C# Asp.Net Owin授权请求在匿名模式下工作，但不是；“正常”；铬

我有一个Asp.Net应用程序，无论是在正常模式还是匿名模式下，我都可以在Chrome中毫无问题地登录。但是，当我执行API请求时，它仅在匿名模式下被授权

然后我试着做“空缓存和硬重新加载”，重新启动Chrome，清除Cookie，甚至重新启动计算机等等，但没有任何效果。我在想，如果它可能是某个插件，但我尝试禁用广告拦截器和所有其他插件，但我仍然得到相同的结果。隐姓埋名一切都很好

本地存储和会话存储为空，并且本地主机的唯一cookie是非匿名和匿名的

.AspNet.applicationcokie

然后我检查了发送到服务器的请求，这是来自非匿名者：

GET /api/prospects/active HTTP/1.1
Host: localhost:3807
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, sdch
Accept-Language: sv-SE,sv;q=0.8,en-US;q=0.6,en;q=0.4
Cookie: ASP.NET_SessionId=ib450fjia5vizwpzxlnfuogd; XSRF-TOKEN=3hd4ZvxqpDU6sjttd22sjnxcrzCkptKajk3ml2maaf6oc8axj8N2P1QH6UzwPNeiKS4DhPYIhDVHzzwTaBb0-RF4ECjLZvPCUXqDEfrmaoIZ5rFOb2vubYL-PT4OGmyH0; XSRF-V=Zmq1iNyMWiHYOuEIYiKBGlEyW7pe1unHxGQN5K3zvn-30oHbX37JgMJTrlJMg0yCtLjfC2JJOiNOV9cO-ox6WIJgQR04cXZffeXzGfTF63E1; .AspNet.ApplicationCookie=RmjkiPr76LDahSXu-vOctxQY_TE0FT8nB-1ytaJ49_p3IYIntIO4fqu_CMuFalVYU9yls9FmGT8kC4L_Zb6fl12plkLfSlCuzVDkvwgi0QABCQ8oK9AgrN5wLx5Lk-OKMZ9LaxIpiDKuLuYFXX9F2LBE5524oEhk8fdUT-k8izwR5pJiBtPFV2PJ4U7ph77gNQRQNd3LMEKX2hYLIO4TjrfteVRClrAJYyVkP4uV9k_fWoHx-Lpx5aJiHIgM2naYqdyi9FmRYFOQRY1dScFhnz-PYYtfP_qkorjzjPLKDHfDQ06wzpuraB2J68bymbB4DG_d_Kr35d97O9WlGgLJo2qQV2HObQlGZ0qU3Dgmrib_ImmmFGcI3fwYWHV9WNV1kjUZ5DS9lIiZsAhqA8_eZbSKILmFw7L7vhMGNVKU6ptOeAyFqqRImY29nw2Fw5Rnrt3cy_Tw-pe229Ztvc7JRwfEF6bs7YqGWJTvGb1c3uE; UMB_UPDCHK=1; _ga=GA1.1.1065814793.1466085326; 3264e9011c=pe_data=|id=0b42d0758724f0295d9384687bcd6b0a; .AspNet.ApplicationCookie=Ol7PeRdke7-95-rLIAQY174l4UAly08mog8da0b7IHfAyHkcZTauLc7ZuGuynO5CTkuVokTuxrsPAwhUgeR9Ex9QpdcFeZV7COICBxBXSQADsbSCs1qf0daOG7LOId_ATup-pOiJcG1tr9JZ4biMdrPrsPE3Z3UITwWesD3UCovmmPMN7tk1cHKQ7XQO3M8tLRE_VWJX79R3aakNolFx2zKnUu15rsGSACcZzfANAGpZR59Ld0vr9378sSkIXrHOJWVgZyOloWlelQfKy1g5X5NZn2rIuBkS1gJrYAKf_4lR46BH8dR8pYbKAVYZb07xLAaiLBz7SkwMrc7nXIONIxnlKTKHBe43FSwu5mmAa5uRltd4Z7E4D_9J96OJd-hyFMA3n-F8SGL6diX6zxtSTjZfXmQmd-PJkzgg7FkuhPpb5nbCEMH6uI_JcU-ZZNbz4cAIbk0maLvLpUQKvkMz-txxNzgABgBUl753LaaHR0o

结果:

