identityserver4 - 无效的 redirect_uri 即使它们相同

Question

尝试登录身份服务器(使用 .net core 3 预览版)时，即使请求 uri 和允许的 uri 相同，我也会收到 Invalid redirect_uri 错误。

我还能做错什么？

fail: IdentityServer4.Validation.AuthorizeRequestValidator[0]
      Invalid redirect_uri: http://localhost:1337/authentication/login-callback
{
        "ClientId": "myapp",
        "ClientName": "myapp",
        "AllowedRedirectUris": [
          "http://localhost:1337/authentication/login-callback"
        ],
        "SubjectId": "anonymous",
        "RequestedScopes": "",
        "Raw": {
          "client_id": "myapp",
          "redirect_uri": "http://localhost:1337/authentication/login-callback",
          "response_type": "id_token token",
          "scope": "webAPI openid profile",
          "state": "5a10fc5a7006475c8d3a348c711ca58a",
          "nonce": "ae6f9f35837241e1ba3841c2ff8a4fce",
          "prompt": "none"
        }
      }
fail: IdentityServer4.Endpoints.AuthorizeEndpoint[0]
      Request validation failed

Answer 1

我想为需要更深入解释的人补充说明这对 IdentityServerSPA 不起作用的原因客户类型是事实，当您调用 AddApiAuthorization 时因此:

            services.AddIdentityServer()
                .AddApiAuthorization<ApplicationUser, ApplicationDbContext>();

库代码从文件 IdentityServerBuilderConfigurationExtensions.cs 运行它第 65 行执行此操作:

builder.AddAspNetIdentity<TUser>()
    .AddOperationalStore<TContext>()
    .ConfigureReplacedServices()  // <-- This is the line
    .AddIdentityResources()
    .AddApiResources()
    .AddClients()
    .AddSigningCredentials();

和 ConfigureReplacedServices 做这个:

builder.Services.AddSingleton<IRedirectUriValidator, RelativeRedirectUriValidator>();

和 RelativeRedirectUriValidator 通过首先检查客户端类型是否为 IdentityServerSPA 来验证重定向 URI与否，因此:

public override Task<bool> IsRedirectUriValidAsync(string requestedUri, Client client)
{
    if (IsLocalSPA(client))
    {
        return ValidateRelativeUris(requestedUri, client.RedirectUris);
    }
    else
    {
        return base.IsRedirectUriValidAsync(requestedUri, client);
    }
}

当 IsLocalSPA 定义如下:

private static bool IsLocalSPA(Client client) =>
    client.Properties.TryGetValue(ApplicationProfilesPropertyNames.Profile, out var clientType) &&
    ApplicationProfiles.IdentityServerSPA == clientType;

我添加这个答案既是为了帮助别人，也是为了帮助自己更好地理解这一点:)