c# - cookie 过期后从 Identity 注销会导致 http 错误 400

Question

在我的 _LoginPartial.cshtml 我有这个注销按钮:

<form id="logoutForm" class="form-inline" asp-area="Identity" asp-page="/Account/Logout" asp-route-returnUrl="@Url.Action("Index", "", new { area = "" })">
    <button id="logout" type="submit">
        Log out
    </button>
</form>

然后，据我所知，Logout.cshtml.cs 被称为:

public class LogoutModel : PageModel
{
    private readonly SignInManager<ApplicationUser> _signInManager;
    private readonly ILogger<LogoutModel> _logger;

    public LogoutModel(SignInManager<ApplicationUser> signInManager, ILogger<LogoutModel> logger)
    {
        _signInManager = signInManager;
        _logger = logger;
    }

    public void OnGet()
    {
    }

    public async Task<IActionResult> OnPost(string returnUrl = null)
    {
        await _signInManager.SignOutAsync();
        _logger.LogInformation("User logged out.");
        if (returnUrl != null)
        {
            return LocalRedirect(returnUrl);
        }
        else
        {
            return RedirectToPage();
        }
    }
}

但如果用户按下“注销”时用户 session cookie 已过期，我会收到以下描述性错误消息:

HTTP ERROR 400

Logout.cshtml.cs 中任何位置设置的任何断点都不会被命中。

发生了什么？

Answer 1

if the user session cookie has expired when the user presses "Log out", I get this descriptive error message:

HTTP ERROR 400

Any breakpoints set anywhere in Logout.cshtml.cs is never hit.

我们知道，Razor 页面会自动受到 XSRF/CSRF 的保护。并且客户端用户发送给服务器的防伪 token (与当前用户的身份相关联)如果当前用户的身份验证过期，则会导致验证失败，从而导致上述错误。

要修复上述错误，您可以将 IgnoreAntiforgeryToken 属性应用于 LogoutModel 类，如下所示。

[AllowAnonymous]
[IgnoreAntiforgeryToken]
public class LogoutModel : PageModel
{ 

您可以从以下文档中获取有关“防止跨站请求伪造 (XSRF/CSRF) 攻击”的详细信息:

https://learn.microsoft.com/en-us/aspnet/core/security/anti-request-forgery?view=aspnetcore-3.1