C#应用调用License Manager API激活许可证遇401授权失败

问题背景 #

搭建了WordPress站点，计划通过C#应用结合LicenseManager插件的REST API实现许可证激活。API要求使用ConsumerKey和ConsumerSecret做身份认证，激活链接格式为http://www.example.com/wp-json/lmfwc/v2/licenses/activate/[许可证密钥]。

编写的C#代码采用Basic认证传递密钥，但运行时返回401 Unauthorized错误，详细提示为"Consumer key or secret is missing"。但手动在浏览器输入URL，以ConsumerKey为用户名、ConsumerSecret为密码登录时，能正常获取服务器响应，需要找到正确的密钥传递方式。

原尝试代码：

private async Task<bool> ActivateLicense()
{
    string baseUrl = "http://www.example.com/wp-json/lmfwc/v2/licenses/activate/";
    string consumerKey = "ExampleConsumerKey";
    string consumerSecret = "ExampleConsumerSecret";
    string licenseKey = "ExampleLicenceKey";

    using (var client = new HttpClient())
    {
        client.BaseAddress = new Uri(baseUrl + licenseKey);
        var authValue = new AuthenticationHeaderValue("Basic",
                                                      Convert.ToBase64String(Encoding.UTF8.GetBytes(consumerKey + ":" + consumerSecret)));
        client.DefaultRequestHeaders.Authorization = authValue;

        HttpResponseMessage response = await client.GetAsync(client.BaseAddress);
        if (response.IsSuccessStatusCode)
        {
            result = await response.Content.ReadAsStringAsync();
            Console.WriteLine(result);
            return true;
        }
        else
        {
            Console.WriteLine("Request failed with status code: " + response.StatusCode);
            Console.WriteLine(result);
            return false;
        }
    }
}

问题原因 #

问题出在HttpClient的BaseAddress与GetAsync参数的组合使用上：将完整请求URL设置为BaseAddress后，再调用GetAsync(client.BaseAddress)会触发HttpClient对URL的二次解析拼接，导致认证请求头无法被服务器正确识别，最终返回密钥缺失的错误提示。

修正后的代码 #

调整BaseAddress为站点基础URL，单独构建API请求路径，确保认证头被正确携带：

private async Task<bool> ActivateLicense()
{
    string baseSiteUrl = "http://www.example.com/";
    string apiPath = "wp-json/lmfwc/v2/licenses/activate/";
    string consumerKey = "ExampleConsumerKey";
    string consumerSecret = "ExampleConsumerSecret";
    string licenseKey = "ExampleLicenceKey";
    string result = string.Empty; // 补充声明result变量

    using (var client = new HttpClient())
    {
        client.BaseAddress = new Uri(baseSiteUrl);
        // 拼接完整的API请求路径
        string requestUrl = $"{apiPath}{licenseKey}";

        // 构建标准Basic认证头
        var authCredentials = $"{consumerKey}:{consumerSecret}";
        var authBytes = Encoding.UTF8.GetBytes(authCredentials);
        var authBase64 = Convert.ToBase64String(authBytes);
        client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Basic", authBase64);

        HttpResponseMessage response = await client.GetAsync(requestUrl);
        if (response.IsSuccessStatusCode)
        {
            result = await response.Content.ReadAsStringAsync();
            Console.WriteLine(result);
            return true;
        }
        else
        {
            result = await response.Content.ReadAsStringAsync(); // 读取错误响应详情
            Console.WriteLine("Request failed with status code: " + response.StatusCode);
            Console.WriteLine("Error details: " + result);
            return false;
        }
    }
}

额外排查点 #

• 编码验证：确保始终使用UTF-8编码转换密钥，避免编码错误导致认证字符串无效
• 特殊字符处理：如果ConsumerKey或ConsumerSecret包含冒号等特殊字符，需要先对其进行URL编码，再拼接成认证字符串
• 请求方法确认：部分LicenseManager版本的激活API要求使用POST请求而非GET，建议查看插件官方文档确认请求方法，若需POST则修改代码为PostAsync并传递对应请求体

内容的提问来源于stack exchange，提问作者Biswind