看了前文的同學(xué)們應(yīng)該都知道，搜狗、360等瀏覽器在單點(diǎn)登錄中反復(fù)重定向，最終失敗報(bào)錯(cuò)。

原因在于，非Chrome80+瀏覽器不識(shí)別Cookie上的SameSite=none屬性值,導(dǎo)致認(rèn)證Cookie在后續(xù)請(qǐng)求中被拋棄。

截至2020/3/30號(hào),非Chrome瀏覽器測(cè)試包含兩種結(jié)果：

• case1：可設(shè)置cookie的samesite=none， 瀏覽器可讀取該cookie
• case2：對(duì)cookie設(shè)置samesite=none， 瀏覽器不能讀取該cookie

嗯，我之前報(bào)的360急速瀏覽器在新版已經(jīng)更新了Chrome內(nèi)核，作為主流的搜狗和獵豹瀏覽器還是使用舊版本Chrome內(nèi)核，這是要鬧哪樣？

如果Web應(yīng)用程序打算支持舊內(nèi)核瀏覽器，則需要實(shí)現(xiàn)瀏覽器嗅探。ASP.NET Core不會(huì)幫你實(shí)現(xiàn)瀏覽器嗅探，因?yàn)閁ser-Agents值易變且經(jīng)常更改。

但是Microsoft.AspNetCore.CookiePolicy中的擴(kuò)展點(diǎn)允許插入瀏覽器嗅探邏輯。

在Startup.Configure中，在調(diào)用UseAuthentication或任何寫(xiě)入cookie的方法之前添加調(diào)用UseCookiePolicy的代碼：

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
   if (env.IsDevelopment())
   {
       app.UseDeveloperExceptionPage();
   }
   else
   {
       app.UseExceptionHandler("/Error");
       app.UseHsts();
   }

   app.UseHttpsRedirection();
   app.UseStaticFiles();

   app.UseRouting();
 // 表示ASP.NET Core 啟動(dòng)Cookie策略
   app.UseCookiePolicy();
   app.UseAuthentication();
   app.UseAuthorization();

   app.UseEndpoints(endpoints =>
   {
       endpoints.MapRazorPages();
   });
}

在Startup.ConfigureServices, 添加Cookie的策略配置代碼：

public void ConfigureServices(IServiceCollection services)
{
   services.Configure<CookiePolicyOptions>(options =>
   {
       options.MinimumSameSitePolicy = (SameSiteMode)(-1);
       options.OnAppendCookie = cookieContext =>
           CheckSameSite(cookieContext.Context, cookieContext.CookieOptions);
       options.OnDeleteCookie = cookieContext =>
           CheckSameSite(cookieContext.Context, cookieContext.CookieOptions);
   });

   services.AddRazorPages();
}

private void CheckSameSite(HttpContext httpContext, CookieOptions options)
{
   if (options.SameSite == SameSiteMode.None)
   {
       var userAgent = httpContext.Request.Headers["User-Agent"].ToString();
       if (MyUserAgentDetectionLib.DisallowsSameSiteNone(userAgent))
       {
           options.SameSite = SameSiteMode.Unspecified;
       }

   }
}

上面的例子中，MyUserAgentDetectionLib.DisallowsSameSiteNone 是一個(gè)自定義的庫(kù)文件，偵測(cè)不支持SameSite=None的UserAgent。

ASP.NET Core3.1 對(duì)與SameSiteMode新增了一個(gè) Unspecified枚舉值，表示服務(wù)端不會(huì)對(duì)Cookie設(shè)置SameSite屬性值， 后面的攜帶Cookie的事情交給瀏覽器默認(rèn)配置。

具體的偵測(cè)代碼如下：

public static bool DisallowsSameSiteNone(string userAgent)
{
   // Check if a null or empty string has been passed in, since this
   // will cause further interrogation of the useragent to fail.
    if (String.IsNullOrWhiteSpace(userAgent))
       return false;
   
   // Cover all iOS based browsers here. This includes:
   // - Safari on iOS 12 for iPhone, iPod Touch, iPad
   // - WkWebview on iOS 12 for iPhone, iPod Touch, iPad
   // - Chrome on iOS 12 for iPhone, iPod Touch, iPad
   // All of which are broken by SameSite=None, because they use the iOS networking
   // stack.
   if (userAgent.Contains("CPU iPhone OS 12") ||
       userAgent.Contains("iPad; CPU OS 12"))
   {
       return true;
   }

   // Cover Mac OS X based browsers that use the Mac OS networking stack.
   // This includes:
   // - Safari on Mac OS X.
   // This does not include:
   // - Chrome on Mac OS X
   // Because they do not use the Mac OS networking stack.
   if (userAgent.Contains("Macintosh; Intel Mac OS X 10_14") &&
       userAgent.Contains("Version/") && userAgent.Contains("Safari"))
   {
       return true;
   }

   // Cover Chrome 50-69, because some versions are broken by SameSite=None,
   // and none in this range require it.
   // Note: this covers some pre-Chromium Edge versions,
   // but pre-Chromium Edge does not require SameSite=None.
   if (userAgent.Contains("Chrome/5") || userAgent.Contains("Chrome/6"))
   {
       return true;
   }

   return false;
}