angularjs - Internet Explorer 11 替换了授权 header

Question

什么会导致 Internet Explorer 替换 HTTP header

Authorization : Bearer <server-provided-token>

与

Authorization : Negotiate <some token>

何时发出 AJAX 请求？

详细信息

在 Internet Explorer 中，一些配置为包含 header Authorization: Bearer ... 的 AJAX 请求由 Internet Explorer 发送， header 为 Authorization: Negotiate ...相反。

例如，Fiddler 显示三个请求中的前两个包含 Authorization : Bearer... header ，而第三个突然包含 Authorization : Negotiate... header 。前两个请求成功，第三个请求失败，因为无法正确验证请求。

所有请求都是使用相同的客户端代码构造的，并且是一个接一个地发出的(在一秒内)。我已经验证了Authorization header 正确包含 Bearer在将请求提供给浏览器之前，在所有三种情况下都使用 token 。

此外，我在 Chrome 中没有看到相同的行为；它只发生在 IE 中。

请求 1

GET http://localhost/myapp/api/User HTTP/1.1Accept: application/json, text/plain, */*Authorization: Bearer oEXS5IBu9huepzW6jfh-POMA18AUA8yWZsPfBPZuFf_JJxq-DKIt0JDyPXSiGpmV_cpT8FlL3D1DN-Tv5ZbT73MTuBOd5y75-bsx9fZvOeJgg04JcO0cUajdCH2h5QlMP8TNwgTpHg-TR9FxyPk3Kw6bQ6tQCOkOwIG_FmEJpP89yrOsoYJoCfrAoZ7M4PVcik9F9qtPgXmWwXB2eHDtkls44wITF_yM_rPm5C47OPCvMVTPz30KwoEPi6fHUcL3qHauP-v9uypv2e48TyPHUwLYmNFxyafMhBx4TkovnRcsdLHZiHmSjMq0V9a2Vw70Referer: http://localhost/client/login.htmlAccept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: localhostDNT: 1Connection: Keep-Alive

请求 2

POST http://localhost/myapp/api/Permissions HTTP/1.1Referer: http://localhost/client/#/DashboardContent-Type: application/jsonAuthorization: Bearer oEXS5IBu9huepzW6jfh-POMA18AUA8yWZsPfBPZuFf_JJxq-DKIt0JDyPXSiGpmV_cpT8FlL3D1DN-Tv5ZbT73MTuBOd5y75-bsx9fZvOeJgg04JcO0cUajdCH2h5QlMP8TNwgTpHg-TR9FxyPk3Kw6bQ6tQCOkOwIG_FmEJpP89yrOsoYJoCfrAoZ7M4PVcik9F9qtPgXmWwXB2eHDtkls44wITF_yM_rPm5C47OPCvMVTPz30KwoEPi6fHUcL3qHauP-v9uypv2e48TyPHUwLYmNFxyafMhBx4TkovnRcsdLHZiHmSjMq0V9a2Vw70Accept: application/json, text/plain, */*Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: localhostContent-Length: 1419DNT: 1Connection: Keep-AlivePragma: no-cache<Post Data Removed>

请求 3

GET http://localhost/myapp/api/UserPreferences/Dashboard HTTP/1.1Referer: http://localhost/client/#/DashboardContent-Type: application/jsonAuthorization: Negotiate YHsGBisGAQUFAqBxMG+gMDAuBgorBgEEAYI3AgIKBgkqhkiC9xIBAgIGCSqGSIb3EgECAgYKKwYBBAGCNwICHqI7BDlOVExNU1NQAAEAAACXsgjiBgAGADMAAAALAAsAKAAAAAYBsR0AAAAPVk1ERVZFTlYtU1JTQ0VSSVM=Accept: application/json, text/plain, */*Accept-Language: en-USAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveDNT: 1Host: localhost

请求是通过 AngularJS $http 发出的服务，后端是托管在 IIS 中的 ASP.NET Web API。

Answer 1

我们在 Internet Explorer 缓存凭据时遇到问题。我们可以使用以下脚本解决该问题:

document.execCommand('ClearAuthenticationCache', 'false');

参见:Wikipedia