1. Startup.cs 设置 Session 相关的内容
using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
namespace Web
{
public class Startup
{
public Startup(IConfiguration configuration)
{
Configuration = configuration;
}
public IConfiguration Configuration { get; }
// This method gets called by the runtime. Use this method to add services to the container.
public void ConfigureServices(IServiceCollection services)
{
services.Configure<CookiePolicyOptions>(options =>
{
// This lambda determines whether user consent for non-essential cookies is needed for a given request.
options.CheckConsentNeeded = context => true;
options.MinimumSameSitePolicy = SameSiteMode.None;
});
//Session 保存到内存
services.AddDistributedMemoryCache();
services.AddSession();
services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_1);
}
// This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
if (env.IsDevelopment())
{
app.UseDeveloperExceptionPage();
}
else
{
app.UseExceptionHandler("/Home/Error");
}
app.UseStaticFiles();
app.UseCookiePolicy();
// 必须在 UseMvc 之前调用
app.UseSession();
app.UseMvc(routes =>
{
routes.MapRoute(
name: "default",
template: "{controller=Login}/{action=Index}/{id?}");
});
}
}
}
2. 在创建验证码图片时设置 Session, 但在登录时获取不到 Session。
/// <summary>
/// 获取图形验证码
/// </summary>
/// <returns></returns>
[HttpGet]
public ActionResult GetAuthCode()
{
string code = string.Empty;
byte[] byteArr = new VerifyCode().GetVerifyCode(out code);
HttpContext.Session.SetString("VERFIY_CODE_TOKEN", code);
return File(byteArr, @"image/png");
}
[HttpPost]
public ActionResult CheckLogin(string username, string password, string code)
{
try
{
string sessionCode = HttpContext.Session.GetString("VERFIY_CODE_TOKEN");
if (string.IsNullOrEmpty(sessionCode) || string.Compare(code, sessionCode, true) != 0)
{
throw new Exception("验证码错误,请重新输入");
}
throw new Exception("登录成功了!");
}
catch (Exception ex)
{
return Json(new AjaxResult { state = ResultType.error.ToString(), message = ex.Message });
}
}
实际断点跟踪时, 发现 Session.Id 前后都不一致了。
注: 验证码是 普通提交, 登录是 ajax 请求。
----------------------------------------------------------------------------------------------------------
解决方案:
去掉:
services.Configure<CookiePolicyOptions>(options =>
{
// This lambda determines whether user consent for non-essential cookies is needed for a given request.
options.CheckConsentNeeded = context => true;
options.MinimumSameSitePolicy = SameSiteMode.None;
});