无法在策略 AuthorizationHandler 中读取会话数据

Question

使用 .NET Core 1.1，我创建了一个 AuthorizationHandler：

public class HasStoreAccountAuthorizationHandler : AuthorizationHandler<HasStoreAccountRequirement>
{
    private SessionHelper SessionHelper { get; }

    public HasStoreAccountAuthorizationHandler(SessionHelper sessionHelper)
    {
        this.SessionHelper = sessionHelper;
    }

    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, HasStoreAccountRequirement requirement)
    {
        if (this.SessionHelper?.Accounts != null && this.SessionHelper.Accounts.Any()) context.Succeed(requirement);
        return Task.FromResult(0);
    }
}

我有一个 SessionHelper 类，它将非原始值序列化到会话中：

public class SessionHelper
{
    public IEnumerable<AccountInformation> Accounts
    {
        get => this.Session.Get<IEnumerable<AccountInformation>>(AccountsKey);
        set => this.Session.Set<IEnumerable<AccountInformation>>(AccountsKey, value);
    }

    public static class SessionHelperExtensionMethods
    {
        public static void Set<T>(this ISession session, string key, T value)
        {
            session.SetString(key, JsonConvert.SerializeObject(value));
        }

        public static T Get<T>(this ISession session, string key)
        {
            var value = session.GetString(key);
            return value == null ? default(T) : JsonConvert.DeserializeObject<T>(value);
        }
    }
}

在代码中的任何其他位置访问 SessionHelper.Accounts 都可以正常工作。但是，每当调用策略 AuthorizationHandler 时，都会抛出以下错误：

An exception was thrown while deserializing the token.
System.InvalidOperationException: The antiforgery token could not be decrypted.
---> System.Security.Cryptography.CryptographicException: The key {KEYNAME} was not found in the key ring.
at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.UnprotectCore(Byte[] protectedData, Boolean allowOperationsOnRevokedKeys, UnprotectStatus& status) at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.DangerousUnprotect(Byte[] protectedData, Boolean ignoreRevocationErrors, Boolean& requiresMigration, Boolean& wasRevoked) at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.Unprotect(Byte[] protectedData) at Microsoft.AspNetCore.Antiforgery.Internal.DefaultAntiforgeryTokenSerializer.Deserialize(String serializedToken) --- End of inner exception stack trace --- at Microsoft.AspNetCore.Antiforgery.Internal.DefaultAntiforgeryTokenSerializer.Deserialize(String serializedToken) at Microsoft.AspNetCore.Antiforgery.Internal.DefaultAntiforgery.GetCookieTokenDoesNotThrow(HttpContext httpContext) System.Security.Cryptography.CryptographicException: The key {KEYNAME} was not found in the key ring.
at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.UnprotectCore(Byte[] protectedData, Boolean allowOperationsOnRevokedKeys, UnprotectStatus& status) at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.DangerousUnprotect(Byte[] protectedData, Boolean ignoreRevocationErrors, Boolean& requiresMigration, Boolean& wasRevoked) at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.Unprotect(Byte[] protectedData) at Microsoft.AspNetCore.Antiforgery.Internal.DefaultAntiforgeryTokenSerializer.Deserialize(String serializedToken)

网站机器密钥在 web.config 和 IIS 中设置，使用 SHA1/AES 并选中和取消选中“为每个应用程序生成唯一密钥”（例如，“KEY_VALUE,IsolateApps”和“KEY_VALUE”）。

我还创建了一个数据保护注册表配置单元并配置 IIS 应用程序池以根据此 link 加载用户配置文件。

我还在 Startup.cs 中添加了数据保护（添加/删除了各种行）：

services.AddAntiforgery();
services.AddDataProtection()
        .SetApplicationName("APPNAME")
        .SetDefaultKeyLifetime(TimeSpan.FromDays(365))
        .PersistKeysToFileSystem(new DirectoryInfo(Configuration["DataProtection:LocalPaths:KeyLocation"]));

在某些情况下，SessionHelper.Accounts 被正确读取并且不会引发异常。但是，一旦应用程序回收，最终 SessionHelper.Accounts 为 null 并引发异常。退出系统重新登录对错误没有影响。

想法？

Answer 1

我已经设法通过传递的 AuthorizationHandlerContext 上下文而不是 IHttpContextAccessor 上下文访问会话数据来解决此问题。

在 SessionHelper 中：

public static IEnumerable<AccountInformation> GetAccounts(HttpContext context)
{
    return context.Session.Get<IEnumerable<AccountInformation>>(AccountsKey);
}

在 AuthorizationHandler 中：

protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, HasStoreAccountRequirement requirement)
{
    var accounts = SessionHelper.GetAccounts(this.Context.HttpContext);
    if (accounts != null && accounts.Any()) context.Succeed(requirement);
    return Task.FromResult(0);
}