using System.Web.Optimization;
using System.Web.Routing;
using Thinktecture.IdentityModel.Tokens.Http;
namespace WebApplication1
{
public class WebApiApplication : System.Web.HttpApplication
{
protected void Application_Start()
{
AreaRegistration.RegisterAllAreas();
GlobalConfiguration.Configuration.MessageHandlers.Add(
new AuthenticationHandler(CreateConfiguration()));
GlobalConfiguration.Configure(WebApiConfig.Register);
FilterConfig.RegisterGlobalFilters(GlobalFilters.Filters);
RouteConfig.RegisterRoutes(RouteTable.Routes);
BundleConfig.RegisterBundles(BundleTable.Bundles);
}
private AuthenticationConfiguration CreateConfiguration()
{
var config = new AuthenticationConfiguration
{
EnableSessionToken = true,
RequireSsl = false,
SendWwwAuthenticateResponseHeaders = false
};
config.AddBasicAuthentication(
(username, password) => { return username == password; });
return config;
}
}
}
处理程序未执行。我已经设置了远程调试,这表明
- ThinkStructure程序集已加载
- 应用程序\u Start创建并添加基本身份验证处理程序
<script>
$(document).ready(function () {
var u = "bilbo";
var p = "bilbo";
var btoken = btoa(u + ":" + p);
$.ajax({
url: "api/token",
headers: { Authorization: "Basic " + btoken },
}).then(function (result) {
document.write("auth ok");
}).fail(function (error) {
document.write("auth fail");
});
});
</script>
此服务器使用以下命令进行响应:
HTTP/1.1 401 Unauthorized
Content-Type: text/html
Server: Microsoft-IIS/8.5
WWW-Authenticate: Basic realm="assa.com.au"
X-Powered-By: ASP.NET
Date: Wed, 17 Feb 2016 01:36:27 GMT
Content-Length: 1293
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>
<title>401 - Unauthorized: Access is denied due to invalid credentials.</title>
<style type="text/css">
<!--
body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}
fieldset{padding:0 15px 10px 15px;}
h1{font-size:2.4em;margin:0;color:#FFF;}
h2{font-size:1.7em;margin:0;color:#CC0000;}
h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;}
#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;
background-color:#555555;}
#content{margin:0 0 0 2%;position:relative;}
.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}
-->
</style>
</head>
<body>
<div id="header"><h1>Server Error</h1></div>
<div id="content">
<div class="content-container"><fieldset>
<h2>401 - Unauthorized: Access is denied due to invalid credentials.</h2>
<h3>You do not have permission to view this directory or page using the credentials that you supplied.</h3>
</fieldset></div>
</div>
</body>
</html>
HTTP/1.1 401未经授权
内容类型:text/html
服务器:Microsoft IIS/8.5
WWW.Authenticate:Basic realm=“assa.com.au”
X-Powered-By:ASP.NET
日期:2016年2月17日星期三01:36:27 GMT
内容长度:1293
401-未经授权:由于凭据无效,访问被拒绝。
服务器错误
401-未经授权:由于凭据无效,访问被拒绝。
您没有使用您提供的凭据查看此目录或页面的权限。
Visual Studio 2013正在处理程序中显示有效断点,但未命中它们。这就是为什么我认为处理程序没有被调用
响应指定了一个领域,但是修改处理程序注册以指定
realm=“assa.com.au”
并不会影响结果。答案在于处理没有尾部斜杠的情况
测试页面被请求为assa.com.au/sandpit
,它返回正确的HTML
对401响应的仔细检查表明,请求是针对api/token
,这不是令牌分发器的正确URL-它应该是sandpit/api/token
将测试页面请求为assa.com.au/sandpit/
会导致请求的URL变为sandpit/api/token
,所有内容都会被清除
但为什么是401?难道不是404找不到吗?事实证明,Web服务器被配置为通过请求用户代理进行身份验证(表示为401身份验证请求)来响应未经授权的请求
错误的URL使内容处于未经授权的状态,产生401身份验证请求
HTTP/1.1 401 Unauthorized
Content-Type: text/html
Server: Microsoft-IIS/8.5
WWW-Authenticate: Basic realm="assa.com.au"
X-Powered-By: ASP.NET
Date: Wed, 17 Feb 2016 01:36:27 GMT
Content-Length: 1293
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>
<title>401 - Unauthorized: Access is denied due to invalid credentials.</title>
<style type="text/css">
<!--
body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}
fieldset{padding:0 15px 10px 15px;}
h1{font-size:2.4em;margin:0;color:#FFF;}
h2{font-size:1.7em;margin:0;color:#CC0000;}
h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;}
#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;
background-color:#555555;}
#content{margin:0 0 0 2%;position:relative;}
.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}
-->
</style>
</head>
<body>
<div id="header"><h1>Server Error</h1></div>
<div id="content">
<div class="content-container"><fieldset>
<h2>401 - Unauthorized: Access is denied due to invalid credentials.</h2>
<h3>You do not have permission to view this directory or page using the credentials that you supplied.</h3>
</fieldset></div>
</div>
</body>
</html>