Asp.Net Owin 授权请求在隐身模式下工作，但不是“正常”Chrome答案

【问题标题】：Asp.Net Owin authorized request works in Incognito mode but not "normal" ChromeAsp.Net Owin 授权请求在隐身模式下工作，但不是“正常”Chrome
【发布时间】：2017-01-10 08:17:12
【问题描述】：

我有一个 Asp.Net 应用程序，我可以在正常模式和隐身模式下在 Chrome 中毫无问题地登录该应用程序。但是，当我发出 API 请求时，它仅在隐身模式下获得授权。

然后我尝试执行“清空缓存和硬重新加载”，重新启动 Chrome，清除 cookie，甚至重新启动计算机等，但没有任何效果。我在想它是否可能是某个插件，但我尝试禁用 Ad-blocker 和所有其他插件，但我仍然得到相同的结果。在隐身模式下一切正常。

本地存储和会话存储为空，Localhost 存在的唯一 cookie 是 .AspNet.ApplicationCookie 在非隐身和隐身状态下。

然后我检查了发往服务器的请求，这是来自非隐身：

GET /api/prospects/active HTTP/1.1
Host: localhost:3807
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, sdch
Accept-Language: sv-SE,sv;q=0.8,en-US;q=0.6,en;q=0.4
Cookie: ASP.NET_SessionId=ib450fjia5vizwpzxlnfuogd; XSRF-TOKEN=3hd4ZvxqpDU6sjttd22sjnxcrzCkptKajk3ml2maaf6oc8axj8N2P1QH6UzwPNeiKS4DhPYIhDVHzzwTaBb0-RF4ECjLZvPCUXqDEfrmaoIZ5rFOb2vubYL-PT4OGmyH0; XSRF-V=Zmq1iNyMWiHYOuEIYiKBGlEyW7pe1unHxGQN5K3zvn-30oHbX37JgMJTrlJMg0yCtLjfC2JJOiNOV9cO-ox6WIJgQR04cXZffeXzGfTF63E1; .AspNet.ApplicationCookie=RmjkiPr76LDahSXu-vOctxQY_TE0FT8nB-1ytaJ49_p3IYIntIO4fqu_CMuFalVYU9yls9FmGT8kC4L_Zb6fl12plkLfSlCuzVDkvwgi0QABCQ8oK9AgrN5wLx5Lk-OKMZ9LaxIpiDKuLuYFXX9F2LBE5524oEhk8fdUT-k8izwR5pJiBtPFV2PJ4U7ph77gNQRQNd3LMEKX2hYLIO4TjrfteVRClrAJYyVkP4uV9k_fWoHx-Lpx5aJiHIgM2naYqdyi9FmRYFOQRY1dScFhnz-PYYtfP_qkorjzjPLKDHfDQ06wzpuraB2J68bymbB4DG_d_Kr35d97O9WlGgLJo2qQV2HObQlGZ0qU3Dgmrib_ImmmFGcI3fwYWHV9WNV1kjUZ5DS9lIiZsAhqA8_eZbSKILmFw7L7vhMGNVKU6ptOeAyFqqRImY29nw2Fw5Rnrt3cy_Tw-pe229Ztvc7JRwfEF6bs7YqGWJTvGb1c3uE; UMB_UPDCHK=1; _ga=GA1.1.1065814793.1466085326; 3264e9011c=pe_data=|id=0b42d0758724f0295d9384687bcd6b0a; .AspNet.ApplicationCookie=Ol7PeRdke7-95-rLIAQY174l4UAly08mog8da0b7IHfAyHkcZTauLc7ZuGuynO5CTkuVokTuxrsPAwhUgeR9Ex9QpdcFeZV7COICBxBXSQADsbSCs1qf0daOG7LOId_ATup-pOiJcG1tr9JZ4biMdrPrsPE3Z3UITwWesD3UCovmmPMN7tk1cHKQ7XQO3M8tLRE_VWJX79R3aakNolFx2zKnUu15rsGSACcZzfANAGpZR59Ld0vr9378sSkIXrHOJWVgZyOloWlelQfKy1g5X5NZn2rIuBkS1gJrYAKf_4lR46BH8dR8pYbKAVYZb07xLAaiLBz7SkwMrc7nXIONIxnlKTKHBe43FSwu5mmAa5uRltd4Z7E4D_9J96OJd-hyFMA3n-F8SGL6diX6zxtSTjZfXmQmd-PJkzgg7FkuhPpb5nbCEMH6uI_JcU-ZZNbz4cAIbk0maLvLpUQKvkMz-txxNzgABgBUl753LaaHR0o

