AspNetCoreで、Cookieをセキュアにする為に、Startup.cs の ConfigureServices(IServiceCollection services) メソッドで、AddAntiforgeryを設定したら、Session/Cookieのデシリアライズ処理が不安定になり、HTTP POSTが「応答無し HTTP ERROR 400」を頻発に返して来るので、Cookieのセキュア化は諦めました。
Cookieのセキュア設定。
Startup.cs
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 |
services.AddAntiforgery(options => { options.CookieName = "__Secure-Cookie"; options.Cookie.Name = "__Secure-Cookie"; options.Cookie.Path = "/"; options.Cookie.Domain = "unikktle.com"; options.Cookie.HttpOnly = true; options.Cookie.SameSite = SameSiteMode.Lax; options.Cookie.SecurePolicy = CookieSecurePolicy.Always; options.Cookie.IsEssential = true; options.Cookie.MaxAge = TimeSpan.FromDays(30); options.FormFieldName = "__Secure-Cookie"; options.HeaderName = "X-CSRF-TOKEN-HEAD"; options.SuppressXFrameOptionsHeader = false; }); |
エラーの詳細。
journalctl -exf
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 |
9月 29 03:47:31 web1.com Web1[10781]: fail: Microsoft.AspNetCore.Antiforgery.Internal.DefaultAntiforgery[7] 9月 29 03:47:31 web1.com Web1[10781]: An exception was thrown while deserializing the token. 9月 29 03:47:31 web1.com Web1[10781]: Microsoft.AspNetCore.Antiforgery.AntiforgeryValidationException: The antiforgery token could not be decrypted. ---> System.Security.Cryptography.CryptographicException: The payload was invalid. 9月 29 03:47:31 web1.com Web1[10781]: at Microsoft.AspNetCore.DataProtection.Managed.ManagedAuthenticatedEncryptor.Decrypt(ArraySegment1 protectedPayload, ArraySegment1 additionalAuthenticatedData) 9月 29 03:47:31 web1.com Web1[10781]: at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.UnprotectCore(Byte[] protectedData, Boolean allowOperationsOnRevokedKeys, UnprotectStatus& status) 9月 29 03:47:31 web1.com Web1[10781]: at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.DangerousUnprotect(Byte[] protectedData, Boolean ignoreRevocationErrors, Boolean& requiresMigration, Boolean& wasRevoked) 9月 29 03:47:31 web1.com Web1[10781]: at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.Unprotect(Byte[] protectedData) 9月 29 03:47:31 web1.com Web1[10781]: at Microsoft.AspNetCore.Antiforgery.Internal.DefaultAntiforgeryTokenSerializer.Deserialize(String serializedToken) 9月 29 03:47:31 web1.com Web1[10781]: --- End of inner exception stack trace --- 9月 29 03:47:31 web1.com Web1[10781]: at Microsoft.AspNetCore.Antiforgery.Internal.DefaultAntiforgeryTokenSerializer.Deserialize(String serializedToken) 9月 29 03:47:31 web1.com Web1[10781]: at Microsoft.AspNetCore.Antiforgery.Internal.DefaultAntiforgery.GetCookieTokenDoesNotThrow(HttpContext httpContext) 9月 29 03:47:38 web1.com Web1[10781]: warn: Microsoft.AspNetCore.Session.SessionMiddleware[7] 9月 29 03:47:38 web1.com Web1[10781]: Error unprotecting the session cookie. 9月 29 03:47:38 web1.com Web1[10781]: System.FormatException: The input is not a valid Base-64 string as it contains a non-base 64 character, more than two padding characters, or an illegal character among the padding characters. 9月 29 03:47:38 web1.com Web1[10781]: at System.Convert.FromBase64CharPtr(Char* inputPtr, Int32 inputLength) 9月 29 03:47:38 web1.com Web1[10781]: at System.Convert.FromBase64String(String s) 9月 29 03:47:38 web1.com Web1[10781]: at Microsoft.AspNetCore.Session.CookieProtection.Unprotect(IDataProtector protector, String protectedText, ILogger logger) |
Webサーバの環境。
CentOS Linux release 7.7.1908 (Core)
Asp.Net Core 2.2 (ver.2.2.7)
発行した開発PCの環境。
Windows 10 Pro (ver.1903)
.Net Core SDK 2.2.402
Visual Studio 2019 (ver.16.3.1)
Asp.Net Core 2.2 (ver.2.2.7)
参考。Cookieのセキュア設定。
https://infosec.mozilla.org/guidelines/web_security#cookies
コメント