.NET 8 gRPC客户端在macOS遇403认证失败，Windows正常求助

你的代码在Windows正常但macOS出现403错误，大概率是请求头重复、HTTP/2兼容性或证书信任问题导致，以下是具体解决步骤：

1. 移除重复的Authorization配置 #

你的代码同时在HttpClient.DefaultRequestHeaders和gRPC CallCredentials中添加了Bearer Token，这会导致请求头出现两个Authorization字段，部分服务器会判定为无效请求返回403。建议仅保留一种方式，推荐用gRPC拦截器的方式（更符合gRPC元数据处理规范）：

修改后代码：

HttpClient httpClient = new(new SocketsHttpHandler()) {
    BaseAddress = new Uri("https://..."),
    DefaultRequestVersion = HttpVersion.Version20,
    DefaultVersionPolicy = HttpVersionPolicy.RequestVersionExact,
    Timeout = Timeout.InfiniteTimeSpan,
};

GrpcChannel channel = GrpcChannel.ForAddress("https://...", new GrpcChannelOptions() {
    HttpClient = httpClient,
    Credentials = ChannelCredentials.Create(new SslCredentials(), CallCredentials.FromInterceptor((c, metadata) => {
        metadata.Add("Authorization", "Bearer " + token);
        return Task.CompletedTask;
    }))
});

var client = new MyServiceClient(channel);
var call = client.Method(new Empty());
await foreach(var draft in call.ResponseStream.ReadAllAsync(stoppingToken)) {
    // 业务逻辑
}

2. 排查HTTP/2兼容性差异 #

.NET的SocketsHttpHandler在macOS上的HTTP/2实现和Windows存在细节差异，可以先强制使用HTTP/1.1测试是否能正常运行（仅用于排查，生产环境建议用HTTP/2）：

HttpClient httpClient = new(new SocketsHttpHandler()) {
    BaseAddress = new Uri("https://..."),
    DefaultRequestVersion = HttpVersion.Version11, // 改为HTTP/1.1
    DefaultVersionPolicy = HttpVersionPolicy.RequestVersionExact,
    Timeout = Timeout.InfiniteTimeSpan,
};

如果HTTP/1.1能正常工作，说明是HTTP/2层面的问题，可以尝试调整SocketsHttpHandler的HTTP/2设置：

var socketsHandler = new SocketsHttpHandler {
    EnableMultipleHttp2Connections = true, // 启用多HTTP/2连接
};
HttpClient httpClient = new(socketsHandler) {
    // 其他配置
};

3. 验证SSL证书信任 #

macOS的证书信任机制和Windows不同，若服务器使用自签名或内部CA证书，需确保证书已被macOS系统信任：

• 打开「钥匙串访问」，将证书导入到「系统」钥匙串，并设置为「始终信任」
• 测试阶段可临时禁用证书验证（生产环境禁止使用）：

// 仅测试用，跳过证书验证
var sslCredentials = new SslCredentials(
    new X509Certificate2Collection(), 
    null, 
    (sender, cert, chain, errors) => true
);

GrpcChannel channel = GrpcChannel.ForAddress("https://...", new GrpcChannelOptions() {
    Credentials = ChannelCredentials.Create(sslCredentials, CallCredentials.FromInterceptor(...)),
    // 其他配置
});

4. 检查系统代理干扰 #

macOS的系统代理可能会篡改gRPC请求，尝试关闭系统代理，或在代码中强制忽略代理：

var socketsHandler = new SocketsHttpHandler {
    UseProxy = false,
    Proxy = null,
};
HttpClient httpClient = new(socketsHandler) {
    // 其他配置
};

内容的提问来源于stack exchange，提问作者Ugur