Programmiererforum

builder.Services.AddSession(options => {
options.IdleTimeout = TimeSpan.FromMinutes(20);
options.Cookie.HttpOnly = true;
options.Cookie.IsEssential = true;
options.Cookie.SameSite = SameSiteMode.None;
options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
});

builder.Services.AddDataProtection()
.PersistKeysToFileSystem(new DirectoryInfo(@"./keys"))
.UseCryptographicAlgorithms(new AuthenticatedEncryptorConfiguration {
EncryptionAlgorithm = EncryptionAlgorithm.AES_256_CBC,
ValidationAlgorithm = ValidationAlgorithm.HMACSHA256
})
.SetApplicationName("BudgetTracker")
.SetDefaultKeyLifetime(TimeSpan.FromDays(14));

builder.Services.AddControllersWithViews(options => {
options.Filters.Add(new AutoValidateAntiforgeryTokenAttribute());
});

builder.Services.AddAntiforgery(options => {
options.HeaderName = "X-XSRF-TOKEN";
options.Cookie.Name = "XSRF-TOKEN";
options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
options.Cookie.HttpOnly = false;
options.Cookie.SameSite = SameSiteMode.None;
options.Cookie.Expiration = TimeSpan.FromDays(14);
options.SuppressXFrameOptionsHeader = false;
options.FormFieldName = "AntiforgeryField";
});

app.UseMiddleware();

  public class AntiForgeryMiddleware {
private readonly IAntiforgery _antiforgery;
private readonly RequestDelegate _next;
private readonly ILogger _logger;

public AntiForgeryMiddleware(RequestDelegate next, IAntiforgery antiforgery, ILogger logger) {
_next = next;
_antiforgery = antiforgery;
_logger = logger;
}

public async Task Invoke(HttpContext context) {
try {
if (string.Equals(context.Request.Path.Value, "/session/csrf", StringComparison.OrdinalIgnoreCase)) {
var token = _antiforgery.GetAndStoreTokens(context).RequestToken;
if (!string.IsNullOrEmpty(token)) {
context.Response.Cookies.Append("XSRF-TOKEN", token, new CookieOptions {
HttpOnly = false,
Secure = true,
SameSite = SameSiteMode.None,
Expires = DateTimeOffset.UtcNow.AddDays(14)
});
}
_logger.LogInformation($"Generated XSRF-TOKEN: {token}");
}

} catch (Exception ex) {
_logger.LogError(new EventId(), ex, ex.Message);
throw;
}

await _next(context);
}
}

intercept(request: HttpRequest\, next: HttpHandler): Observable\ {
let token = this.tokenExtractor.getToken();
let permitted = this.findByActionName(request.method, this.actions);
let forbidden = this.findByActionName(request.method, this.forbiddenActions);;

if (permitted !== undefined && forbidden === undefined && token !== null) {
request = request.clone({ setHeaders: { "X-XSRF-TOKEN": token }, withCredentials: true });
}
return next.handle(request);

}

private findByActionName(name: string, actions: string\[\]): string | undefined {
return actions.find(action =\> action.toLocaleLowerCase() === name.toLocaleLowerCase());
}
}

info: webapi.Middlewares.AntiForgeryTokenLoggingMiddleware[0]
Request XSRF-TOKEN: cece034d-b5a2-4042-a884-c4aa9399436b
info: webapi.Middlewares.AntiForgeryTokenLoggingMiddleware[0]
Request X-XSRF-TOKEN: cece034d-b5a2-4042-a884-c4aa9399436b

[19:02:46 INF] Antiforgery token validation failed.  The antiforgery token could not be decrypted.
Microsoft.AspNetCore.Antiforgery.AntiforgeryValidationException: The antiforgery token could not be decrypted.
---> System.Security.Cryptography.CryptographicException: The provided payload cannot be decrypted because it was not protected with this protection provider.

