.NET Core 6.0中如何在静态助手类中获取ITokenAcquisition实例？

你完全可以优化当前的令牌获取逻辑，但不建议用静态助手类统一实例化ITokenAcquisition——因为ITokenAcquisition是和请求上下文绑定的Scoped服务，静态类的全局生命周期会导致上下文丢失、线程安全等问题，而且你当前代码里用静态方式获取HttpClient的做法本身就存在连接池耗尽的风险。

下面提供两种更合理的优化方案：

方案一：创建API服务基类封装通用逻辑 #

把HttpClient注入和令牌获取逻辑封装到基类中，让所有业务服务继承这个基类，避免重复代码：

1. 定义基类 #

using System.Net.Http.Headers;
using Microsoft.Identity.Web;

public class ApiServiceBase
{
    protected readonly HttpClient _httpClient;
    protected readonly ITokenAcquisition _tokenAcquisition;
    protected readonly string[] _apiScopes;

    public ApiServiceBase(HttpClient httpClient, ITokenAcquisition tokenAcquisition, string[] apiScopes)
    {
        _httpClient = httpClient;
        _tokenAcquisition = tokenAcquisition;
        _apiScopes = apiScopes;
    }

    // 统一添加Bearer令牌到请求头
    protected async Task AddAuthHeaderAsync(CancellationToken cancellationToken = default)
    {
        var accessToken = await _tokenAcquisition.GetAccessTokenForUserAsync(_apiScopes, cancellationToken: cancellationToken);
        _httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
    }

    // 封装通用的GET请求方法
    protected async Task<T?> GetAsync<T>(string requestUri, CancellationToken cancellationToken = default)
    {
        await AddAuthHeaderAsync(cancellationToken);
        return await _httpClient.GetFromJsonAsync<T>(requestUri, cancellationToken);
    }

    // 可根据需求扩展POST/PUT等方法
}

2. 业务服务继承基类 #

public class XYZService : ApiServiceBase, IXYZService
{
    // 注入所需依赖，传递给基类构造函数
    public XYZService(HttpClient httpClient, ITokenAcquisition tokenAcquisition)
        : base(httpClient, tokenAcquisition, new[] { "your-api-scope" })
    {
    }

    // 业务方法直接调用基类封装的通用方法
    public async Task<XYZData> GetXYZDataAsync(int id)
    {
        return await GetAsync<XYZData>($"/api/xyz/{id}");
    }
}

3. 注册服务与HttpClient #

在Program.cs中注册业务服务和HttpClient（通过HttpClientFactory管理，避免连接池问题）：

// 注册Microsoft Identity Web相关服务（确保已配置Azure AD等认证信息）
builder.Services.AddMicrosoftIdentityWebAppAuthentication(builder.Configuration)
    .EnableTokenAcquisitionToCallDownstreamApi(new[] { "your-api-scope" })
    .AddInMemoryTokenCaches();

// 注册业务服务并绑定HttpClient
builder.Services.AddHttpClient<IXYZService, XYZService>(client =>
{
    client.BaseAddress = new Uri("https://your-backend-api.com/");
});

方案二：使用HttpClient消息处理程序自动添加令牌 #

通过自定义DelegatingHandler，让HttpClient在发送请求时自动添加Bearer令牌，业务服务无需关心令牌逻辑：

1. 自定义令牌处理程序 #

using System.Net.Http.Headers;
using Microsoft.Identity.Web;

public class AuthHeaderHandler : DelegatingHandler
{
    private readonly ITokenAcquisition _tokenAcquisition;
    private readonly string[] _apiScopes;

    public AuthHeaderHandler(ITokenAcquisition tokenAcquisition, string[] apiScopes)
    {
        _tokenAcquisition = tokenAcquisition;
        _apiScopes = apiScopes;
    }

    protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
    {
        // 获取令牌并添加到请求头
        var accessToken = await _tokenAcquisition.GetAccessTokenForUserAsync(_apiScopes, cancellationToken: cancellationToken);
        request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
        
        return await base.SendAsync(request, cancellationToken);
    }
}

2. 注册处理程序与业务服务 #

在Program.cs中注册处理程序，并绑定到HttpClient：

// 注册令牌处理程序
builder.Services.AddTransient<AuthHeaderHandler>(sp =>
{
    var tokenAcquisition = sp.GetRequiredService<ITokenAcquisition>();
    return new AuthHeaderHandler(tokenAcquisition, new[] { "your-api-scope" });
});

// 注册业务服务并添加令牌处理程序
builder.Services.AddHttpClient<IXYZService, XYZService>(client =>
{
    client.BaseAddress = new Uri("https://your-backend-api.com/");
})
.AddHttpMessageHandler<AuthHeaderHandler>();

3. 简化业务服务代码 #

此时业务服务只需注入HttpClient，无需处理令牌：

public class XYZService : IXYZService
{
    private readonly HttpClient _httpClient;

    public XYZService(HttpClient httpClient)
    {
        _httpClient = httpClient;
    }

    public async Task<XYZData> GetXYZDataAsync(int id)
    {
        return await _httpClient.GetFromJsonAsync<XYZData>($"/api/xyz/{id}");
    }
}

为什么不推荐静态助手类？ #

1. 生命周期冲突：ITokenAcquisition是Scoped服务，和请求上下文绑定；静态类是全局单例，会持有实例导致后续请求复用错误的上下文。
2. 线程安全问题：静态类的成员是全局共享的，多请求并发时会出现令牌覆盖、上下文混乱的问题。
3. HttpClient管理问题：静态创建HttpClient会导致连接池无法正确回收，最终引发连接耗尽的异常，正确的做法是通过HttpClientFactory管理HttpClient生命周期。

内容的提问来源于stack exchange，提问作者Shant Hagopian