在.NET MAUI和Blazor中调用HoloLens API失败问题求助

我正在开发基于Blazor和.NET MAUI的两款应用，目前遇到HoloLens API调用失败的问题：Postman测试该API能正常返回数据，但代码调用始终失败。

已做过的尝试：

• 测试带Basic Auth的公开API可正常工作，排除HttpClient基础配置问题
• 尝试添加Postman推荐的Cookie、HoloLens官网提及的CSRF Cookie
• 通过HttpClientHandler配置NetworkCredential的方式验证

附上相关代码示例：

.NET MAUI基础调用代码 #

var credentials = Convert.ToBase64String(Encoding.ASCII.GetBytes("user:1234"));

// 设置Authorization请求头
client.DefaultRequestHeaders.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Basic", credentials);
var url = $"https://Hololens_IP/api/power/state";
var response = await client.GetAsync(url);
if (response.IsSuccessStatusCode)
{
    var content = response.Content.ReadAsStringAsync();
    Console.WriteLine(content.Result.ToString());
}

尝试添加CSRF Cookie的代码 #

response.Headers.Add("Cookie", "CSRF-Token=TokenOfTheCredentials");

参考第三方示例的代码 #

private void Initialize()
{
    HttpClientHandler handler = new HttpClientHandler();
    handler.Credentials = new NetworkCredential("ameijers", "********");

    client = new HttpClient(handler);
}

排查方向及解决方案建议 #

1. 处理HTTPS自签名证书问题
   HoloLens设备门户使用自签名证书，.NET MAUI/Blazor默认会拒绝这类证书。测试环境可临时忽略证书校验（生产环境需导入信任证书）：

var handler = new HttpClientHandler();
handler.ServerCertificateCustomValidationCallback = (sender, cert, chain, sslPolicyErrors) => true;
var client = new HttpClient(handler);

2. 正确获取并使用CSRF Token
   HoloLens的CSRF Token不能硬编码，需先从设备门户首页获取：

• 先请求https://Hololens_IP/，从响应Cookie中提取CSRF-Token
• 将Token添加到API请求的X-CSRF-Token头，而非Cookie字段

示例代码：

var handler = new HttpClientHandler { ServerCertificateCustomValidationCallback = (s, c, ch, e) => true };
var client = new HttpClient(handler);

// 第一步：获取CSRF Token
var initResponse = await client.GetAsync("https://Hololens_IP/");
string csrfToken = "";
if (initResponse.Headers.TryGetValues("Set-Cookie", out var cookies))
{
    foreach (var cookie in cookies)
    {
        if (cookie.StartsWith("CSRF-Token="))
        {
            csrfToken = cookie.Split(';')[0].Split('=')[1];
            break;
        }
    }
}

// 第二步：发起API请求
var credentials = Convert.ToBase64String(Encoding.ASCII.GetBytes("user:1234"));
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Basic", credentials);
client.DefaultRequestHeaders.Add("X-CSRF-Token", csrfToken);

var apiResponse = await client.GetAsync("https://Hololens_IP/api/power/state");
if (apiResponse.IsSuccessStatusCode)
{
    var content = await apiResponse.Content.ReadAsStringAsync();
    Console.WriteLine(content);
}

3. 补全必要请求头
   对比Postman的请求头，确保代码包含User-Agent等可能被校验的字段：

client.DefaultRequestHeaders.UserAgent.ParseAdd("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36");

4. 捕获详细错误信息
   不要仅依赖IsSuccessStatusCode，输出响应状态码和错误内容，明确失败原因：

if (!response.IsSuccessStatusCode)
{
    var errorContent = await response.Content.ReadAsStringAsync();
    Console.WriteLine($"状态码：{response.StatusCode}，错误信息：{errorContent}");
}

内容的提问来源于stack exchange，提问作者GhostRider