.NET Core Blazor Server中为HttpClient配置OAuth2 Bearer令牌的最优方案

核心思路：用DelegatingHandler分离令牌逻辑 #

不要把令牌获取逻辑硬编码到业务客户端（MyClient）或Program.cs中，最佳方式是通过**自定义DelegatingHandler**统一处理请求的令牌注入，同时配合独立的令牌服务管理令牌的获取、缓存与刷新，实现关注点分离。

1. 定义令牌服务（负责获取与缓存令牌） #

创建令牌服务接口和实现，封装OAuth2客户端凭证模式的令牌请求逻辑，同时缓存令牌避免重复请求：

public interface ITokenService
{
    Task<string> GetAccessTokenAsync();
}

public class TokenService : ITokenService
{
    private readonly HttpClient _httpClient;
    private readonly IConfiguration _configuration;
    private string? _cachedToken;
    private DateTime _tokenExpiry;

    public TokenService(HttpClient httpClient, IConfiguration configuration)
    {
        _httpClient = httpClient;
        _configuration = configuration;
    }

    public async Task<string> GetAccessTokenAsync()
    {
        // 检查缓存令牌是否有效
        if (!string.IsNullOrEmpty(_cachedToken) && DateTime.UtcNow < _tokenExpiry)
        {
            return _cachedToken;
        }

        // 从配置读取OAuth2参数
        var clientId = _configuration["OAuth2:ClientId"];
        var clientSecret = _configuration["OAuth2:ClientSecret"];
        var tokenEndpoint = _configuration["OAuth2:TokenEndpoint"];

        // 生成base64编码的客户端凭证
        var credentials = Convert.ToBase64String(Encoding.UTF8.GetBytes($"{clientId}:{clientSecret}"));

        // 构造令牌请求参数
        var requestContent = new FormUrlEncodedContent(new[]
        {
            new KeyValuePair<string, string>("grant_type", "client_credentials"),
            // 如有API权限范围需求，添加此行
            // new KeyValuePair<string, string>("scope", "your-target-api-scope")
        });

        // 设置请求头的Basic认证
        _httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Basic", credentials);

        // 发送令牌请求
        var response = await _httpClient.PostAsync(tokenEndpoint, requestContent);
        response.EnsureSuccessStatusCode();

        var tokenResponse = await response.Content.ReadFromJsonAsync<TokenResponse>();
        if (tokenResponse == null || string.IsNullOrEmpty(tokenResponse.AccessToken))
        {
            throw new InvalidOperationException("Failed to retrieve access token");
        }

        // 更新缓存和过期时间（提前60秒刷新，避免令牌过期）
        _cachedToken = tokenResponse.AccessToken;
        _tokenExpiry = DateTime.UtcNow.AddSeconds(tokenResponse.ExpiresIn - 60);

        return _cachedToken;
    }

    // 令牌响应模型
    private class TokenResponse
    {
        [JsonPropertyName("access_token")]
        public string AccessToken { get; set; } = string.Empty;

        [JsonPropertyName("expires_in")]
        public int ExpiresIn { get; set; }
    }
}

2. 创建自定义DelegatingHandler #

这个Handler会拦截所有HttpClient的请求，自动添加Bearer令牌：

public class OAuth2TokenHandler : DelegatingHandler
{
    private readonly ITokenService _tokenService;

    public OAuth2TokenHandler(ITokenService tokenService)
    {
        _tokenService = tokenService;
    }

    protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
    {
        var accessToken = await _tokenService.GetAccessTokenAsync();
        request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);

        return await base.SendAsync(request, cancellationToken);
    }
}

3. 在Program.cs中注册服务 #

把令牌服务、自定义Handler和业务客户端注册到DI容器：

// 注册令牌服务专用的HttpClient
builder.Services.AddHttpClient<ITokenService, TokenService>();

// 注册自定义令牌Handler（用AddTransient避免复用问题）
builder.Services.AddTransient<OAuth2TokenHandler>();

// 注册业务客户端，并注入令牌Handler
builder.Services.AddHttpClient<IMyClient, MyClient>(client =>
{
    client.BaseAddress = new Uri("https://my-api/");
})
.AddHttpMessageHandler<OAuth2TokenHandler>();

4. 业务客户端保持简洁 #

MyClient不需要关心令牌逻辑，专注于业务请求即可：

public interface IMyClient
{
    Task<List<Project>?> GetProjectsAsync();
}

public class MyClient : IMyClient
{
    private readonly HttpClient _httpClient;

    public MyClient(HttpClient httpClient)
    {
        _httpClient = httpClient;
    }

    public async Task<List<Project>?> GetProjectsAsync()
    {
        var response = await _httpClient.GetAsync("Projects");
        response.EnsureSuccessStatusCode();
        return await response.Content.ReadFromJsonAsync<List<Project>>();
    }
}

// 项目模型示例
public class Project
{
    public int Id { get; set; }
    public string Name { get; set; } = string.Empty;
    // 其他业务属性
}

方案优势 #

• 关注点分离：令牌逻辑与业务请求逻辑完全解耦，代码职责清晰。
• 可复用性：多个业务客户端需要令牌认证时，只需添加同一个OAuth2TokenHandler。
• 易于扩展：后续可轻松添加令牌自动刷新、请求重试、日志记录等逻辑到Handler或TokenService中。
• 符合.NET官方最佳实践：DelegatingHandler是.NET中处理HttpClient请求拦截的标准方案，适合这类横切关注点场景。

内容的提问来源于stack exchange，提问作者Blake Rivell