无法读取策略AuthorizationHandler中的会话数据

Question

使用.NET Core1.1，我创建了一个AuthorizationHandler：

public class HasStoreAccountAuthorizationHandler : AuthorizationHandler<HasStoreAccountRequirement>
{
    private SessionHelper SessionHelper { get; }

    public HasStoreAccountAuthorizationHandler(SessionHelper sessionHelper)
    {
        this.SessionHelper = sessionHelper;
    }

    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, HasStoreAccountRequirement requirement)
    {
        if (this.SessionHelper?.Accounts != null && this.SessionHelper.Accounts.Any()) context.Succeed(requirement);
        return Task.FromResult(0);
    }
}

我有一个SessionHelper类，它将非原始值序列化为会话：

public class SessionHelper
{
    public IEnumerable<AccountInformation> Accounts
    {
        get => this.Session.Get<IEnumerable<AccountInformation>>(AccountsKey);
        set => this.Session.Set<IEnumerable<AccountInformation>>(AccountsKey, value);
    }

    public static class SessionHelperExtensionMethods
    {
        public static void Set<T>(this ISession session, string key, T value)
        {
            session.SetString(key, JsonConvert.SerializeObject(value));
        }

        public static T Get<T>(this ISession session, string key)
        {
            var value = session.GetString(key);
            return value == null ? default(T) : JsonConvert.DeserializeObject<T>(value);
        }
    }
}

在代码中的任何其他地方访问SessionHelper.Accounts都很好。但是，每当调用策略AuthorizationHandler时，都会引发以下错误：

An exception was thrown while deserializing the token.
System.InvalidOperationException: The antiforgery token could not be decrypted.
---> System.Security.Cryptography.CryptographicException: The key {KEYNAME} was not found in the key ring.
at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.UnprotectCore(Byte[] protectedData, Boolean allowOperationsOnRevokedKeys, UnprotectStatus& status) at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.DangerousUnprotect(Byte[] protectedData, Boolean ignoreRevocationErrors, Boolean& requiresMigration, Boolean& wasRevoked) at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.Unprotect(Byte[] protectedData) at Microsoft.AspNetCore.Antiforgery.Internal.DefaultAntiforgeryTokenSerializer.Deserialize(String serializedToken) --- End of inner exception stack trace --- at Microsoft.AspNetCore.Antiforgery.Internal.DefaultAntiforgeryTokenSerializer.Deserialize(String serializedToken) at Microsoft.AspNetCore.Antiforgery.Internal.DefaultAntiforgery.GetCookieTokenDoesNotThrow(HttpContext httpContext) System.Security.Cryptography.CryptographicException: The key {KEYNAME} was not found in the key ring.
at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.UnprotectCore(Byte[] protectedData, Boolean allowOperationsOnRevokedKeys, UnprotectStatus& status) at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.DangerousUnprotect(Byte[] protectedData, Boolean ignoreRevocationErrors, Boolean& requiresMigration, Boolean& wasRevoked) at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.Unprotect(Byte[] protectedData) at Microsoft.AspNetCore.Antiforgery.Internal.DefaultAntiforgeryTokenSerializer.Deserialize(String serializedToken)

网站机器密钥是在web.config和IIS中设置的，使用SHA1 1/AES，同时“为每个应用程序生成一个唯一的密钥”检查和未选中(例如，"KEY_VALUE，IsolateApps“和"KEY_VALUE")。

我还创建了一个数据保护注册表单元，并将IIS池配置为按此链接加载用户配置文件。

我还在Startup.cs中添加了数据保护(添加/删除了各种行)：

services.AddAntiforgery();
services.AddDataProtection()
        .SetApplicationName("APPNAME")
        .SetDefaultKeyLifetime(TimeSpan.FromDays(365))
        .PersistKeysToFileSystem(new DirectoryInfo(Configuration["DataProtection:LocalPaths:KeyLocation"]));

在某些情况下，SessionHelper.Accounts被正确读取，没有异常被抛出。然而，一旦应用程序回收，最终SessionHelper.Accounts为null并引发异常。注销系统并再次登录不会影响错误。

有什么想法？

Answer 1

通过通过传递的AuthorizationHandlerContext上下文而不是IHttpContextAccessor上下文访问会话数据，我成功地修复了这个问题。

在SessionHelper中：

public static IEnumerable<AccountInformation> GetAccounts(HttpContext context)
{
    return context.Session.Get<IEnumerable<AccountInformation>>(AccountsKey);
}

在AuthorizationHandler中：

protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, HasStoreAccountRequirement requirement)
{
    var accounts = SessionHelper.GetAccounts(this.Context.HttpContext);
    if (accounts != null && accounts.Any()) context.Succeed(requirement);
    return Task.FromResult(0);
}