From bac16132a8fd431cba2ede1b030400fc6e78054c Mon Sep 17 00:00:00 2001
From: hjhan <hongjun.han@yieldchain.com>
Date: Mon, 27 Apr 2026 13:25:50 +0800
Subject: [PATCH] =?UTF-8?q?fix(auth):=20Cookie=E8=AE=A4=E8=AF=81AJAX?=
 =?UTF-8?q?=E8=AF=B7=E6=B1=82=E8=BF=94=E5=9B=9E401=E5=B9=B6=E5=A2=9E?=
 =?UTF-8?q?=E5=8A=A0=E8=AF=8A=E6=96=AD=E6=97=A5=E5=BF=97?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

OnRedirectToLogin/OnRedirectToAccessDenied中对AJAX请求返回401而非302，
并增加请求头诊断日志便于排查认证跳转问题
---
 YLErpWeb/Program.cs | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/YLErpWeb/Program.cs b/YLErpWeb/Program.cs
index a9a0a243..af91693c 100644
--- a/YLErpWeb/Program.cs
+++ b/YLErpWeb/Program.cs
@@ -74,8 +74,11 @@ try
             {
                 OnRedirectToLogin = context =>
                 {
-                    if (context.Request.Headers["X-Requested-With"] == "XMLHttpRequest" ||
-                        !context.Request.Headers["Accept"].ToString().Contains("text/html"))
+                    var accept = context.Request.Headers["Accept"].ToString();
+                    var xrw = context.Request.Headers["X-Requested-With"].ToString();
+                    var isAjax = xrw == "XMLHttpRequest" || !accept.Contains("text/html");
+                    logger.Info($"[CookieAuth] OnRedirectToLogin Path={context.Request.Path} Accept={accept} X-Requested-With={xrw} IsAjax={isAjax}");
+                    if (isAjax)
                     {
                         context.Response.StatusCode = 401;
                         return Task.CompletedTask;
@@ -85,8 +88,11 @@ try
                 },
                 OnRedirectToAccessDenied = context =>
                 {
-                    if (context.Request.Headers["X-Requested-With"] == "XMLHttpRequest" ||
-                        !context.Request.Headers["Accept"].ToString().Contains("text/html"))
+                    var accept = context.Request.Headers["Accept"].ToString();
+                    var xrw = context.Request.Headers["X-Requested-With"].ToString();
+                    var isAjax = xrw == "XMLHttpRequest" || !accept.Contains("text/html");
+                    logger.Info($"[CookieAuth] OnRedirectToAccessDenied Path={context.Request.Path} Accept={accept} X-Requested-With={xrw} IsAjax={isAjax}");
+                    if (isAjax)
                     {
                         context.Response.StatusCode = 403;
                         return Task.CompletedTask;