如何为每个HttpClient请求配置不同的摘要认证凭据？

你不需要为每个设备的凭据单独创建HttpClient实例，有两种更高效的方式实现「每请求」的凭据配置：

方式1：自定义DelegatingHandler处理动态凭据 #

通过自定义DelegatingHandler，可以在每个请求发送时动态指定凭据，同时复用核心的HttpClient实例。这种方式利用HttpClient内置的摘要认证逻辑，无需手动处理认证参数计算。

步骤1：实现自定义DelegatingHandler #

public class PerRequestDigestAuthHandler : DelegatingHandler
{
    // 用于在请求中传递凭据的Key
    public const string CredentialPropertyKey = "RequestNetworkCredential";

    protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
    {
        // 检查请求是否携带了凭据
        if (request.Properties.TryGetValue(CredentialPropertyKey, out var credentialObj) 
            && credentialObj is NetworkCredential credential)
        {
            // 为当前请求创建临时HttpClientHandler，设置专属凭据
            using var dedicatedHandler = new HttpClientHandler { Credentials = credential };
            using var tempClient = new HttpClient(dedicatedHandler);
            
            // 克隆原始请求，避免修改共享实例的请求内容
            var clonedRequest = await CloneHttpRequest(request);
            return await tempClient.SendAsync(clonedRequest, cancellationToken);
        }

        // 无凭据时直接转发请求
        return await base.SendAsync(request, cancellationToken);
    }

    // 辅助方法：克隆HttpRequestMessage（处理内容和头的复制）
    private async Task<HttpRequestMessage> CloneHttpRequest(HttpRequestMessage original)
    {
        var clone = new HttpRequestMessage(original.Method, original.RequestUri);

        // 复制请求头
        foreach (var header in original.Headers)
        {
            clone.Headers.TryAddWithoutValidation(header.Key, header.Value);
        }

        // 复制请求内容（如果有）
        if (original.Content != null)
        {
            var contentStream = new MemoryStream();
            await original.Content.CopyToAsync(contentStream);
            contentStream.Position = 0;
            clone.Content = new StreamContent(contentStream);

            foreach (var contentHeader in original.Content.Headers)
            {
                clone.Content.Headers.TryAddWithoutValidation(contentHeader.Key, contentHeader.Value);
            }
        }

        // 复制请求属性
        foreach (var prop in original.Properties)
        {
            clone.Properties.Add(prop);
        }

        return clone;
    }
}

步骤2：初始化共享的HttpClient #

// 创建全局共享的HttpClient实例，使用自定义Handler
var sharedHttpClient = new HttpClient(new PerRequestDigestAuthHandler());

步骤3：发送带凭据的请求 #

// 创建请求
var request = new HttpRequestMessage(HttpMethod.Get, "http://your-device-ip/api/face-recognition");

// 为当前请求添加专属凭据
request.Properties.Add(PerRequestDigestAuthHandler.CredentialPropertyKey, 
    new NetworkCredential("device-username", "device-password"));

// 发送请求
var response = await sharedHttpClient.SendAsync(request);
response.EnsureSuccessStatusCode();

方式2：手动构造摘要认证头 #

如果想完全复用同一个HttpClient且避免临时创建Handler的开销，可以手动处理摘要认证的逻辑：先发送无认证请求获取服务器的认证参数，计算出合法的Authorization头后重新发送请求。

实现代码 #

public static async Task<HttpResponseMessage> SendWithDigestAuthAsync(
    HttpClient client, 
    HttpRequestMessage request, 
    NetworkCredential credential)
{
    // 1. 先发送无认证请求，获取服务器的认证挑战
    var initialResponse = await client.SendAsync(request, CancellationToken.None);
    if (!initialResponse.IsSuccessStatusCode 
        && initialResponse.StatusCode == HttpStatusCode.Unauthorized
        && initialResponse.Headers.WwwAuthenticate.Any(h => h.Scheme.Equals("Digest", StringComparison.OrdinalIgnoreCase)))
    {
        // 2. 解析WWW-Authenticate头中的参数（realm、nonce、qop等）
        var digestChallenge = initialResponse.Headers.WwwAuthenticate
            .First(h => h.Scheme.Equals("Digest", StringComparison.OrdinalIgnoreCase));
        var authParams = ParseDigestChallengeParameters(digestChallenge.Parameter);

