Azure API Management获取OAuth令牌放入请求头时遇500错误求助

作为Azure和API Management新手，我需要为每个请求从OAuth资源获取令牌，但反复遇到500内部服务器错误，最终定位到问题：从send-request的响应变量中提取令牌并放入后端请求头的环节存在问题。

原策略代码如下：

<send-request mode="new" response-variable-name="tokenstate" timeout="20" ignore-error="false">
    <set-url>https://xxx/token</set-url>
    <set-method>POST</set-method>
    <set-header name="Content-Type" exists-action="override">
        <value>application/x-www-form-urlencoded</value>
    </set-header>
    <set-header name="Authorization" exists-action="override">
        <value>{{Named Value}}</value>
    </set-header>
    <set-body>@{ 
       return "grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&scope={{Named Value}}&assertion={{Named Value}}";
       }
    </set-body>
</send-request>

<set-header name="Authorization" exists-action="override">
    <value>@("Bearer " + (String)((IResponse)context.Variables["tokenstate"]).Body.As<JObject>()["access_token"])</value>
</set-header>
<set-header name="Content-Type" exists-action="override">
    <value>application/json</value>
</set-header>
<set-header exists-action="delete" name="Ocp-Apim-Subscription-Key"/>
<set-backend-service backend-id="{{Backend Service}}" />

问题分析 #

1. 未处理令牌请求失败场景：ignore-error="false"会导致令牌请求返回非200状态时直接抛出异常，触发500错误。
2. 无空值判断：如果响应中不存在access_token字段，直接提取会引发空引用异常。

修复后的策略代码 #

<send-request mode="new" response-variable-name="tokenstate" timeout="20" ignore-error="true">
    <set-url>https://xxx/token</set-url>
    <set-method>POST</set-method>
    <set-header name="Content-Type" exists-action="override">
        <value>application/x-www-form-urlencoded</value>
    </set-header>
    <set-header name="Authorization" exists-action="override">
        <value>{{Named Value}}</value>
    </set-header>
    <set-body>@{ 
       return "grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&scope={{Named Value}}&assertion={{Named Value}}";
       }
    </set-body>
</send-request>

<!-- 先验证令牌请求是否成功，再处理令牌提取 -->
<choose>
    <when condition="@(((IResponse)context.Variables["tokenstate"]).StatusCode == 200)">
        <set-header name="Authorization" exists-action="override">
            <value>@{
                var tokenResponse = ((IResponse)context.Variables["tokenstate"]).Body.As<JObject>();
                return tokenResponse.ContainsKey("access_token") ? $"Bearer {tokenResponse["access_token"]}" : string.Empty;
            }</value>
        </set-header>
    </when>
    <otherwise>
        <!-- 令牌获取失败时返回明确的401错误，方便排查 -->
        <return-response>
            <set-status code="401" reason="Unauthorized" />
            <set-body>@{
                var errorDetails = ((IResponse)context.Variables["tokenstate"]).Body.As<string>();
                return $"获取访问令牌失败: {errorDetails}";
            }</set-body>
        </return-response>
    </otherwise>
</choose>

<set-header name="Content-Type" exists-action="override">
    <value>application/json</value>
</set-header>
<set-header exists-action="delete" name="Ocp-Apim-Subscription-Key"/>
<set-backend-service backend-id="{{Backend Service}}" />

修复说明 #

• 将ignore-error改为true，允许继续执行后续逻辑，避免直接抛出500错误
• 添加choose分支判断，只有令牌请求返回200时才提取令牌
• 提取access_token前先检查字段是否存在，防止空引用异常
• 令牌获取失败时返回401状态码和错误详情，便于定位问题

内容的提问来源于stack exchange，提问作者Scott Paulin