.NET Core 3.1 SOAP客户端Basic Auth认证头未生效问题

你无法抓到预期的Authorization请求头，核心原因有两点：

• 你没有显式配置绑定的安全模式，虽然BasicHttpsBinding默认安全模式为Transport，但在.NET Core 3.1的WCF客户端实现中，未显式声明安全模式时，部分场景下不会正确加载你设置的客户端凭证配置。
• 最关键的逻辑差异：WCF内置的Basic传输认证默认遵循HTTP标准的挑战-应答机制，首次发起请求时不会主动携带Authorization头，只有收到服务端返回的401 Unauthorized响应、且响应携带WWW-Authenticate: Basic挑战头时，才会在第二次重试请求中附上配置的用户名密码。你用hookbin做抓包端点时，hookbin收到任意请求都会直接返回200响应，永远不会触发401挑战，自然抓不到带认证头的请求。

你之前尝试更换WSHttpBinding仍不生效也是同理，所有WCF内置绑定的Basic传输认证都默认遵循该挑战-应答逻辑，和绑定类型无关。

根据你对接的服务实际情况，二选一即可：

方案1：对接遵循标准HTTP Basic认证规范的服务 #

只需要补全安全模式的显式配置即可，不需要额外修改逻辑，真实服务返回401挑战后客户端会自动携带凭证重试：

BasicHttpsBinding binding= new BasicHttpsBinding();
// HTTPS场景使用传输安全模式
binding.Security.Mode = BasicHttpSecurityMode.Transport;
// 非加密HTTP场景替换为下面这行配置
// binding.Security.Mode = BasicHttpSecurityMode.TransportCredentialOnly;
binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.Basic;

EndpointAddress endpoint = new EndpointAddress("https://your-actual-service-address");
var soapClient = new RandomServiceClient(binding, endpoint);
soapClient.ClientCredentials.UserName.UserName = "user";
soapClient.ClientCredentials.UserName.Password = "bla";

soapClient.CallServiceMethod(new Request { Foo = "Bar" });

注意：该方案下用hookbin抓首次请求看不到Authorization头是正常现象，不代表配置错误。

方案2：强制首次请求携带Authorization头（适配不返回401挑战的非标准服务，或需要直接在hookbin中抓到认证头） #

通过自定义客户端消息检查器手动注入认证头，绕开默认的挑战-应答逻辑：

1. 实现自定义消息检查器，在请求发送前注入头：

using System;
using System.ServiceModel;
using System.ServiceModel.Channels;
using System.ServiceModel.Dispatcher;
using System.Text;
using System.Net;

public class BasicAuthHeaderInjector : IClientMessageInspector
{
    private readonly string _authValue;

    public BasicAuthHeaderInjector(string username, string password)
    {
        var rawCredential = Convert.ToBase64String(Encoding.ASCII.GetBytes($"{username}:{password}"));
        _authValue = $"Basic {rawCredential}";
    }

    public object BeforeSendRequest(ref Message request, IClientChannel channel)
    {
        if (request.Properties.TryGetValue(HttpRequestMessageProperty.Name, out object propObj))
        {
            var prop = (HttpRequestMessageProperty)propObj;
            prop.Headers[HttpRequestHeader.Authorization] = _authValue;
        }
        else
        {
            var prop = new HttpRequestMessageProperty();
            prop.Headers.Add(HttpRequestHeader.Authorization, _authValue);
            request.Properties.Add(HttpRequestMessageProperty.Name, prop);
        }
        return null;
    }

    public void AfterReceiveReply(ref Message reply, object correlationState)
    {
        // 无需处理响应逻辑
    }
}

2. 实现对应端点行为，将检查器挂载到客户端：

using System.ServiceModel.Channels;
using System.ServiceModel.Description;
using System.ServiceModel.Dispatcher;

public class BasicAuthEndpointBehavior : IEndpointBehavior
{
    private readonly string _username;
    private readonly string _password;

    public BasicAuthEndpointBehavior(string username, string password)
    {
        _username = username;
        _password = password;
    }

    public void AddBindingParameters(ServiceEndpoint endpoint, BindingParameterCollection bindingParameters) { }
    public void ApplyClientBehavior(ServiceEndpoint endpoint, ClientRuntime clientRuntime)
    {
        clientRuntime.ClientMessageInspectors.Add(new BasicAuthHeaderInjector(_username, _password));
    }
    public void ApplyDispatchBehavior(ServiceEndpoint endpoint, EndpointDispatcher endpointDispatcher) { }
    public void Validate(ServiceEndpoint endpoint) { }
}

3. 客户端调用时挂载自定义行为即可，注意要将内置客户端凭证类型设为None，避免逻辑冲突：

BasicHttpsBinding binding= new BasicHttpsBinding();
binding.Security.Mode = BasicHttpSecurityMode.Transport;
// 关闭内置的Basic认证逻辑，避免冲突
binding.Security.Transport.ClientCredentialType = HttpClientCredentialType.None;
EndpointAddress endpoint = new EndpointAddress("https://hookb.in/...");

var soapClient = new RandomServiceClient(binding, endpoint);
// 挂载自定义认证行为
soapClient.Endpoint.EndpointBehaviors.Add(new BasicAuthEndpointBehavior("user", "bla"));
// 首次请求就会携带Authorization头
soapClient.CallServiceMethod(new Request { Foo = "Bar" });

内容的提问来源于stack exchange，提问作者Stutje