我有一个在Visual Studio中创建的Web应用程序，并将Web Deploy发布到Windows Server IIS站点。我[有时]能够访问http：//testapp.domain.ext网站，[有时]能够登录但无法访问内部“gui”页面，[有时]能够登录并成功访问“API”页面。
网站不停地转啊转啊转。IIS工作进程占用越来越多的CPU，直到我把它杀死。

["..." means "other lines omitted for clarity"]

Application
    .NET Core7 web application 
    Startup.cs
        ...ConfigureServices...
            services.AddMvc(options =>
            {
                options.Filters.Add(new AutoValidateAntiforgeryTokenAttribute());
            })
        ...{add Session Cookie}...
        ...{add Authentication Cookie}...
        
    All pages except consolidated Error page and various standard in/out Identity pages (e.g. login, logout, forgot password, etc) require authenciation by default, and most also require authorization for specific role(s)
        consolidated Error page and the standard in/out Identity pages have [AllowAnonymous] 
        consolidated Error page also has [IgnoreAntiforgeryToken]

Development Environment
    OS is Windows 10 
    database is SQL Server 2019 database Developer Edition
    ASPNETCORE_ENVIRONMENT = "Development"
    IIS is 10.0
    
Testing Environment
    OS is Windows Server 2019 Datacenter 
    database is SQL Server 2022 Express Edition
    ASPNETCORE_ENVIRONMENT = "Testing"
    IIS is 10.0

In Both Environments ... 

    c:\inetpub\wwwroot\{siteShortName}
        delete all files except web.config

    SSL Certificates

        Installed self-signed certificates using PowerShell instructions found at
            https://stackoverflow.com/questions/8169999/how-can-i-create-a-self-signed-cert-for-localhost
            
        As per https://learn.microsoft.com/en-us/aspnet/core/host-and-deploy/iis/advanced?view=aspnetcore-7.0
            "Configure the IIS Application Pool to load the user profile"
                "Keys are persisted to the %LOCALAPPDATA%/ASP.NET/DataProtection-Keys folder."
                    also deleted .xml file at %LOCALAPPDATA%/ASP.NET/DataProtection-Keys

        Development
        
            gemerated a localhost self-signed certificate and added to trusted root certificates
            
        Testing
        
            gemerated a localhost self-signed certificate and added to trusted root certificates
            
            gemerated a testapp.{siteName}.{ext} self-signed certificate and added to trusted root certificates 
            
    in IIS      

        Application Pool {siteName}
            Basic Settings
                .NET CLR Version        v4.0
                Manage Pipeline Mode    Integrated
                Applications            1
            Advanced Settings
                Identity                NETWORK SERVICE 
                Load User Profile       true
            
        Sites {siteShortName}
        
            Using Application Pool {siteShortName}
        
            Bindings
                
                Development     
                    http:80             
                    https:443               
                        using localhost self-signed certificate created via PowerShell script
                        no hostname
                        
                Testing     
                    http:80             
                    https:443               
                        using testapp.domain.ext self-signed certificate created via PowerShell script      
                        hostname testapp.domain.ext
                    https:444               
                        using localhost self-signed certificate created via PowerShell script
                        no hostname

    via Visual Studio 2020

        Launches application via IIS Express
            Runs fine!
            
        Published via WebDav to IIS on same computer
             publish profile includes
                ...<ExcludeFilesFromDeployment>Web.config</ExcludeFilesFromDeployment>...
            
    Manually checked web.config to verify inclusion of
        ...<add name="aspNetCore" path="*" verb="*" modules="AspNetCoreModuleV2" resourceType="Unspecified" />...
        ...<aspNetCore processPath="dotnet" arguments=".\{appName}.dll" stdoutLogEnabled="false" stdoutLogFile=".\logs\stdout" hostingModel="inprocess">...
        ...<environmentVariable name="ASPNETCORE_ENVIRONMENT" value="{environmentStringAsAppropriate}" />...
        ...<rule name="HTTP to HTTPS" stopProcessing="true">...
            ... <action type="Redirect" url="https://{HTTP_HOST}{REQUEST_URI}" appendQueryString="false" redirectType="Temporary"  />...
        
