.NET Core中API集成IdentityServer4的[Authorize]授权401问题

1. 确认Web应用OAuth2配置是否正确存储Token #

确保Web应用的OpenID Connect配置启用SaveTokens，将IdentityServer返回的Token存入Cookie：

services.AddAuthentication(options =>
{
    options.DefaultScheme = "Cookies";
    options.DefaultChallengeScheme = "oidc";
})
.AddCookie("Cookies")
.AddOpenIdConnect("oidc", options =>
{
    options.Authority = "https://your-identityserver-url";
    options.ClientId = "your-web-client-id";
    options.ClientSecret = "your-web-client-secret";
    options.ResponseType = "code";
    options.SaveTokens = true; // 核心配置：保存Token到Cookie
    options.Scope.Add("your-api-required-scope"); // 必须包含API所需的Scope
});

2. 配置HttpClient自动附加AccessToken #

使用内置的BearerTokenHandler让HttpClient自动从当前用户上下文获取Token并添加到请求头：

services.AddHttpClient("ApiClient", client =>
{
    client.BaseAddress = new Uri("https://your-api-base-url");
})
.AddHttpMessageHandler<BearerTokenHandler>();

如果需要手动处理，可直接从HttpContext提取Token：

private readonly IHttpClientFactory _httpClientFactory;
private readonly IHttpContextAccessor _httpContextAccessor;

public YourService(IHttpClientFactory httpClientFactory, IHttpContextAccessor httpContextAccessor)
{
    _httpClientFactory = httpClientFactory;
    _httpContextAccessor = httpContextAccessor;
}

public async Task CallAuthorizedApi()
{
    var client = _httpClientFactory.CreateClient("ApiClient");
    var accessToken = await _httpContextAccessor.HttpContext.GetTokenAsync("access_token");
    client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
    
    var response = await client.GetAsync("/api/your-protected-endpoint");
    // 处理响应逻辑
}

3. 验证Token的Scope与受众匹配性 #

• 检查IdentityServer中Web客户端的AllowedScopes是否包含API对应的Scope
• 确认API的JWT验证配置中，受众(Audience)与IdentityServer定义的API资源一致：

services.AddAuthentication("Bearer")
.AddJwtBearer("Bearer", options =>
{
    options.Authority = "https://your-identityserver-url";
    options.TokenValidationParameters = new TokenValidationParameters
    {
        ValidateAudience = true,
        ValidAudience = "your-api-audience" // 需和IdentityServer中API资源的Audience完全匹配
    };
});

4. 排查Cookie存储与Token有效性 #

• 检查Web应用Cookie配置，确保没有过严的SameSite策略或过短的过期时间导致Token丢失
• 在Web控制器中通过await HttpContext.GetTokenAsync("access_token")手动获取Token，验证是否能拿到有效值

5. 检查请求头的Token传递情况 #

用浏览器开发者工具（F12）查看Web应用调用API的请求，确认Authorization: Bearer {token}请求头是否存在，且Token值与Postman中使用的一致

内容的提问来源于stack exchange，提问作者Vlad Vorobyev