.NET 8升级后使用UseDefaultCredentials的Http请求失败求助

以下代码在.NET 6.0 Windows环境可正常运行，但升级至.NET 8.0 Windows环境后执行失败；WSL环境下无论.NET 6还是.NET 8均能正常运行：

var client = new HttpClient(new HttpClientHandler() { UseDefaultCredentials = true });
var message = new HttpRequestMessage(HttpMethod.Post, "http://example.com/endpoint");
var response = client.Send(message);

被调用的第三方端点无法修改，返回错误信息：

Authentication validation failed with error - InvalidToken.

错误堆栈如下：

System.Net.Http.HttpRequestException: Authentication validation failed with error - InvalidToken.
   at System.Net.Http.AuthenticationHelper.SendWithNtAuthAsync(HttpRequestMessage request, Uri authUri, Boolean async, ICredentials credentials, Boolean isProxyAuth, HttpConnection connection, HttpConnectionPool connectionPool, CancellationToken cancellationToken)
   at System.Net.Http.HttpConnectionPool.SendWithVersionDetectionAndRetryAsync(HttpRequestMessage request, Boolean async, Boolean doRequestAuth, CancellationToken cancellationToken)
   at System.Net.Http.AuthenticationHelper.SendWithAuthAsync(HttpRequestMessage request, Uri authUri, Boolean async, ICredentials credentials, Boolean preAuthenticate, Boolean isProxyAuth, Boolean doRequestAuth, HttpConnectionPool pool, CancellationToken cancellationToken)
   at System.Net.Http.HttpMessageHandlerStage.Send(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Net.Http.DiagnosticsHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
   at System.Net.Http.HttpMessageHandlerStage.Send(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Net.Http.Metrics.MetricsHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
   at System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, Boolean async, CancellationToken cancellationToken)
   at System.Net.Http.HttpMessageHandlerStage.Send(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Net.Http.SocketsHttpHandler.Send(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Net.Http.HttpClient.Send(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationToken cancellationToken)
   at System.Net.Http.HttpClient.Send(HttpRequestMessage request)

.NET 8对Windows环境下的NTLM/Kerberos认证逻辑做了变更：默认启用了Extended Protection for Authentication (EPA)，而第三方端点不支持这种扩展保护机制，导致生成的认证令牌被判定为无效。WSL环境不受Windows特定的认证逻辑变更影响，因此运行正常。

方案1：禁用EPA（最小代码改动） #

显式修改HttpClientHandler的配置，关闭Extended Protection：

var handler = new HttpClientHandler
{
    UseDefaultCredentials = true,
    // 关键配置：关闭Extended Protection，兼容不支持EPA的旧端点
    ExtendedProtectionPolicy = new System.Security.Authentication.ExtendedProtectionPolicy(System.Security.Authentication.ExtendedProtectionPolicyType.None)
};
var client = new HttpClient(handler);
var message = new HttpRequestMessage(HttpMethod.Post, "http://example.com/endpoint");
var response = client.Send(message);

方案2：改用WinHttpHandler #

如果HttpClientHandler的变更仍有问题，可以切换到WinHttpHandler，它的认证行为更贴近.NET 6的旧逻辑：

1. 先安装NuGet包System.Net.Http.WinHttpHandler
2. 修改代码：

var handler = new WinHttpHandler
{
    UseDefaultCredentials = true
};
var client = new HttpClient(handler);
var message = new HttpRequestMessage(HttpMethod.Post, "http://example.com/endpoint");
var response = client.Send(message);

方案3：全局配置回退行为 #

不想修改代码的话，可以通过配置文件或代码全局关闭EPA：

• 方式1：在appsettings.json中添加配置

{
  "System.Net.Http": {
    "SocketsHttpHandler": {
      "Authentication": {
        "EnableExtendedProtection": false
      }
    }
  }
}

• 方式2：在应用启动时设置全局开关

AppContext.SetSwitch("System.Net.Http.SocketsHttpHandler.EnableExtendedProtection", false);

内容的提问来源于stack exchange，提问作者Andrew Radford