Ich stelle Antiforgy für die .net+Angular-App ein.
Ich deklariere Einstellungen für die Sitzung
[code]builder.Services.AddSession(options => {
options.IdleTimeout = TimeSpan.FromMinutes(20);
options.Cookie.HttpOnly = true;
options.Cookie.IsEssential = true;
options.Cookie.SameSite = SameSiteMode.None;
options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
});
[/code]
Ich erkläre den Datenschutz
[code]builder.Services.AddDataProtection()
.PersistKeysToFileSystem(new DirectoryInfo(@"./keys"))
.UseCryptographicAlgorithms(new AuthenticatedEncryptorConfiguration {
EncryptionAlgorithm = EncryptionAlgorithm.AES_256_CBC,
ValidationAlgorithm = ValidationAlgorithm.HMACSHA256
})
.SetApplicationName("BudgetTracker")
.SetDefaultKeyLifetime(TimeSpan.FromDays(14));
[/code]
Ich füge Attribute für Controller hinzu
[code]builder.Services.AddControllersWithViews(options => {
options.Filters.Add(new AutoValidateAntiforgeryTokenAttribute());
});
[/code]
Ich erkläre Antifogery-Einstellungen
[code]builder.Services.AddAntiforgery(options => {
options.HeaderName = "X-XSRF-TOKEN";
options.Cookie.Name = "XSRF-TOKEN";
options.Cookie.SecurePolicy = CookieSecurePolicy.Always;
options.Cookie.HttpOnly = false;
options.Cookie.SameSite = SameSiteMode.None;
options.Cookie.Expiration = TimeSpan.FromDays(14);
options.SuppressXFrameOptionsHeader = false;
options.FormFieldName = "AntiforgeryField";
});
[/code]
Ich verwende Middleware für Antifogery
[code]app.UseMiddleware();
[/code]
Dies ist der Code der Middleware:
[code] public class AntiForgeryMiddleware {
private readonly IAntiforgery _antiforgery;
private readonly RequestDelegate _next;
private readonly ILogger _logger;

public AntiForgeryMiddleware(RequestDelegate next, IAntiforgery antiforgery, ILogger logger) {
_next = next;
_antiforgery = antiforgery;
_logger = logger;
}

public async Task Invoke(HttpContext context) {
try {
if (string.Equals(context.Request.Path.Value, "/session/csrf", StringComparison.OrdinalIgnoreCase)) {
var token = _antiforgery.GetAndStoreTokens(context).RequestToken;
if (!string.IsNullOrEmpty(token)) {
context.Response.Cookies.Append("XSRF-TOKEN", token, new CookieOptions {
HttpOnly = false,
Secure = true,
SameSite = SameSiteMode.None,
Expires = DateTimeOffset.UtcNow.AddDays(14)
});
}
_logger.LogInformation($"Generated XSRF-TOKEN: {token}");
}

} catch (Exception ex) {
_logger.LogError(new EventId(), ex, ex.Message);
throw;
}

await _next(context);
}
}
[/code]
Die Schlüsseldatei in /keys wird erstellt. Ich sehe X-XSRF-TOKEN in Headern und in der Sitzung. Ich habe Interceptor in Angular:
[code]intercept(request: HttpRequest\, next: HttpHandler): Observable\ {
let token = this.tokenExtractor.getToken();
let permitted = this.findByActionName(request.method, this.actions);
let forbidden = this.findByActionName(request.method, this.forbiddenActions);;

if (permitted !== undefined && forbidden === undefined && token !== null) {
request = request.clone({ setHeaders: { "X-XSRF-TOKEN": token }, withCredentials: true });
}
return next.handle(request);

}

private findByActionName(name: string, actions: string\[\]): string | undefined {
return actions.find(action =\> action.toLocaleLowerCase() === name.toLocaleLowerCase());
}
}
[/code]
Ich kann Protokolle auf dem Server sehen:
[code]info: webapi.Middlewares.AntiForgeryTokenLoggingMiddleware[0]
Request XSRF-TOKEN: cece034d-b5a2-4042-a884-c4aa9399436b
info: webapi.Middlewares.AntiForgeryTokenLoggingMiddleware[0]
Request X-XSRF-TOKEN: cece034d-b5a2-4042-a884-c4aa9399436b
[/code]
Aber ich erhalte die Fehlermeldung:
[code][19:02:46 INF] Antiforgery token validation failed. The antiforgery token could not be decrypted.
Microsoft.AspNetCore.Antiforgery.AntiforgeryValidationException: The antiforgery token could not be decrypted.
---> System.Security.Cryptography.CryptographicException: The provided payload cannot be decrypted because it was not protected with this protection provider.
[/code]
Ich habe drei Tage damit verbracht, eine Lösung zu finden. Andere Einstellung geändert, nach anderer Lösung gegoogelt, ich habe Code von Microsoft verwendet, chartgpt verwendet, aber nichts hat geholfen. Könnten Sie bitte erklären, was falsch ist?
Danke!