    Accessed website using Chrome (have tried normal, incognito; and also Firefox with both methods; same results on all; cleared cookies before each attempt)

        Development
        
            IISExpress from w/i visual Studio       
                
                able to login and access all pages and features as expected         
        
            http://localhost 
            
                successfully redirected to https://localhost with NO warnings about not secure site (yay), 
                
                was able to login and access all pages and features as expected (yay),
                    
                nothing new was written to %LOCALAPPDATA%/ASP.NET/DataProtection-Keys (not really sure if it supposed to for localhost, but app works, so ?)
        
        Testing
        
            IISExpress from w/i visual Studio       
                
                able to login and access all pages and features as expected     
        
            http://localhost:444 
            
                successfully redirected to https://localhost with NO warnings about not secure site (yay), 
                
                was able to login and access all pages and features as expected (yay), 
                    
                nothing new was written to %LOCALAPPDATA%/ASP.NET/DataProtection-Keys ((not really sure if it supposed to for localhost, but app works, so ?)
            
            http://testapp.domain.ext
            
                successfully redirected to http://testapp.domain.ext WITH warnings about not secure site  (boo)
            
                    accepted warning and proceeded      
            
                login page loaded as expected (yay), 
                    
                    Database access was fine as evidenced by the database-driven FAQs present on the login page
                
                Input credentials and submitted
                
                    98% of my tries, Login never resolves to anything; just sits and spins and spins and spins (booooooooooooooooooooooooo)
                        
                        the IIS Worker Process spins up CPU usage and must be ended via Task Manager (booooooooooooooooooooooooo)
                    
                        nothing new gets written to %LOCALAPPDATA%/ASP.NET/DataProtection-Keys(really thought it would but since didn't access app after login I guess that makes sense; also it didn't for localhost, but app works there, so ??)
                    
                        No warnings or errors are shown in Windows Logs / Applications
        
                        inetpub/Logs/w3svc{#} file shows all seemingly-to-me normal data with 202 results for js and css files, and then ends with (also seemingly-normal-to-me) entries:
                        
                            #Software: Microsoft Internet Information Services 10.0
                            #Version: 1.0
                            #Date: 2023-03-29 19:57:29
                            #Fields: date time s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs(User-Agent) cs(Referer) sc-status sc-substatus sc-win32-status time-taken
                            2023-03-29 19:57:29 10.10.172.2 GET / - 80 - 76.25.250.251 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/111.0.0.0+Safari/537.36 - 307 0 0 192
                            2023-03-29 19:57:32 10.10.172.2 GET / - 443 - 76.25.250.251 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/111.0.0.0+Safari/537.36 - 302 0 0 2679
                            2023-03-29 19:57:32 10.10.172.2 GET /Identity/Account/Login ReturnUrl=%2F 443 - 76.25.250.251 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/111.0.0.0+Safari/537.36 - 200 0 0 612
                            2023-03-29 19:57:33 10.10.172.2 GET /favicon.ico - 443 - 76.25.250.251 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/111.0.0.0+Safari/537.36 https://testapp.domain.ext/Identity/Account/Login?ReturnUrl=%2F 200 0 0 44
                            2023-03-29 19:59:00 10.10.172.2 POST /Identity/Account/Login ReturnUrl=%2F 443 - 76.25.250.251 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/111.0.0.0+Safari/537.36 https://testapp.domain.ext/Identity/Account/Login?ReturnUrl=%2F 302 0 0 385
                        
                        after killing IIS Working Process, recyling app ppol, restarting website, and clearing cookies, subsequent access attempts often result in timeout errors so never getting to login page, or getting to login page and then spinning again as before
                        
                    1% of my tries, I'm able to login and access primary pages (e.g. Customers) but when I try to access inner "gui" pages (e.g. Customers/Edit/3) the application hangs as login does above.
                    
                    1% of tries, if I'm able to login and I skip trying to access "gui" pages and try the API pages instead, the APIs return data from the database as expected             
                    

Pulling my hair out here! Help? I'm sure it's something I've set wrong on the IIS server, but what additional things should I check?