.NET Core HttpClient调用内部API网关耗时15秒问题求助

问题描述 #

• 同集群内直接调用外部API响应正常，但通过内部API网关调用时，代码发起请求15秒后网关才收到请求
• Docker终端直接调用网关API无延迟
• 网关日志确认延迟发生在代码到网关的请求发送阶段

相关代码 #

HttpClientHandler clientHandlerCustPortfolioSecurityHoldings = new() {
  UseProxy = false,
    ServerCertificateCustomValidationCallback = (sender, cert, chain, sslPolicyErrors) => {
      return true;
    }
};
using(var httpClient = new HttpClient(clientHandlerCustPortfolioSecurityHoldings)) {
  httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", "Bearer token");
  httpClient.DefaultRequestHeaders.Add("ClientId", "test data");
  httpClient.DefaultRequestHeaders.Add("X-USER-ID", "test data");
  httpClient.DefaultRequestHeaders.Add("X-ORG-ID", "test data");
  httpClient.DefaultRequestHeaders.Add("X-MSG-ID", "test data");
  httpClient.Timeout = TimeSpan.FromSeconds(int.Parse(_config["EXT_API_TIMEOUT_IN_SECONDS"]));
  StringContent InputContent = new(JsonSerializer.Serialize(reqparams), Encoding.UTF8, "application/json");
  using(var response = await httpClient.PostAsync("https internal gateway URL", InputContent)) {
    if (response.IsSuccessStatusCode) {
      var result = await response.Content.ReadAsStringAsync();
      APICustomResponse apiCustomResponse = new() {
        StatusCode = true,
          ErrorMessage = "Success",
          ResponseData = result
      };
      return await Task.FromResult(apiCustomResponse);
    } else {
      var result = await response.Content.ReadAsStringAsync();
      APICustomResponse apiCustomResponse = new() {
        StatusCode = false,
          ErrorMessage = "Failed",
          ResponseData = result
      };
      return await Task.FromResult(apiCustomResponse);
    }
  }
}

排查与解决步骤 #

1. 修正Authorization头的明显错误

代码中AuthenticationHeaderValue的token值多了冗余的Bearer 前缀，这可能导致网关侧的认证逻辑异常，先修正：

// 正确格式：第二个参数仅传入token字符串
httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", "your-actual-token");

2. 排查DNS解析延迟

固定15秒是DNS超时重试的典型特征，即使禁用了代理，仍可能出现域名解析问题：

• 直接用网关IP替换域名测试，验证是否是DNS导致的延迟
• 检查容器内/etc/resolv.conf配置，确保使用集群内部可靠的DNS服务器
• 在HttpClientHandler中添加DNS缓存配置，减少解析次数：

  clientHandlerCustPortfolioSecurityHoldings.DnsRefreshTimeout = TimeSpan.FromMinutes(5);
  

3. 改用HttpClient单例复用

每次请求创建新HttpClient会导致TCP连接频繁建立/销毁，尤其是TLS握手阶段可能产生延迟，改用单例模式（.NET Core官方推荐）：

// 在Program.cs/Startup.cs中注册单例HttpClient
services.AddSingleton<HttpClient>(sp => {
    var config = sp.GetRequiredService<IConfiguration>();
    var handler = new HttpClientHandler {
        UseProxy = false,
        ServerCertificateCustomValidationCallback = (sender, cert, chain, sslPolicyErrors) => true,
        SslProtocols = SslProtocols.Tls12 | SslProtocols.Tls13 // 明确指定TLS版本，避免协商耗时
    };
    var client = new HttpClient(handler);
    // 预设置通用请求头
    client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", "your-actual-token");
    client.DefaultRequestHeaders.Add("ClientId", "test data");
    client.DefaultRequestHeaders.Add("X-USER-ID", "test data");
    client.DefaultRequestHeaders.Add("X-ORG-ID", "test data");
    client.DefaultRequestHeaders.Add("X-MSG-ID", "test data");
    client.Timeout = TimeSpan.FromSeconds(int.Parse(config["EXT_API_TIMEOUT_IN_SECONDS"]));
    return client;
});

之后在业务类中注入HttpClient使用，不再每次创建新实例。

4. 检查容器网络策略

集群网络策略可能限制了项目容器到网关的流量：

• 查看集群网络规则（如Kubernetes NetworkPolicy），确保项目容器所在命名空间允许访问网关端口
• 在项目容器内执行curl调用网关API，对比代码的请求耗时，确认是否是代码层面的问题

5. 排查TLS握手延迟

指定明确的TLS版本，避免协商过程中的超时重试：

clientHandlerCustPortfolioSecurityHoldings.SslProtocols = SslProtocols.Tls12 | SslProtocols.Tls13;

如果网关要求客户端证书，需在HttpClientHandler中添加证书配置：

handler.ClientCertificates.Add(new X509Certificate2("path-to-client-cert.pfx", "cert-password"));

内容的提问来源于stack exchange，提问作者Matthew George