Asp.net Blazor 服务器应用程序无法在具有 OIDC 的 Kubernetes 中重定向

Question

我们有一个在 Azure Kubernetes 中运行的 .NET 5 (Blazor Server) 应用程序，它使用 OpenID Connect 向第 3 方进行身份验证。该应用程序在 Ingress 后面运行。 Ingress 使用 https。该应用程序只有http。在我们通过 OIDC 进行身份验证并被重定向回 /signin-oidc 后，我们得到了一个我们无法解决的 .NET 错误。

warn: Microsoft.AspNetCore.Http.ResponseCookies[1]
      The cookie '.AspNetCore.OpenIdConnect.Nonce.CfDJ8EYehvsxFBVNtGDsitGDhE8K9FHQZVQwqqr1YO-zVntEtRgpfb_0cHpxfZp77AdGnS35iGRKYV54DTgx2O6ZO_3gq98pbP_XcbHnJmBDtZg2g5hhPakTrRirxDb-Qab0diaLMFKdmDrNTqGkVmqiGWpQkSxcnmxzVGGE0Cg_l930hk6TYgU0qmkzSO9WS16UBOYiub32GF4I9_qPwIiYlCq5dMTtUJaMxGlo8AdAqknxTzYz4UsrrPBi_RiWUKaF6heQitbOD4V-auHmdXQm4LE' has set 'SameSite=None' and must also set 'Secure'.
warn: Microsoft.AspNetCore.Http.ResponseCookies[1]
      The cookie '.AspNetCore.Correlation.MMrYZ2WKyYiV4hMC6bhQbGZozpubcF2tYsKq748YH44' has set 'SameSite=None' and must also set 'Secure'.
warn: Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler[15]
      '.AspNetCore.Correlation.MMrYZ2WKyYiV4hMC6bhQbGZozpubcF2tYsKq748YH44' cookie not found.
fail: Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware[1]
      An unhandled exception has occurred while executing the request.
      System.Exception: An error was encountered while handling the remote login.
       ---> System.Exception: Correlation failed.
         --- End of inner exception stack trace ---
         at Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler`1.HandleRequestAsync()
         at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
         at Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddleware.<Invoke>g__Awaited|6_0(ExceptionHandlerMiddleware middleware, HttpContext context, Task task)

---

public class Startup
{
    private static readonly object refreshLock = new object();
    private IConfiguration Configuration;
    private readonly IWebHostEnvironment Env;

    public Startup(IConfiguration configuration, IWebHostEnvironment env)
    {
        Console.WriteLine($"LogQAApp Version: {Assembly.GetExecutingAssembly().GetName().Version}");
        // We apparently need to set a CultureInfo or some of the Razor pages dealing with DateTimes, like LogErrorCountByTime fails with JavaScript errors.
        // I wanted to set it to CultureInvariant, but that wouldn't take.  Didn't complain, but wouldn't actually set it.
        CultureInfo.DefaultThreadCurrentCulture = new CultureInfo("en-US");
        CultureInfo.DefaultThreadCurrentUICulture = new CultureInfo("en-US");
        Configuration = configuration;
        Env = env;
    }

    // This method gets called by the runtime. Use this method to add services to the container.
    // For more information on how to configure your application, visit https://go.microsoft.com/fwlink/?LinkID=398940
    public void ConfigureServices(IServiceCollection services)
    {
        services.Configure<ForwardedHeadersOptions>(options =>
        {
            options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto;
        });
        Encoding.RegisterProvider(CodePagesEncodingProvider.Instance);  // Needed for 1252 code page encoding.
        Syncfusion.Licensing.SyncfusionLicenseProvider.RegisterLicense("");
        services.AddSignalR(e =>
        {
            e.MaximumReceiveMessageSize = 102400000;
        });
        services.AddBlazoredSessionStorage();
        services.AddCors();
        services.AddSyncfusionBlazor();
        services.AddRazorPages();
        services.AddServerSideBlazor();
        services.AddHttpContextAccessor();

        ServiceConfigurations.LoadFromConfiguration(Configuration);

        #region Authentication


        services.AddAuthentication(options =>
        {
            options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
            options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
        })
        .AddCookie(
            options =>
            {
                options.Events = GetCookieAuthenticationEvents();
            }
        )
        .AddOpenIdConnect("SlbOIDC", options =>
        {
            options.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
            options.Authority = Configuration["SlbOIDC:Authority"];
            if (Env.IsDevelopment())
            {
                options.ClientId = Configuration["SlbOIDC:ClientID"];
                options.ClientSecret = Configuration["SlbOIDC:ClientSecret"];
            }
            else
            {
                options.ClientId = Configuration.GetValue<string>("slbclientid");
                options.ClientSecret = Configuration.GetValue<string>("slbclientsecret");
            }
            options.ResponseType = OpenIdConnectResponseType.Code;
            options.UsePkce = true;
            options.SaveTokens = true;
            options.ClaimsIssuer = "SlbOIDC";
            // Azure is communicating to us over http, but we need to tell SLB to respond back to us on https.
            options.Events = new OpenIdConnectEvents()
            {
                OnRedirectToIdentityProvider = context =>
                {
                    Console.WriteLine($"Before: {context.ProtocolMessage.RedirectUri}");
                    context.ProtocolMessage.RedirectUri = context.ProtocolMessage.RedirectUri.Replace("http://", "https://");
                    Console.WriteLine($"After: {context.ProtocolMessage.RedirectUri}");
                    return Task.FromResult(0);
                }
            };
        });

        services.AddSession(options =>
        {
            options.Cookie.SameSite = SameSiteMode.None;
            options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
            options.Cookie.IsEssential = true;
        });
        #endregion

