在ASP.NET Core MVC与Azure中优化API请求头的高效实现

我使用ASP.NET Core 8.0 MVC开发了一个Web应用，我们的API仅接受带有正确scope和clientID的请求。目前调用API时遇到访问问题，仅能通过创建服务调用Get/Put/Post接口，且需在每次请求中手动添加请求头。现咨询是否存在更高效的请求头创建方式？能否在program.cs文件中配置实现？

当前调用代码 #

每次调用需手动提取令牌并添加至HttpClient请求头：

using var request = await _downstreamApi.CallApiForUserAsync("DownstreamApi");
var BearerToken = request.RequestMessage.Headers.Authorization;

// 将令牌添加到HttpClient请求头
_httpClient.DefaultRequestHeaders.Authorization = BearerToken;

后续API调用逻辑：

var response = await _httpClient.GetAsync("api/AccountCategoryType");
response.EnsureSuccessStatusCode();

return await response.Content.ReadFromJsonAsync<IEnumerable<AccountCategoryType>>();

现有program.cs配置 #

builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApp(builder.Configuration.GetSection("AzureAd"))
        .EnableTokenAcquisitionToCallDownstreamApi(initialScopes)
            .AddMicrosoftGraph(builder.Configuration.GetSection("MicrosoftGraph"))
            .AddDownstreamApi("DownstreamApi", builder.Configuration.GetSection("DownstreamApi"))
            .AddInMemoryTokenCaches();

方法1：直接使用IDownstreamApi内置方法调用API #

IDownstreamApi已封装令牌自动获取与请求头附加逻辑，无需手动处理。直接调用对应方法即可完成API请求：

var result = await _downstreamApi.CallApiForUserAsync<IEnumerable<AccountCategoryType>>(
    "DownstreamApi",
    options =>
    {
        options.RelativePath = "api/AccountCategoryType";
        options.HttpMethod = HttpMethod.Get;
    });

return result;

POST/PUT请求只需修改HttpMethod并传入请求内容即可，全程无需手动操作请求头。

方法2：配置自动附加令牌的HttpClient #

若偏好使用自定义HttpClient实例，可通过消息处理器实现令牌自动注入，在program.cs中完成配置：

// 注册带令牌自动注入的HttpClient
builder.Services.AddHttpClient("MyApiClient")
    .AddHttpMessageHandler<BearerTokenHandler>();

// 自定义消息处理器：自动获取并添加Authorization头
public class BearerTokenHandler : DelegatingHandler
{
    private readonly ITokenAcquisition _tokenAcquisition;
    private readonly IConfiguration _configuration;

    public BearerTokenHandler(ITokenAcquisition tokenAcquisition, IConfiguration configuration)
    {
        _tokenAcquisition = tokenAcquisition;
        _configuration = configuration;
    }

    protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
    {
        var scopes = _configuration.GetSection("DownstreamApi:Scopes").Get<string[]>();
        var token = await _tokenAcquisition.GetAccessTokenForUserAsync(scopes);
        request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token);

        return await base.SendAsync(request, cancellationToken);
    }
}

// 注册自定义处理器
builder.Services.AddTransient<BearerTokenHandler>();

在服务中通过IHttpClientFactory获取配置好的HttpClient即可自动带令牌请求：

private readonly IHttpClientFactory _httpClientFactory;

public YourService(IHttpClientFactory httpClientFactory)
{
    _httpClientFactory = httpClientFactory;
}

public async Task<IEnumerable<AccountCategoryType>> GetAccountCategoryTypes()
{
    var client = _httpClientFactory.CreateClient("MyApiClient");
    var response = await client.GetAsync("api/AccountCategoryType");
    response.EnsureSuccessStatusCode();

    return await response.Content.ReadFromJsonAsync<IEnumerable<AccountCategoryType>>();
}

方法3：复用AddDownstreamApi配置的HttpClient #

你已通过AddDownstreamApi完成了API的scope与客户端信息配置，对应的HttpClient已自动集成令牌处理逻辑。直接通过IHttpClientFactory获取该客户端即可：

private readonly IHttpClientFactory _httpClientFactory;

public YourService(IHttpClientFactory httpClientFactory)
{
    _httpClientFactory = httpClientFactory;
}

public async Task<IEnumerable<AccountCategoryType>> GetAccountCategoryTypes()
{
    var client = _httpClientFactory.CreateClient("DownstreamApi");
    var response = await client.GetAsync("api/AccountCategoryType");
    response.EnsureSuccessStatusCode();

    return await response.Content.ReadFromJsonAsync<IEnumerable<AccountCategoryType>>();
}

此方法无需额外配置，直接复用现有注册的客户端即可实现自动附加请求头。

内容的提问来源于stack exchange，提问作者Manny Sanchez