创建GraphServiceClient时，如何为AuthorizationCodeCredential传递code_verifier？

AADSTS50148错误的核心原因是：PKCE授权流程要求，用授权码兑换token时必须提供与授权请求中code_challenge对应的code_verifier，你当前的AuthorizationCodeCredential实例未传入该值，导致验证失败。

修改GraphServiceClient的注册代码，从Cookie中取出存储的code_verifier并传递给AuthorizationCodeCredentialOptions即可解决问题：

builder.Services.AddScoped<GraphServiceClient>(provider =>
{
    var clientId = builder.Configuration["AzureAD:ClientId"];
    var tenantId = builder.Configuration["AzureAD:TenantId"];
    var clientSecret = builder.Configuration["AzureAD:ClientSecret"];
    var context = provider.GetRequiredService<IHttpContextAccessor>();
    var request = context.HttpContext.Request;
    var scheme = request.Scheme;
    var host = request.Host.Host;
    var port = request.Host.Port;

    var baseUrl = $"{scheme}://{host}";

    if (port != null)
    {
        baseUrl += $":{port}";
    }
    baseUrl += builder.Configuration["AzureAD:CallbackPath"];
    
    // 从Cookie读取之前存储的code_verifier
    request.Cookies.TryGetValue("code_verifier", out string codeVerifier);
    
    var credOptions = new AuthorizationCodeCredentialOptions()
    {
        AuthorityHost = AzureAuthorityHosts.AzurePublicCloud,
        RedirectUri = new Uri(baseUrl),
        // 将code_verifier传入选项
        CodeVerifier = codeVerifier
    };
    
    AuthorizationCodeCredential cred = new AuthorizationCodeCredential(tenantId, clientId, clientSecret, request.Cookies["auth_code"], credOptions);
    
    return new GraphServiceClient(cred, initialScopes, "https://graph.microsoft.com");
});

额外注意事项 #

• 确认OnAuthorizationCodeReceived事件中存储的code_verifier值正确，可通过调试查看context.TokenEndpointRequest.Parameters["code_verifier"]是否不为空
• PKCE的code_verifier和授权码一样只能使用一次，兑换token后即失效，后续刷新token无需再次传递

内容的提问来源于stack exchange，提问作者LeeAdama