        services.AddScoped<BrowserService>();
        services.AddSingleton<ConcurrentSessionStatesSingleton>();
        services.AddSingleton<URLConfiguration>();
        services.AddScoped<CircuitHandler>((sp) => new CircuitHandlerScoped(sp.GetRequiredService<ConcurrentSessionStatesSingleton>(), sp.GetRequiredService<BrowserService>(), sp.GetRequiredService<IJSRuntime>()));
        services.AddScoped<SessionServiceScoped>();
        services.AddScoped<LogEditorScoped>();
        services.AddSingleton<ModalService>();
        services.AddFlexor();
        services.AddScoped<ResizeListener>();
        services.AddScoped<ApplicationLogSingleton>();
        services.AddScoped<LogChartsSingleton>();
        services.AddScoped<CurveNameClassificationSingleton>();
        services.AddScoped<HubClientSingleton>();
        services.AddScoped((sp) => new LogAquisitionScopedService(
            sp.GetRequiredService<URLConfiguration>(),
            sp.GetRequiredService<HubClientSingleton>(),
            sp.GetRequiredService<ApplicationLogSingleton>(),
            sp.GetRequiredService<IConfiguration>(),
            sp.GetRequiredService<SessionServiceScoped>(),
            sp.GetRequiredService<AuthenticationStateProvider>(),
            sp.GetRequiredService<IHttpContextAccessor>(),
            sp.GetRequiredService<IJSRuntime>()
            )
        );
        services.AddScoped<UnitSingleton>();
        services.AddServerSideBlazor().AddCircuitOptions(options => { options.DetailedErrors = true; });
        services.AddScoped<TimeZoneService>();
        services.AddHostedService<ExcelBackgroundService>();
        services.AddHostedService<LogEditorBackgroundService>();
    }

    // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }
        else
        {
            app.UseExceptionHandler("/Error");
            //app.UseHsts();
        }

        //app.UseHttpsRedirection();
        app.UseStaticFiles();
        app.UseRouting();
        app.UseCors();
        app.UseAuthorization();
        app.UseCookiePolicy();
        app.UseForwardedHeaders(new ForwardedHeadersOptions
        {
            ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto
        });
        app.UseAuthentication();

        if (!Env.IsDevelopment())
        {
            app.UseTrafficManager();
        }

        app.UseEndpoints(endpoints =>
        {
            endpoints.MapDefaultControllerRoute();
            endpoints.MapBlazorHub();
            endpoints.MapFallbackToPage("/_Host");
        });
    }

    private CookieAuthenticationEvents GetCookieAuthenticationEvents()
    {
        return new CookieAuthenticationEvents()
        {
            OnValidatePrincipal = context =>
            {
                lock (refreshLock)
                {
                    if (context.Properties.Items.ContainsKey(".Token.expires_at"))
                    {
                        DateTime expire = DateTime.Parse(context.Properties.Items[".Token.expires_at"]);
                        if (expire.AddMinutes(-20) < DateTime.Now)
                        {
                        try
                            {
                                CloudAuthentication cloudAuthentication = new CloudAuthentication();
                                TokenResponse tokenResponse = cloudAuthentication.GetRefreshToken(context.Properties.Items[".Token.refresh_token"]);

                                context.Properties.Items[".Token.access_token"] = tokenResponse.access_token;
                                context.Properties.Items[".Token.refresh_token"] = tokenResponse.refresh_token;
                                context.Properties.Items[".Token.expires_at"] = DateTime.Now.AddSeconds(tokenResponse.expires_in).ToString();

                                context.ShouldRenew = true;
                            }
                            catch (Exception ex)
                            {
                                context.RejectPrincipal();
                            }
                        }
                    }
                    return Task.FromResult(0);
                }
            }
        };
    }
}

Answer 1

这是一个很好的问题 - 这里有几个有趣的点我已经展开了，因为它们与 SameSite cookie 有关。

反向代理设置

如果使用需要 SSL 连接的 cookie，则默认情况下 Microsoft 堆栈 requires you to run on HTTPS。但是，您通过 Kubernetes 入口提供 SSL，这是一种反向代理。

Microsoft .Net Core Reverse Proxy Docs 可能会提供解决方案。该文档建议您可以通知运行时存在 SSL 上下文，即使您正在侦听 HTTP：

app.Use((context, next) =>
{
    context.Request.Scheme = "https";
    return next();
});

如果 Microsoft 不支持您的设置，我会感到惊讶，因为它是一个非常主流的托管选项。如果这不起作用，那么您可以尝试：

• 进一步搜索 Blazor 和“反向代理托管”
• 在最坏的情况下，您可能必须在集群内为此特定组件使用 SSL，正如 Johan 所指出的那样

更广泛的信息 - API 驱动的 OAUTH

许多公司想要开发单页应用程序，但使用基于网站的后端来管理 OAuth 安全性。将 Web 内容服务与 OAuth 安全性相结合会增加复杂性。通常不理解，如果以 API 驱动的方式开发 OAuth SPA 安全性会更好。

以下资源展示了如何简化 SPA 代码，在此示例中，API 将发出 cookie，但无论其配置如何。这将使它能够在集群内通过 HTTP 侦听（如果需要），但也可以发出安全 cookie：

• API driven OpenID Connect code
• Curity Blog Post

更广泛的信息：SAMESITE COOKIES

建议使用SameSite=strict 作为最安全的选项，而不是SameSite=none。但是，strict 选项有时会出现可用性问题，这可能会导致在重定向或从电子邮件链接导航后丢弃 cookie。

这可能会导致公司将其 Web 安全性降级为安全性较低的 SameSite 选项。使用 API 驱动的解决方案时不会出现这些问题，您可以使用最强的SameSite=strict 选项。