        // 3. 计算摘要认证所需的哈希值
        var ha1 = ComputeMd5Hash($"{credential.UserName}:{authParams["realm"]}:{credential.Password}");
        var ha2 = ComputeMd5Hash($"{request.Method.Method}:{request.RequestUri.PathAndQuery}");
        var cnonce = GenerateCnonce();
        var nc = "00000001"; // 请求计数，首次请求用1

        var responseHash = ComputeMd5Hash($"{ha1}:{authParams["nonce"]}:{nc}:{cnonce}:{authParams["qop"]}:{ha2}");

        // 4. 构造Authorization头
        var authHeaderValue = $"Digest username=\"{credential.UserName}\", realm=\"{authParams["realm"]}\", " +
                              $"nonce=\"{authParams["nonce"]}\", uri=\"{request.RequestUri.PathAndQuery}\", " +
                              $"qop={authParams["qop"]}, nc={nc}, cnonce=\"{cnonce}\", response=\"{responseHash}\"";

        // 5. 克隆请求并添加认证头，重新发送
        var authenticatedRequest = await CloneHttpRequest(request);
        authenticatedRequest.Headers.Authorization = new AuthenticationHeaderValue("Digest", authHeaderValue);
        
        initialResponse = await client.SendAsync(authenticatedRequest, CancellationToken.None);
    }

    return initialResponse;
}

// 辅助方法：解析摘要认证挑战参数
private static Dictionary<string, string> ParseDigestChallengeParameters(string parameterString)
{
    return parameterString.Split(',')
        .Select(pair => pair.Trim().Split(new[] { '=' }, 2))
        .ToDictionary(kv => kv[0], kv => kv[1].Trim('"'));
}

// 辅助方法：生成客户端随机数
private static string GenerateCnonce()
{
    return Convert.ToBase64String(Guid.NewGuid().ToByteArray()).Substring(0, 16);
}

// 辅助方法：计算MD5哈希
private static string ComputeMd5Hash(string input)
{
    using var md5 = MD5.Create();
    var hashBytes = md5.ComputeHash(Encoding.UTF8.GetBytes(input));
    return BitConverter.ToString(hashBytes).Replace("-", "").ToLowerInvariant();
}

// 辅助方法：克隆HttpRequestMessage
private static async Task<HttpRequestMessage> CloneHttpRequest(HttpRequestMessage original)
{
    var clone = new HttpRequestMessage(original.Method, original.RequestUri);

    foreach (var header in original.Headers)
    {
        clone.Headers.TryAddWithoutValidation(header.Key, header.Value);
    }

    if (original.Content != null)
    {
        var contentStream = new MemoryStream();
        await original.Content.CopyToAsync(contentStream);
        contentStream.Position = 0;
        clone.Content = new StreamContent(contentStream);

        foreach (var contentHeader in original.Content.Headers)
        {
            clone.Content.Headers.TryAddWithoutValidation(contentHeader.Key, contentHeader.Value);
        }
    }

    return clone;
}

使用方式 #

// 使用全局共享的HttpClient
var sharedHttpClient = new HttpClient();

var request = new HttpRequestMessage(HttpMethod.Post, "http://your-device-ip/api/face-detect");
// 设置请求内容（如果需要）
request.Content = new StringContent("{...}", Encoding.UTF8, "application/json");

// 发送带摘要认证的请求
var response = await SendWithDigestAuthAsync(sharedHttpClient, request, 
    new NetworkCredential("device-user", "device-pass"));
response.EnsureSuccessStatusCode();

方案对比 #

内容的提问来源于stack exchange，提问作者Loudenvier