.net 6 cors 预检选项请求 401 未经授权错误的问题

Question

我正在发出 CORS PUT 请求并将 Content-Type 标头设置为 json。这会触发预检选项请求。在我的程序文件中（见下图）我得到了 401 Unauthorized error（见图片）。我该怎么做才能让它发挥作用

builder.Services.AddControllers();
// Learn more about configuring Swagger/OpenAPI at https://aka.ms/aspnetcore/swashbuckle
builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen(c =>
{
    c.SwaggerDoc("v1", new OpenApiInfo { Title = "Internal Store Data API", Version = "v1" });
});

builder.Services.AddAuthentication(NegotiateDefaults.AuthenticationScheme)
   .AddNegotiate();

builder.Services.AddAuthorization(options =>
{
    // By default, all incoming requests will be authorized according to the default policy.
    options.FallbackPolicy = options.DefaultPolicy;
});

builder.Services.AddCors(options =>
{
    options.AddPolicy(
      "CorsPolicy",
      builder => builder
                .AllowAnyMethod()
               .AllowAnyHeader()
               .SetIsOriginAllowed(origin => true) // allow any origin
               .AllowCredentials()
      );
});



// Start Database Connection
// End Database Connection

// Start Repositories
// End Repositories

// Start UseCases
// End UserCases


var app = builder.Build();

// Configure the HTTP request pipeline.
if (app.Environment.IsDevelopment() || app.Environment.IsProduction())
{
    app.UseDeveloperExceptionPage();
    app.UseSwagger();
    app.UseSwaggerUI(c =>
    {
        c.SwaggerEndpoint("/swagger/v1/swagger.json", "Internal Store Data API V1");
        c.RoutePrefix = String.Empty;
    });
}

app.UseHttpsRedirection();
app.UseCors("CorsPolicy");

app.UseAuthorization();
app.UseAuthentication();
app.MapControllers();

app.Run();

在此处输入图像描述

我尝试添加此内容，但仅此而已在 localhost 上工作（当我在 VS 上运行它时，但在托管时则不然）

"iisSettings": {
"windowsAuthentication": true,
"anonymousAuthentication": true,
"iisExpress": {
  "applicationUrl": "http://localhost:8791/",
  "sslPort": 0
}

请帮助

Answer 1

我看不到您实际上正在添加任何来源尝试这个，添加您允许的来源

    /*
    * cors
    * 
    */
    string MyAllowSpecificOrigins = "_myAllowSpecificOrigins";
    
    string[] origin = { your allowed origins here };
    
    builder.Services.AddCors(options =>
    {
        options.AddPolicy(name: MyAllowSpecificOrigins,
                          builder =>
                          {
                              builder.WithOrigins(origin
                                                  )
                                                   .AllowAnyHeader()
                                                   .AllowAnyMethod();
                          });
    });

...

app.UseCors(MyAllowSpecificOrigins);

我不确定您的解决方案的这一部分：

 .SetIsOriginAllowed(origin => true) // allow any origin

虽然有这种方法可能是您想要的方法：

  ...
  .AllowAnyOrigin()

编辑
虽然看你的问题看起来根本不像 CORS，但它看起来像是身份验证问题，但你没有通过身份验证