.NET 6 WebAssembly迁移至.NET 8 Blazor添加ApiAuthorization报错求助

核心问题分析 #

从.NET 6 Blazor WASM迁移到.NET 8 Blazor Auto/SSR模式时，公私API的HttpClient需要自动携带认证Cookie/令牌，原手动HttpClient配置无法适配新的认证体系，导致添加AddApiAuthorization后出现服务缺失或认证状态异常的报错。

分步解决方案 #

1. 客户端HttpClient配置（关键修正） #

替换原手动创建HttpClient的方式，利用AddApiAuthorization提供的消息处理器自动附加认证信息：

// 公开API HttpClient：无需认证，直接配置基础地址
builder.Services.AddHttpClient("RGPublic", client => 
    client.BaseAddress = new Uri(builder.HostEnvironment.BaseAddress));

// 私有API HttpClient：关联认证消息处理器，自动携带认证令牌/Cookie
builder.Services.AddHttpClient("RGPrivate", client => 
    client.BaseAddress = new Uri(builder.HostEnvironment.BaseAddress))
    .AddHttpMessageHandler<BaseAddressAuthorizationMessageHandler>();

// 可选：保留默认注入私有HttpClient的配置（如果有组件直接注入HttpClient）
builder.Services.AddScoped(sp => sp.GetRequiredService<IHttpClientFactory>().CreateClient("RGPrivate"));

// 完成ApiAuthorization配置
builder.Services.AddApiAuthorization();
// 注册客户端认证状态提供器
builder.Services.AddScoped<AuthenticationStateProvider, PersistentAuthenticationStateProvider>();

BaseAddressAuthorizationMessageHandler会自动从当前认证状态中获取有效凭据，并附加到私有API的请求中，解决未携带认证信息的问题。

2. 服务器端配置优化 #

推荐方案：避免服务器端调用自身API

微软不推荐服务器端通过HttpClient调用自身API，直接注入业务逻辑服务或仓储层组件效率更高，无需额外配置。

特殊场景：必须保留服务器端HttpClient调用

需要配置HttpClient传递当前请求的Cookie，同时添加HttpContextAccessor：

// 注册HttpContextAccessor以获取当前请求上下文
builder.Services.AddHttpContextAccessor();

// 服务器端私有API HttpClient配置：复制当前请求的Cookie
builder.Services.AddHttpClient("RGPrivateServer", client => 
    client.BaseAddress = new Uri(builder.Configuration["ApiBaseAddress"] ?? "https://localhost:5001"))
    .AddHttpMessageHandler(sp => 
    {
        var accessor = sp.GetRequiredService<IHttpContextAccessor>();
        return new CookieMessageHandler(accessor);
    });

// 保持现有认证状态提供器配置
builder.Services.AddScoped<AuthenticationStateProvider, PersistingRevalidatingAuthenticationStateProvider>();

自定义CookieMessageHandler实现Cookie传递：

public class CookieMessageHandler : DelegatingHandler
{
    private readonly IHttpContextAccessor _httpContextAccessor;

    public CookieMessageHandler(IHttpContextAccessor httpContextAccessor)
    {
        _httpContextAccessor = httpContextAccessor;
    }

    protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
    {
        var context = _httpContextAccessor.HttpContext;
        if (context != null)
        {
            foreach (var cookie in context.Request.Cookies)
            {
                request.Headers.Add("Cookie", $"{cookie.Key}={cookie.Value}");
            }
        }
        return await base.SendAsync(request, cancellationToken);
    }
}

3. 服务注入与API调用保持简洁 #

UserService无需手动处理认证凭据，配置好的HttpClient会自动完成：

public class UserService
{
    private readonly HttpClient _httpPrivate;
    private readonly HttpClient _httpPublic;
    private readonly AuthenticationStateProvider _authenticationStateProvider;

    public UserService(IHttpClientFactory httpFactory, AuthenticationStateProvider authenticationStateProvider)
    {
        _httpPrivate = httpFactory.CreateClient("RGPrivate");
        _httpPublic = httpFactory.CreateClient("RGPublic");
        _authenticationStateProvider = authenticationStateProvider;
    }

    // 后续API调用直接使用_httpPrivate/_httpPublic即可，自动携带认证信息
}

4. 报错解决说明 #

• 第一个报错（服务缺失）：因客户端添加AddApiAuthorization后，未关联对应的认证消息处理器，导致认证相关服务无法正确注入，按步骤1配置后即可解决。
• 第二个报错（认证状态异常）：因服务器端未正确配置认证状态提供器，或HttpClient未传递认证上下文，按步骤2配置后即可修复。

内容的提问来源于stack exchange，提问作者Brett JB