结果：

隐身请求：

GET /api/prospects/active HTTP/1.1
Host: localhost:3807
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, sdch
Accept-Language: sv-SE,sv;q=0.8,en-US;q=0.6,en;q=0.4
Cookie: .AspNet.ApplicationCookie=PxTseFnL3UPqv438ySa4f0Cb9mb-0ByyjjMDjTSCD9tSCmN4X0xYgIyMVVriHj1UJ8aogNe_ztHcEfr8pkE4xsMx2miVZ1Z50BGxBwY7sIz22fFQzDmC3-ASPMzYE6k9IFECpdqFfBLkb4rcSx_kd-flUb9hVLGa0zDC-qpypIEZJaYg2j50OfX9g9h0Ko4XXx9DJcDTE4qkPPmD52oMn2qLGSdSOFfLyi4tNE66vsh38Bi4DIxSB2wSHEBlWsE9LyZpwC8IN6C1B6R4XDuJaliWMZJCmoWLCr5X-YPWo-PQcrCiK_iCSp5ndJJJBsY65L2MiVDueShMTi4UeFwzk24kTUES_zhS0JSXEPrOyXGWV_1OAIAGkRObkN7YvD78jSairV547nfcPFzGTt6VPrUq6FkXGINV0AHa_5Vo03Ygjg3o6PgCB8kDrijYy_tAeA2rnmkCUsb8ZD6W-veCoujGKpHOTkuA1Ock1cczxTg

如您所见，即使 Chrome 开发者工具 -> 应用程序仅显示一个 cookie，非隐身请求还有多个 cookie。

这可能是什么原因造成的？

登录控制器：

private IAuthenticationManager AuthenticationManager => HttpContext.GetOwinContext().Authentication;

[HttpPost]
[Route("Login")]
public ActionResult Login(AuthenticationViewModel viewModel)
{
    if (!ModelState.IsValid)
    {
        return View(viewModel);
    }

    User user = authenticationGateway.Authenticate(viewModel.Username, viewModel.Password);

    if (user == null)
    {
        logRepository.LogInformation("Login failed", $"Login attempt for user {viewModel.Username} from IP {Request.UserHostAddress} failed.", Guid.NewGuid());
        TempData["loginError"] = "Wrong username or password.";

        return View(viewModel);
    }

    var claims = new List<Claim>
    {
        new Claim(ClaimTypes.Name, user.Name, ClaimValueTypes.String),
        new Claim(ClaimTypes.NameIdentifier, user.Id.ToString(), ClaimValueTypes.Integer),
        new Claim(ClaimTypes.Email, user.Email ?? string.Empty, ClaimValueTypes.Email),
        new Claim(ClaimTypes.Role, user.Role.ToString(), ClaimValueTypes.String),
        new Claim(ClaimTypes.OtherPhone, user.Phone ?? string.Empty, ClaimValueTypes.String),
        new Claim(CustomClaimTypes.SalesId, user.UgId.ToString(), ClaimValueTypes.Integer)
    };

    var claimsIdentity = new ClaimsIdentity(claims, DefaultAuthenticationTypes.ApplicationCookie);
    AuthenticationManager.SignIn(claimsIdentity);

    logRepository.LogInformation("Login success", $"Login attempt for user {viewModel.Username} from IP {Request.UserHostAddress} succeeded.", Guid.NewGuid());

    return RedirectToAction("Index", "Home");
}

[HttpGet]
[Authorize]
[Route("Logout")]
public ActionResult Logout()
{
    logRepository.LogInformation("Logout", $"Logged out user {User.Identity.Name}. Logout initiated from IP {Request.UserHostAddress}.", Guid.NewGuid());

    AuthenticationManager.SignOut();

    return RedirectToAction("Login");
}

Startup.Auth：

public partial class Startup
{
    public void ConfigureAuth(IAppBuilder app)
    {
        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
            LoginPath = new PathString("/Login"),
            LogoutPath = new PathString("/Logout"),
            SlidingExpiration = true
        });
    }
}

【问题讨论】：

标签： c# asp.net google-chrome cookies

【解决方案1】：

某些 cookie 未正确删除。当我直接在浏览器中访问 api http://localhost:3807/api/prospects/active 时，Chrome 开发者工具显示了上面的所有 cookie。我不知道这是否是一个错误，因为应用程序和 API 都在 localhost:3807 上运行。 Chrome 开发者工具在 API 和 Web 上都特别提到了 Cookies -> http://localhost:3807/。当我手动删除 cookie 后，我再次登录后一切都开始工作了。

【讨论】：

【解决方案2】：

我曾尝试删除 cookie，但没有帮助。所以我试图从 Chore Developer Console 中清除所有站点数据。它显示了特定的端口，但有助于所有本地 Web 应用程序了解端口号

【讨论】：