facebook - URL 被阻止 : This redirect failed because the redirect URI is not whitelisted in the app’s Client OAuth Settings?

Question

我点击了链接https://learn.microsoft.com/en-us/azure/app-service-mobile/app-service-mobile-how-to-configure-facebook-authentication设置 Facebook 登录。

在 https://developers.facebook.com/apps ，“有效的 OAuth 重定向 URI”具有以下 URI

https://myapp.azurewebsites.net/.auth/login/facebook/callback 

但是仍然出现错误？

URL Blocked: This redirect failed because the redirect URI is not whitelisted in the app’s Client OAuth Settings. Make sure Client and Web OAuth Login are on and add all your app domains as Valid OAuth Redirect URIs.

<小时/>

更新: 添加了 https://myapp.azurewebsites.net/signin-facebook和https://myapp.azurewebsites.net/.auth/login/facebook/callback 。现在网站出现错误

A claim of type 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier' or 'http://schemas.microsoft.com/accesscontrolservice/2010/07/claims/identityprovider' was not present on the provided ClaimsIdentity. To enable anti-forgery token support with claims-based authentication, please verify that the configured claims provider is providing both of these claims on the ClaimsIdentity instances it generates. If the configured claims provider instead uses a different claim type as a unique identifier, it can be configured by setting the static property AntiForgeryConfig.UniqueClaimTypeIdentifier. 。

上线@Html.AntiForgeryToken()在d:\home\site\wwwroot\Views\Account\_ExternalLoginsListPartial.cshtm

<小时/>

更新: 在 global.asax 中添加以下行，上面的错误消失了。

AntiForgeryConfig.UniqueClaimTypeIdentifier = ClaimTypes.NameIdentifier;

但是，它只显示以下消息框，网址为 https://myapp.azurewebsites.net/.auth/login/done#_=_ .

You have successfully signed in
-> RETURN TO THE WEBSITE

单击该链接将返回登录屏幕。 https://myapp.azurewebsites.net/ (不需要授权)而不是https://myapp.azurewebsites.net/event 。打字 https://myapp.azurewebsites.net/event将再次显示登录页面。 (重定向至https://myapp.azurewebsites.net/Account/Login?ReturnUrl=%2Fevent)

Answer 1

正如这位官方tutorial关于Azure应用服务中的身份验证和授权:

App Service Authentication / Authorization is a feature that provides a way for your application to sign in users so that you don't have to change code on the app backend. It provides an easy way to protect your application and work with per-user data.

您可以通过浏览器https://myapp.azurewebsites.net/.auth/login/facebook进行登录。

URL Blocked: This redirect failed because the redirect URI is not whitelisted in the app’s Client OAuth Settings. Make sure Client and Web OAuth Login are on and add all your app domains as Valid OAuth Redirect URIs.

您可以利用fiddler捕获网络包来检查你的facebook登录处理如下:

注意:确保上述 redirect_uri 已添加到有效的 OAuth 重定向 URI。 HTTP 或 HTTPS 可能是一个可能的原因。

此外，如果您使用中间件 UseFacebookAuthentication 来验证使用 Facebook 的用户，我假设您需要添加 http(s)://myapp.azurewebsites.net/signin-facebook 到有效的 OAuth 重定向 URI 或者您可以尝试使用以下代码:

app.UseFacebookAuthentication(new FacebookAuthenticationOptions()
{
    AppId = "{your-app-id}",
    AppSecret = "{your-app-secret}",
    CallbackPath = new PathString("/.auth/login/facebook/callback")
});

更新:

我关注了这个tutorial关于在 ASP.NET MVC5 中使用 OWIN 处理 Facebook 身份验证，我发现无法检索已记录的 facebook 用户信息，并且 returnUrl 不起作用。经过一番尝试，我发现Facebook将graph API从v2.2强制升级到v2.3，如下:

Facebook 图形 API，Changes from v2.2 to v2.3 :

[Oauth Access Token] Format - The response format of https://www.facebook.com/v2.3/oauth/access_token returned when you exchange a code for an access_token now return valid JSON instead of being URL encoded. The new format of this response is {"access_token": {TOKEN}, "token_type":{TYPE}, "expires_in":{TIME}}. We made this update to be compliant with section 5.1 of RFC 6749.

您需要升级 Microsoft.Owin.Security.Facebook到 3.1.0，或者您需要实现 BackchannelHttpHandler在此提到issue .