匿名请求：

GET /api/prospects/active HTTP/1.1
Host: localhost:3807
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, sdch
Accept-Language: sv-SE,sv;q=0.8,en-US;q=0.6,en;q=0.4
Cookie: .AspNet.ApplicationCookie=PxTseFnL3UPqv438ySa4f0Cb9mb-0ByyjjMDjTSCD9tSCmN4X0xYgIyMVVriHj1UJ8aogNe_ztHcEfr8pkE4xsMx2miVZ1Z50BGxBwY7sIz22fFQzDmC3-ASPMzYE6k9IFECpdqFfBLkb4rcSx_kd-flUb9hVLGa0zDC-qpypIEZJaYg2j50OfX9g9h0Ko4XXx9DJcDTE4qkPPmD52oMn2qLGSdSOFfLyi4tNE66vsh38Bi4DIxSB2wSHEBlWsE9LyZpwC8IN6C1B6R4XDuJaliWMZJCmoWLCr5X-YPWo-PQcrCiK_iCSp5ndJJJBsY65L2MiVDueShMTi4UeFwzk24kTUES_zhS0JSXEPrOyXGWV_1OAIAGkRObkN7YvD78jSairV547nfcPFzGTt6VPrUq6FkXGINV0AHa_5Vo03Ygjg3o6PgCB8kDrijYy_tAeA2rnmkCUsb8ZD6W-veCoujGKpHOTkuA1Ock1cczxTg

正如您所看到的，尽管Chrome开发者工具->应用程序只显示一个cookie，但非匿名请求还有几个cookie

这可能是什么原因造成的

登录控制器：

private IAuthenticationManager AuthenticationManager => HttpContext.GetOwinContext().Authentication;

[HttpPost]
[Route("Login")]
public ActionResult Login(AuthenticationViewModel viewModel)
{
    if (!ModelState.IsValid)
    {
        return View(viewModel);
    }

    User user = authenticationGateway.Authenticate(viewModel.Username, viewModel.Password);

    if (user == null)
    {
        logRepository.LogInformation("Login failed", $"Login attempt for user {viewModel.Username} from IP {Request.UserHostAddress} failed.", Guid.NewGuid());
        TempData["loginError"] = "Wrong username or password.";

        return View(viewModel);
    }

    var claims = new List<Claim>
    {
        new Claim(ClaimTypes.Name, user.Name, ClaimValueTypes.String),
        new Claim(ClaimTypes.NameIdentifier, user.Id.ToString(), ClaimValueTypes.Integer),
        new Claim(ClaimTypes.Email, user.Email ?? string.Empty, ClaimValueTypes.Email),
        new Claim(ClaimTypes.Role, user.Role.ToString(), ClaimValueTypes.String),
        new Claim(ClaimTypes.OtherPhone, user.Phone ?? string.Empty, ClaimValueTypes.String),
        new Claim(CustomClaimTypes.SalesId, user.UgId.ToString(), ClaimValueTypes.Integer)
    };

    var claimsIdentity = new ClaimsIdentity(claims, DefaultAuthenticationTypes.ApplicationCookie);
    AuthenticationManager.SignIn(claimsIdentity);

    logRepository.LogInformation("Login success", $"Login attempt for user {viewModel.Username} from IP {Request.UserHostAddress} succeeded.", Guid.NewGuid());

    return RedirectToAction("Index", "Home");
}

[HttpGet]
[Authorize]
[Route("Logout")]
public ActionResult Logout()
{
    logRepository.LogInformation("Logout", $"Logged out user {User.Identity.Name}. Logout initiated from IP {Request.UserHostAddress}.", Guid.NewGuid());

    AuthenticationManager.SignOut();

    return RedirectToAction("Login");
}

---

有些饼干没有被正确地取出。当我访问api时，

http://localhost:3807/api/prospects/active

，Chrome Developer Tools直接在浏览器中显示上述所有cookies。我不知道这是否是一个bug，因为应用程序和API都运行在localhost:3807上。Chrome开发者工具在API和Web上都特别提到Cookies->。当我手动删除Cookie时，在我再次登录后，一切都开始工作。

我尝试删除Cookie，但没有帮助。 因此，我尝试从Chore Developer控制台中清除所有站点数据。它显示了特定的端口，但对所有本地web应用程序都有帮助

public partial class Startup
{
    public void ConfigureAuth(IAppBuilder app)
    {
        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
            LoginPath = new PathString("/Login"),
            LogoutPath = new PathString("/Logout"),
            SlidingExpiration = true
        });
    }
}