为什么 IIS 似乎将来自 AppPool 的一个请求的 WindowsIdentity 提升到我的用户帐户？
我目前正在开发一个 ASP .NET 应用程序，该应用程序涉及用户使用 Windows 身份验证登录。这会导致 HTTPContext.User 和 Thread.Principal 设置为与登录用户相同的凭据（这是预期的行为），而 WindowsIdentity 仍保留为 IIS .NET AppPool 用户。
加载页面时的第 5 个请求），其中 WindowsIdentity 以 IIS 用户身份开始，但最终被提升为正在登录的用户。
我最近在应用程序日志中注意到，似乎有一个请求（通常是 仅当用户访问根路径（例如 http://localhost/）时才会发生。如果我指定任何其他确切路径，例如 http://localhost/index.aspx 此请求似乎不会发生并且 WindowsIdentity 永远不会改变。
浏览（相当大的）代码库，我只能找到一种模拟 WindowsIdentity 的方法，但除了特定页面上的特定情况外，不会调用该方法。
我想知道为什么会发生这种情况，以及 IIS 是否有任何原因可能会自行执行此操作。
I am currently working on an ASP .NET application which involves the user logging in using Windows Authentication. This causes both the HTTPContext.User and Thread.Principal to be set with the same credentials as the user logging in which is expected behaviour, while the WindowsIdentity stays as the IIS .NET AppPool user.
I have recently noticed in the application logs that there appears to be one request (normally the 5th-ish request on loading the page) where the WindowsIdentity starts off as the IIS user but ends up being elevated to the user who is logging in.
This only appears to be happening when the user is accessing the root path (for instance http://localhost/). If I specify any other exact path such as http://localhost/index.aspx this request does not appear to occur and the WindowsIdentity never changes.
Looking through the (rather large) codebase I can only find one method that impersonates a WindowsIdentity, but that method is not called apart from in specific circumstances on a specific page.
I was wondering why this might be happening and if there was any reason that IIS might be doing it by itself.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
据我所知，我认为 root(http://localhost) 访问权限仅适用于管理员用户，因此它正在检查它是否是管理员用户..，是 http://loclahost 如果用户不是管理员用户可以访问吗？
As per me i think the root(http://localhost) access is only for the administrator user , so it is checking where it is administrator user or not .. ,is the http://loclahost accessible if the user in not the administrator user ?