From 4ef52f57363df31ccb867a9c9568d61eb53ffd32 Mon Sep 17 00:00:00 2001
From: liukuo <liukuo.lk@163.com>
Date: Tue, 11 Jan 2022 11:11:37 +0800
Subject: [PATCH] =?UTF-8?q?=E8=AE=BE=E7=BD=AE=20Cookie=20=E7=9A=84SameSite?=
 =?UTF-8?q?=20=E4=B8=BALax?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../Controllers/HomeController.cs               | 15 ++++++++++-----
 .../YiSha.Admin.Web/Views/Home/Index.cshtml     | 17 ++++++++++++++++-
 YiSha.Web/YiSha.Web.Code/State/CookieHelper.cs  |  2 ++
 3 files changed, 28 insertions(+), 6 deletions(-)

diff --git a/YiSha.Web/YiSha.Admin.Web/Controllers/HomeController.cs b/YiSha.Web/YiSha.Admin.Web/Controllers/HomeController.cs
index d281cb3c..46d34bc8 100644
--- a/YiSha.Web/YiSha.Admin.Web/Controllers/HomeController.cs
+++ b/YiSha.Web/YiSha.Admin.Web/Controllers/HomeController.cs
@@ -67,13 +67,13 @@ public IActionResult Login()
             return View();
         }
 
-        [HttpGet]
-        public async Task<IActionResult> LoginOff()
+        [HttpPost]
+        public async Task<IActionResult> LoginOffJson()
         {
-            #region 退出系统
             OperatorInfo user = await Operator.Instance.Current();
             if (user != null)
             {
+                #region 退出系统
                 // 如果不允许同一个用户多次登录，当用户登出的时候，就不在线了
                 if (!GlobalContext.SystemConfig.LoginMultiple)
                 {
@@ -95,9 +95,14 @@ public async Task<IActionResult> LoginOff()
 
                 Operator.Instance.RemoveCurrent();
                 new CookieHelper().RemoveCookie("RememberMe");
+
+                return Json(new TData { Tag = 1 });
+                #endregion
+            }
+            else
+            {
+                throw new Exception("非法请求");
             }
-            #endregion
-            return View(nameof(Login));
         }
 
         [HttpGet]
diff --git a/YiSha.Web/YiSha.Admin.Web/Views/Home/Index.cshtml b/YiSha.Web/YiSha.Admin.Web/Views/Home/Index.cshtml
index 35bbd695..a9086e7d 100644
--- a/YiSha.Web/YiSha.Admin.Web/Views/Home/Index.cshtml
+++ b/YiSha.Web/YiSha.Admin.Web/Views/Home/Index.cshtml
@@ -129,7 +129,7 @@
                             </li>
                             <li class="divider"></li>
                             <li>
-                                <a href="@Url.Content("~/Home/LoginOff")">
+                                <a href="#" onclick="loginOff()">
                                     <i class="fa fa-sign-out"></i> 退出登录
                                 </a>
                             </li>
@@ -203,4 +203,19 @@
             maxmin: false
         });
     }
+
+    function loginOff() {
+         ys.ajax({
+                url: '@Url.Content("~/Home/LoginOffJson")',
+                type: "post",
+                success: function (obj) {
+                    if (obj.Tag == 1) {
+                       location.href = '@Url.Content("~/Home/Index")';
+                    }
+                    else {
+                        ys.msgError(obj.Message);
+                    }
+                }
+            });
+    }
 </script>
diff --git a/YiSha.Web/YiSha.Web.Code/State/CookieHelper.cs b/YiSha.Web/YiSha.Web.Code/State/CookieHelper.cs
index c3bd0c42..aa24147e 100644
--- a/YiSha.Web/YiSha.Web.Code/State/CookieHelper.cs
+++ b/YiSha.Web/YiSha.Web.Code/State/CookieHelper.cs
@@ -24,6 +24,7 @@ public void WriteCookie(string sName, string sValue, bool httpOnly = true)
             CookieOptions option = new CookieOptions();
             option.Expires = DateTime.Now.AddDays(30);
             option.HttpOnly = httpOnly;
+            option.SameSite = SameSiteMode.Lax;
             hca?.HttpContext?.Response.Cookies.Append(sName, sValue, option);
         }
 
@@ -40,6 +41,7 @@ public void WriteCookie(string sName, string sValue, int expires, bool httpOnly
             CookieOptions option = new CookieOptions();
             option.Expires = DateTime.Now.AddMinutes(expires);
             option.HttpOnly = httpOnly;
+            option.SameSite = SameSiteMode.Lax;
             hca?.HttpContext?.Response.Cookies.Append(sName, sValue, option);
         }