From f43a0450acb65e2bdf9f0ee61760f661a91cf700 Mon Sep 17 00:00:00 2001 From: wanghu Date: Thu, 3 Sep 2026 20:55:10 +0800 Subject: [PATCH] 1 --- .../Middleware/SsoProtectionMiddleware.cs | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/src/YhCore.WebApi/Middleware/SsoProtectionMiddleware.cs b/src/YhCore.WebApi/Middleware/SsoProtectionMiddleware.cs index 7d8f071..b29406c 100644 --- a/src/YhCore.WebApi/Middleware/SsoProtectionMiddleware.cs +++ b/src/YhCore.WebApi/Middleware/SsoProtectionMiddleware.cs @@ -2,6 +2,7 @@ using Microsoft.AspNetCore.Authentication; using Microsoft.AspNetCore.Http; using Microsoft.Extensions.Configuration; using System; +using System.Reflection.Metadata; using System.Threading.Tasks; using Yh.Platform.Abstractions; using Yh.Platform.Auth; @@ -96,7 +97,19 @@ namespace YhCore.WebApi.Middleware { context.Response.StatusCode = StatusCodes.Status200OK; context.Response.ContentType = "application/json; charset=utf-8"; - throw new DException(ErrorCode.Unauthorized); + + // 返回与文档导航 Challenge 一致的 CAS 登录地址（200 + JSON 而非 302，避免跨域跳转被 CORS 拦截）。 + // service 指向 signin-cas 回调，与 CasAuthenticationHandler.HandleChallengeAsync 的 BuildServiceUrl 一致 + // （AppBaseUrl + SignInCallbackPath），保证回调重建 service 时与登录时完全一致，ticket 校验才能通过。 + var casBase = (sso["CasServerUrlPrefix"] ?? string.Empty).TrimEnd('/'); + var root = string.IsNullOrEmpty(sso["AppBaseUrl"]) + ? (context.Request.Scheme + "://" + context.Request.Host.Value) + : sso["AppBaseUrl"].TrimEnd('/'); + var callbackPath = sso["SignInCallbackPath"] ?? "/signin-cas"; + var loginUrl = casBase + "/login?service=" + Uri.EscapeDataString(root + callbackPath); + + await context.Response.WriteAsync("{\"code\":302,\"urlToRedirectTo\":\"" + loginUrl + "\"}"); + return; } // 未认证 → Challenge → 302 重定向 CAS 登录页（ticket 校验与回跳由新框架 CasAuthenticationHandler 处理）