ASP.NET Core WebAPI Controller中HttpClient调用外部API返回401未授权错误

问题根因 #

• 认证方式错误：frost.met.no 官方使用Basic认证，而非你尝试的Bearer认证。你给出的示例URL格式https://密钥@域名/路径是Basic认证的浏览器隐式传参写法，要求请求头格式为Authorization: Basic {Base64编码的<客户端ID:空密码>}
• 冗余配置冲突：你同时注入了IHttpClientFactory又定义了静态HttpClient，实际请求用的是静态实例，工厂创建的客户端完全没有用到，静态实例的默认请求头会存在并发污染风险
• 认证参数拼接错误：你直接把密钥作为Bearer令牌传参，没有做Basic认证要求的用户名:密码Base64编码处理

修正后代码 #

[Route("api/[controller]")]
[ApiController]
public class FrostMetAPIController : ControllerBase
{
    private readonly ILogger<FrostMetAPIController> _logger;
    private readonly IHttpClientFactory _httpClientFactory;

    public FrostMetAPIController(ILogger<FrostMetAPIController> logger, IHttpClientFactory httpClientFactory)
    {
        _logger = logger;
        _httpClientFactory = httpClientFactory;
    }

    [HttpGet("values")]
    public async Task<string> GetRates()
    {
        // 你的Frost API客户端ID，替换为实际值
        var clientId = "XXX-xxx-XXX-xxx";
        // Basic认证要求格式：用户名:密码 转Base64，Frost API密码为空，所以拼接为<clientId>:
        var authCredential = Convert.ToBase64String(System.Text.Encoding.ASCII.GetBytes($"{clientId}:"));
        
        var url = "sources=SN68290:0";
        url += "&referencetime=2019-01-01T12:00:00.000Z/2020-06-30T23:59:59Z";
        url += "&elements=wind_speed,%20max(wind_speed%20PT1H)";
        url += "&timeoffsets=PT0H";
        url += "&timeresolutions=PT1H";
        url += "&timeseriesids=0";
        url += "&performancecategories=C";
        url += "&exposurecategories=2&levels=10.0";

        using var httpClient = _httpClientFactory.CreateClient();
        httpClient.BaseAddress = new Uri("https://frost.met.no/observations/");
        httpClient.DefaultRequestHeaders.Accept.Add(new System.Net.Http.Headers.MediaTypeWithQualityHeaderValue("application/json"));
        // 注意这里是Basic不是Bearer
        httpClient.DefaultRequestHeaders.TryAddWithoutValidation("Authorization", $"Basic {authCredential}");

        var response = await httpClient.GetAsync("v0.jsonld?" + url);
        response.EnsureSuccessStatusCode();
        return await response.Content.ReadAsStringAsync();
    }
}

额外说明 #

• 不要混用静态HttpClient和IHttpClientFactory，推荐统一使用IHttpClientFactory管理客户端生命周期，避免端口耗尽和请求头污染问题
• Frost API的所有密钥不要硬编码在代码里，建议放到配置文件中通过IOption读取

内容的提问来源于stack exchange，提问作者user2140740