javascript - AJAX 请求不发送 cookie (NET 5)

Question

出于测试目的，设置了两个网络应用程序，一个“客户端”应用程序(本地主机)和一个服务器应用程序(Azure 网络应用程序)。客户端向服务器发送 AJAX 请求并接收 cookie 作为响应。然后它对服务器进行另一个 AJAX 调用，但请求中没有 cookie，它丢失了。

这是服务器配置(CORS 设置；https://localhost:44316 是我的“客户端”URL):

public class Startup
{
    public Startup(IConfiguration configuration)
    {
        Configuration = configuration;
    }

    public IConfiguration Configuration { get; }

    public void ConfigureServices(IServiceCollection services)
    {
        services.AddCors(o => {
            o.AddPolicy("policy1", builder =>
                builder.WithOrigins("https://localhost:44316")
                    .AllowAnyMethod()
                    .AllowAnyHeader()
                    .AllowCredentials());
        });

        services.AddControllers();
    }

    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        app.UseHttpsRedirection();

        app.UseRouting();

        app.UseCors("policy1");

        app.UseAuthorization();

        app.UseEndpoints(endpoints =>
        {
            endpoints.MapControllers();
        });
    }
}

这是第一个 Controller ，返回 cookie:

[Route("api/[controller]")]
[ApiController]
public class AController : ControllerBase
{
    [HttpPost]
    public IActionResult Post()
    {
        var cookieOptions = new CookieOptions
        {
            HttpOnly = true,
            Expires = DateTime.Now.AddMinutes(10),
            SameSite = SameSiteMode.None
        };
        Response.Cookies.Append("mykey", "myvalue", cookieOptions);

        return Ok();
    }
}

这是第二个 Controller ，它应该接收 cookie(但它没有):

[Route("api/[controller]")]
[ApiController]
public class BController : ControllerBase
{
    [HttpPost]
    public IActionResult Post()
    {
        var x = Request.Cookies;

        return Ok(JsonConvert.SerializeObject(x));
    }
}

这是来自“客户端”的调用脚本(分别是第一次和第二次调用):

function Go()
{
    $.ajax({
        url: 'https://somewebsite.azurewebsites.net/api/a',
        type: 'post',
        xhrFields: {
            withCredentials: true
        },
        success: function (data, textStatus, jQxhr)
        {
            console.log(data);
        },
        error: function (jqXhr, textStatus, errorThrown)
        {
            console.log(errorThrown);
        }
    });
}

function Go2()
{
    $.ajax({
        url: 'https://somewebsite.azurewebsites.net/api/b',
        type: 'post',
        xhrFields: {
            withCredentials: true
        },
        success: function (data, textStatus, jQxhr)
        {
            console.log(data);
        },
        error: function (jqXhr, textStatus, errorThrown)
        {
            console.log(errorThrown);
        }
    });
}

有谁知道这里的问题是什么？

Answer 1

作为this document说:

Cookies that assert SameSite=None must also be marked as Secure

但你没有，所以用这个代替:

var cookieOptions = new CookieOptions
            {
                HttpOnly = true,
                Expires = DateTime.Now.AddMinutes(10),
                SameSite = SameSiteMode.None,
                Secure = true
            };

这是我的测试结果: