Blazor中HttpClient拦截401未授权并自动重定向的实现方案

你的核心问题在于：在Blazor Server环境下，HttpClientHandler的SendAsync方法运行在后台线程，此时HTTP响应已经开始向客户端发送，直接通过IHttpContextAccessor修改响应会触发StatusCode cannot be set because the response has already started错误。以下是几种横切关注点的解决方案：

方案一：事件驱动的全局重定向处理 #

通过事件总线将未授权事件从HttpClient传递到Blazor组件，由组件触发重定向，避免直接操作HttpContext。

1. 定义授权错误事件服务 #

public interface IAuthErrorService
{
    event Action OnUnauthorized;
    void RaiseUnauthorized();
}

public class AuthErrorService : IAuthErrorService
{
    public event Action OnUnauthorized;

    public void RaiseUnauthorized() => OnUnauthorized?.Invoke();
}

2. 修改自定义HttpClientHandler #

移除直接重定向逻辑，改为发布未授权事件：

public class UnauthorizedHandler : HttpClientHandler
{
    private readonly IAuthErrorService _authErrorService;

    public UnauthorizedHandler(IAuthErrorService authErrorService)
    {
        _authErrorService = authErrorService;
    }

    protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
    {
        var response = await base.SendAsync(request, cancellationToken);
        
        if (response.StatusCode == HttpStatusCode.Unauthorized)
        {
            _authErrorService.RaiseUnauthorized();
            // 抛出异常终止后续逻辑，避免无效响应继续流转
            throw new UnauthorizedAccessException("访问令牌已过期，请重新登录");
        }

        return response;
    }
}

3. 注册服务 #

在Program.cs中添加服务注册：

builder.Services.AddScoped<IAuthErrorService, AuthErrorService>();
builder.Services.AddHttpClient<IMyApiClient, MyApiClient>(client =>
{
    client.BaseAddress = new Uri("https://your-api-base-url/");
}).AddHttpMessageHandler<UnauthorizedHandler>();
builder.Services.AddTransient<UnauthorizedHandler>();

4. 在全局布局中订阅事件 #

在MainLayout.razor中订阅事件并触发重定向：

@inject NavigationManager NavManager
@inject IAuthErrorService AuthErrorService
@implements IDisposable

<!-- 布局内容 -->

@code {
    protected override void OnInitialized()
    {
        AuthErrorService.OnUnauthorized += HandleUnauthorized;
    }

    private void HandleUnauthorized()
    {
        // 强制刷新页面，确保清除客户端认证状态
        NavManager.NavigateTo("/Identity/Logout", forceLoad: true);
    }

    public void Dispose()
    {
        AuthErrorService.OnUnauthorized -= HandleUnauthorized;
    }
}

方案二：结合NSwag生成客户端的处理 #

如果使用NSwag生成的API客户端，可在分部类中实现ProcessResponse方法，复用上述事件服务：

public partial class MyGeneratedApiClient
{
    private readonly IAuthErrorService _authErrorService;

    // 重写构造函数注入事件服务
    public MyGeneratedApiClient(HttpClient httpClient, IAuthErrorService authErrorService) : base(httpClient)
    {
        _authErrorService = authErrorService;
    }

    partial void ProcessResponse(HttpResponseMessage response)
    {
        if (response.StatusCode == HttpStatusCode.Unauthorized)
        {
            _authErrorService.RaiseUnauthorized();
            throw new UnauthorizedAccessException("令牌已过期");
        }
    }
}

关键注意事项 #

• Blazor Server vs WebAssembly：如果是WebAssembly项目，可直接在Handler中注入NavigationManager执行重定向，无需事件服务，因为WASM运行在客户端，不存在响应流已启动的问题。
• 强制刷新：使用NavigateTo时添加forceLoad: true，确保客户端完全刷新页面，清除残留的认证状态。
• 异常处理：抛出异常可终止API调用的后续逻辑，避免无效数据返回给组件。

内容的提问来源于stack exchange，提问作者Phil Sandler