Cors策略问题Blazor WASM、Web API和Identity Server 4和IIS

Question

我得到Cors策略错误时，试图做POST请求到Web api从我的WASM blazor应用程序。

CORS策略阻止从http://localhost:8080/DashboardService/TestConnectionhttps://localhost:8081获取数据：请求的资源上不存在访问控制允许来源标头。如果不透明的响应满足您的需求，请将请求的模式设置为no-cors，以在禁用CORS的情况下获取资源。

我在调试模式下没有问题，只有IIS发布

Startup.cs（WEB API）

   public class Startup
{
    #region Fields/Attributes

    private static readonly NLog.Logger logger = NLog.LogManager.GetCurrentClassLogger();

    private readonly IConfiguration configuration;

    #endregion Fields/Attributes

    #region Constructors

    /// <summary>
    /// Initializes a new instance of the <see cref="Startup"/> class.
    /// </summary>
    /// <param name="configuration">The configuration identifier</param>
    public Startup(IConfiguration configuration)
    {
        logger.Trace($"{GetType().FullName} constructed");
        this.configuration = configuration;
    }

    #endregion Constructors

    #region Methods

    /// <summary>
    /// This method gets called by the runtime. Use this method to add services to the container.
    /// </summary>
    /// <param name="services">The service collection identifier</param>
    public void ConfigureServices(IServiceCollection services)
    {
       

        // Statistics And Monitoring Service
        services.AddSingleton<IDashboardService, DashboardService>();
        services.AddSingleton<IManualLogsService, ManualLogsService>();

        services.AddCors(options =>
        {
            options.AddPolicy("CorsPolicy",
              builder =>
              {
                  builder
                  .AllowAnyOrigin()
                  .AllowAnyHeader()
                  .AllowAnyMethod();
              });
        });

        services.AddCors(options => options.AddPolicy("CorsPolicy2",
        builder =>
        {
            builder.WithOrigins("https://localhost:8081").AllowAnyHeader()
                   .AllowAnyMethod()
                   .AllowCredentials();
        }));

        services.AddSignalR(options =>
        {
            options.EnableDetailedErrors = true;
            options.MaximumReceiveMessageSize = long.MaxValue;
            options.ClientTimeoutInterval = TimeSpan.FromSeconds(240);
            options.KeepAliveInterval = TimeSpan.FromSeconds(120);
        })
      

        string identityServerAuthority =  "https://localhost:8082";


        services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
            .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, opt =>
            {
                opt.RequireHttpsMetadata = false;
                opt.Authority = identityServerAuthority;
                opt.Audience = "backend"; 
            });

     
        logger.Trace($"Services configured");
    }

    /// <summary>
    /// This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
    /// </summary>
    /// <param name="app">The application builder identifier</param>
    /// <param name="env">The web host environement identifier</param>
    /// <param name="agentsService">The AgentsService identifier</param>
    /// <param name="collectedValueConverter">The CollectedValueConverter identifier</param>
    /// <param name="databaseConnectionService">The DatabaseConnectionService identifier</param>
    [System.Diagnostics.CodeAnalysis.SuppressMessage("Style", "IDE0060:Remove unused parameter", Justification = "Dependency injecting only to force instantiation of Singletons")]
    public void Configure(IApplicationBuilder app, IWebHostEnvironment env, IDataBaseServiceApplicationConfig dataBaseServiceApplicationConfig, IAgentsService agentsService, IMachineStructureService machineStructureService, ICollectedValueConverter collectedValueConverter, IDatabaseConnectionService databaseConnectionService)
    {
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }
        else
        {
            //app.UseHsts();
        }
        //app.UseHttpsRedirection();

        app.UseRouting();

        app.UseCors("CorsPolicy2");
        app.UseAuthentication();

        app.UseAuthorization();

        app.UseStaticFiles();

        app.UseEndpoints(endpoints =>
        {
            endpoints.MapControllers(); 
            endpoints.MapHub<BackEndHub>("/DashboardService");
        });
    }

    #endregion Methods
}

我在我的控制器上有[授权]属性，如果我删除它们，它会工作。。。

有人能帮我吗？提前谢谢

日亨

Answer 1

问题解决：我转到windows中的事件查看器，看到了真正的错误，这是一个SSL证书问题。我的后端是http，identity server不接受这种方式。我们将后端转换为https并使用开发证书。我们面临同样的问题，但这一次是个人存储的证书，不受信任。管理此操作的步骤：Windows-

谢谢大家的帮助。

Answer 2

我看到的第一个问题是这两行的顺序不对：

 app.UseAuthorization();
 app.UseAuthentication();

您应该始终在授权之前进行身份验证。

您还应该知道，在识别服务客户端定义中有一个单独的CORS设置，但是这些设置（如果我没有错的话）仅在调用识别服务器终结点时应用。