如何用C#获取SharePoint Online文档？403禁止访问问题求助

你作为团队所有者仍遇到403错误，通常和认证配置错误、资源路径问题或权限细节限制有关，以下是具体排查和修复方案：

一、排查认证配置问题 #

你的代码未显示HttpClient的认证逻辑，这是最常见的原因。SharePoint Online不支持匿名访问，必须携带有效认证凭证：

未开启MFA的账号：使用用户名密码认证 #

如果账号未启用多因素认证，可通过获取Bearer Token完成认证：

using System.Net.Http.Headers;
using Microsoft.Identity.Client;

// 配置Azure AD应用参数（需提前注册应用并授予Sites.Read.All权限）
string clientId = "你的Azure AD应用客户端ID";
string tenantId = "你的租户ID";
string username = "你的账号";
string password = "你的密码";

// 获取认证Token
var pca = PublicClientApplicationBuilder.Create(clientId)
    .WithTenantId(tenantId)
    .Build();
var scopes = new[] { "https://graph.microsoft.com/Sites.Read.All" };
var authResult = await pca.AcquireTokenByUsernamePassword(scopes, username, password).ExecuteAsync();

// 配置HttpClient的认证头
HttpClient client = new HttpClient();
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", authResult.AccessToken);

开启MFA的账号：使用设备代码流认证 #

若账号开启了多因素认证，需通过设备代码流让用户手动授权：

var authResult = await pca.AcquireTokenWithDeviceCode(scopes, deviceCodeResult =>
{
    Console.WriteLine(deviceCodeResult.Message); // 提示用户在指定页面输入代码授权
    return Task.FromResult(0);
}).ExecuteAsync();

二、检查资源路径是否正确 #

你拼接的服务器相对URL可能存在格式错误，比如重复斜杠或路径层级错误：

• 确保webRelativeUrl是站点的相对路径（如/sites/YourTeamSite），避免多余斜杠
• 用Path.Combine构造路径，避免手动拼接的格式问题：

string serverRelativePath = Path.Combine(webRelativeUrl.Trim('/'), documentLibName, fileName).Replace("\\", "/");
Uri endpointUri = new Uri($"{webUrl.TrimEnd('/')}/_api/web/GetFileByServerRelativeUrl('{serverRelativePath}')/$value");

三、排查权限细节 #

即使是团队所有者，也可能存在以下权限限制：

• 权限继承被打破：进入文档库设置→权限设置，检查是否禁用了继承，且你的账号未被分配该文档库/文件的访问权限
• IP访问限制：管理员可能设置了IP白名单，你的客户端IP不在允许范围内

四、修正文件写入逻辑 #

你的代码使用FileMode.OpenOrCreate | FileMode.Append会导致下载文件被追加而非覆盖，应改为FileMode.Create：

using (FileStream outputStream = new FileStream(Path.Combine(path, fileName), FileMode.Create, FileAccess.Write, FileShare.None))
{
    await contentStream.CopyToAsync(outputStream);
}

完整修正后的示例代码 #

using System;
using System.IO;
using System.Net.Http;
using System.Net.Http.Headers;
using System.Threading.Tasks;
using Microsoft.Identity.Client;

class Program
{
    static async Task Main(string[] args)
    {
        string webUrl = "https://yourtenant.sharepoint.com/sites/YourTeamSite";
        string webRelativeUrl = "/sites/YourTeamSite";
        string documentLibName = "Documents";
        string fileName = "Test.docx";
        string savePath = @"C:\Downloads";

        // 认证配置
        string clientId = "your-client-id";
        string tenantId = "your-tenant-id";
        string username = "your-account@tenant.onmicrosoft.com";
        string password = "your-password";

        var pca = PublicClientApplicationBuilder.Create(clientId)
            .WithTenantId(tenantId)
            .Build();
        var scopes = new[] { "https://graph.microsoft.com/Sites.Read.All" };
        var authResult = await pca.AcquireTokenByUsernamePassword(scopes, username, password).ExecuteAsync();

        // 构造正确的资源路径
        string serverRelativePath = Path.Combine(webRelativeUrl.Trim('/'), documentLibName, fileName).Replace("\\", "/");
        Uri endpointUri = new Uri($"{webUrl.TrimEnd('/')}/_api/web/GetFileByServerRelativeUrl('{serverRelativePath}')/$value");

        using (HttpClient client = new HttpClient())
        {
            client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", authResult.AccessToken);
            try
            {
                HttpResponseMessage response = await client.GetAsync(endpointUri);
                response.EnsureSuccessStatusCode();

                using (Stream contentStream = await response.Content.ReadAsStreamAsync())
                {
                    string fullSavePath = Path.Combine(savePath, fileName);
                    using (FileStream outputStream = new FileStream(fullSavePath, FileMode.Create, FileAccess.Write, FileShare.None))
                    {
                        await contentStream.CopyToAsync(outputStream);
                    }
                }
                Console.WriteLine("File downloaded successfully.");
            }
            catch (HttpRequestException ex)
            {
                Console.WriteLine($"Error downloading file: {ex.Message}");
                if (ex.InnerException != null)
                {
                    Console.WriteLine($"Inner exception: {ex.InnerException.Message}");
                }
            }
        }
    }
}

内容的提问来源于stack exchange，提问作者Jerry