如何在C# ASP.NET项目中为Azure Key Vault请求配置代理？

你的思路是对的，通过自定义HttpClientTransport替换SecretClient的默认传输层，就能让密钥请求走指定代理。下面是完善后的落地实现，同时解决认证请求代理、资源复用等关键问题：

一、完整可运行代码 #

using System;
using System.Configuration;
using System.Net;
using System.Net.Http;
using System.Threading.Tasks;
using Azure.Core.Pipeline;
using Azure.Identity;
using Azure.Security.KeyVault.Secrets;

namespace Helpers
{
    public class KeyVaultHelper
    {
        // 静态复用SecretClient和HttpClient，避免频繁创建连接导致资源浪费
        private static SecretClient _secretClient;

        static KeyVaultHelper()
        {
            InitializeSecretClient();
        }

        private static void InitializeSecretClient()
        {
            string keyVaultUrl = ConfigurationManager.AppSettings["url"];
            string proxyAddress = ConfigurationManager.AppSettings["ProxyAddress"] ?? "http://myproxy.bankfab.com:8080";
            
            var appId = ConfigurationManager.AppSettings["APP_ID"];
            var appKey = ConfigurationManager.AppSettings["APP_KEY"];
            var tenantId = ConfigurationManager.AppSettings["TENANT_ID"];

            // 1. 配置代理（支持认证）
            var proxy = new WebProxy(new Uri(proxyAddress))
            {
                // 若代理需要用户名密码，取消注释并填写
                // Credentials = new NetworkCredential("proxy_username", "proxy_password")
            };

            var httpClientHandler = new HttpClientHandler
            {
                Proxy = proxy,
                UseProxy = true,
                // 仅测试环境可临时禁用SSL验证，生产环境必须删除此行
                // ServerCertificateCustomValidationCallback = (_, __, ___, ____) => true
            };

            // 2. 创建带代理的HttpClient，全局复用
            var proxyHttpClient = new HttpClient(httpClientHandler);
            
            // 3. 为SecretClient配置代理传输
            var secretClientOptions = new SecretClientOptions
            {
                Transport = new HttpClientTransport(proxyHttpClient)
            };

            // 4. 关键：认证请求也要走代理，给ClientSecretCredential配置相同传输层
            var credentialOptions = new ClientSecretCredentialOptions
            {
                Transport = new HttpClientTransport(proxyHttpClient)
            };

            var credential = new ClientSecretCredential(tenantId, appId, appKey, credentialOptions);

            _secretClient = new SecretClient(new Uri(keyVaultUrl), credential, secretClientOptions);
        }

        public static Settings Get()
        {
            try
            {
                // 并行执行多个异步请求，比逐个阻塞更高效
                var publicKeyTask = _secretClient.GetSecretAsync(ConfigurationManager.AppSettings["secret1"]);
                var secretKeyTask = _secretClient.GetSecretAsync(ConfigurationManager.AppSettings["secret2"]);
                var clientIdTask = _secretClient.GetSecretAsync(ConfigurationManager.AppSettings["secret3"]);
                var clientSecretTask = _secretClient.GetSecretAsync(ConfigurationManager.AppSettings["secret4"]);

                Task.WaitAll(publicKeyTask, secretKeyTask, clientIdTask, clientSecretTask);

                return new Settings 
                {
                    Secret1 = publicKeyTask.Result.Value.Value,
                    Secret2 = secretKeyTask.Result.Value.Value,
                    Secret3 = clientIdTask.Result.Value.Value,
                    Secret4 = clientSecretTask.Result.Value.Value
                };
            }
            catch (Exception ex)
            {
                // 建议添加日志记录后再抛出，便于排查问题
                throw;
            }
        }
    }

    public class Settings
    {
        public string Secret1 { get; set; }
        public string Secret2 { get; set; }
        public string Secret3 { get; set; }
        public string Secret4 { get; set; }
    }
}

二、核心注意事项 #

• 认证请求也要走代理：ClientSecretCredential获取Azure AD令牌时会发起HTTP请求，必须给它也配置相同的代理传输层，否则认证环节会绕过代理失败。
• 复用HttpClient：不要每次请求都创建新HttpClient，否则会导致套接字耗尽，建议静态初始化后全局复用。
• 异步请求优化：避免用GetAwaiter().GetResult()同步阻塞，改用Task.WaitAll并行执行多个密钥请求，提升获取效率。
• 代理认证配置：如果代理需要身份验证，直接在WebProxy的Credentials属性中设置即可。

三、全局代理替代方案 #

如果希望应用所有HTTP请求都走代理，可直接在App.config/Web.config中添加配置，Azure SDK会自动读取使用：

<system.net>
  <defaultProxy enabled="true" useDefaultCredentials="false">
    <proxy proxyaddress="http://myproxy.bankfab.com:8080" bypassonlocal="true" />
    <!-- 代理需要认证时添加 -->
    <credentials username="proxy_user" password="proxy_pass" />
  </defaultProxy>
</system.net>

这种方式无需修改代码，但仅能全局生效，无法单独为Key Vault请求配置专属代理。

内容的提问来源于stack exchange，提问作者Thiago Brandão