.Net core 3.1 MVC 站点给出 http 403 错误

Question

我有一个用c#和.net core 3.1 MVC编写的网站。 对于这个网站，我启用了SSL和基于角色的身份验证，它托管在某个托管提供商上。当我尝试访问该网站时，它有时会给我一个 http 403 禁止：访问被拒绝错误。但是如果我清除浏览器的 cookie 并刷新页面，我可以毫无问题地访问它。当我尝试访问公共(没有授权属性的控制器(时，我也遇到了这个问题。谁能帮我？多谢。

我的 ConfigureServices 方法在 Startup.cs 文件中：

public void ConfigureServices(IServiceCollection services)
{
services.Configure<IISServerOptions>(options => { options.AutomaticAuthentication = false; });
services.AddDbContext<ApplicationDbContext>(options =>
options.UseSqlServer(
Configuration.GetConnectionString("DefaultConnection")));
services.AddIdentity<IdentityUser, IdentityRole>()
.AddEntityFrameworkStores<ApplicationDbContext>()
.AddDefaultTokenProviders();
services.AddAuthentication(options =>
{
options.DefaultAuthenticateScheme = IdentityConstants.ApplicationScheme;
options.DefaultChallengeScheme = IdentityConstants.ApplicationScheme;
options.DefaultSignInScheme = IdentityConstants.ExternalScheme;
});
services.AddScoped<IDbInitializer, DbInitializer>();
services.AddControllersWithViews();
services.AddRazorPages();
services.ConfigureApplicationCookie(options =>
{
options.ExpireTimeSpan = TimeSpan.FromHours(1);
options.LoginPath = "/Identity/Account/Login";
options.AccessDeniedPath = "/Identity/Account/AccessDenied";
});
services.AddTransient<IMessage, EmailService>();
}

我在启动时的配置方法.cs：

public void Configure(IApplicationBuilder app, IWebHostEnvironment env, IDbInitializer initializer)
{
if (env.IsDevelopment())
{
app.UseDeveloperExceptionPage();
app.UseDatabaseErrorPage();
}
else
{
//app.UseExceptionHandler("/Home/Error");
app.UseStatusCodePagesWithRedirects("/");
// The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
app.UseHsts();
}
initializer.Initialize();
app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseRouting();
app.UseAuthentication();
app.UseAuthorization();
app.UseEndpoints(endpoints =>
{
endpoints.MapControllerRoute(
name: "user_default",
pattern: "{action=Index}",
defaults: new
{area = "User", controller = "Home", action = "Index"},
constraints: new {area = "User", controller = "Home"}
);
endpoints.MapControllerRoute(
name: "products_default",
pattern: "{controller}/{mainCategory}/{category}/{product}",
defaults: new
{area = "User", action = "Index", mainCategory = "", category = "", product = ""},
constraints: new
{area = "User", controller = "Products"}
);
endpoints.MapControllerRoute(
name: "user_subcontrollers_default",
pattern: "{controller=Home}/{action=Index}/{id?}",
defaults: new
{area = "User"},
constraints: new {area = "User"}
);
endpoints.MapControllerRoute(
name: "default",
pattern: "{area=User}/{controller=Home}/{action=Index}/{id?}");
endpoints.MapRazorPages();
});
}

Answer 1

事实证明，我们的主机防火墙设置导致了此问题。在他们重新配置它后，我们的 403 错误停止了。可悲的是，我不知道他们在防火墙中改变了什么。

Answer 2

检查您是否具有以下装饰器，该装饰器被调用的控制器/操作方法以及具有用户所需的权限

[Authorize(Roles = "CreateRecord")]