C#使用HttpClient调用POST API携带Bearer token报认证错误如何解决

问题排查与修复方案 #

1. 修复代码显性语法错误 #

你的代码存在两处语法问题，会直接导致请求头未按预期生成：

• Cookie 头添加行末尾缺少闭合双引号：原代码client.DefaultRequestHeaders.Add("Cookie", "ebpPermHash=-396055074);修改为client.DefaultRequestHeaders.Add("Cookie", "ebpPermHash=-396055074");
• Cache-Control 头添加行末尾缺少分号：原代码client.DefaultRequestHeaders.Add("Cache-Control", "no-cache")修改为client.DefaultRequestHeaders.Add("Cache-Control", "no-cache");

2. 修复重定向时Authorization头丢失问题 #

HttpClient 默认开启自动重定向，但重定向请求会自动清除Authorization头，这是Bearer token不被携带的最高频原因。需要关闭自动重定向自行处理，同时关闭不需要的默认凭证配置：

new HttpClientHandler() { 
    UseDefaultCredentials = false, // Bearer授权无需默认凭证，建议关闭
    AllowAutoRedirect = false // 关闭自动重定向避免头丢失
}

3. 移除重复的Accept头配置 #

你先添加了application/json的Accept头，后面又覆盖添加了多类型的Accept头，可能导致服务端无法正确识别响应格式，删除后面重复的client.DefaultRequestHeaders.Add("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8"); 行即可。

4. 避免阻塞调用引发的参数异常 #

同步调用.Result容易引发线程上下文死锁，导致请求参数异常，建议用GetAwaiter().GetResult()替代：

HttpResponseMessage response = client.PostAsJsonAsync("/v2/bb/sa", payModel).GetAwaiter().GetResult();
var responseString = response.Content.ReadAsStringAsync().GetAwaiter().GetResult();

5. 验证token有效性 #

添加Trim()清除authtoken变量前后的多余空格、换行符，避免token格式错误：

client.DefaultRequestHeaders.Add("Authorization", "Bearer " + authtoken.Trim());

修复后完整代码示例 #

ServicePointManager.SecurityProtocol = SecurityProtocolType.Ssl3 | SecurityProtocolType.Tls12 | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls;
string result = "";
// 生产环境建议HttpClient单例注入，不要每次请求都新建
using (var client = new HttpClient(new HttpClientHandler() { 
    UseDefaultCredentials = false,
    AllowAutoRedirect = false
}))
{
    client.BaseAddress = new Uri(baseURL);
    client.DefaultRequestHeaders.Accept.Clear();
    client.DefaultRequestHeaders.Add("Cookie", "ebpPermHash=-396055074");
    client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
    client.DefaultRequestHeaders.Add("Authorization", "Bearer " + authtoken.Trim());
    client.DefaultRequestHeaders.Add("Accept-Encoding", "gzip, deflate");
    client.DefaultRequestHeaders.Add("Accept-Language", "en-GB,en-US;q=0.9,en;q=0.8");
    client.DefaultRequestHeaders.Add("Cache-Control", "no-cache");
    client.DefaultRequestHeaders.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36");
    
    HttpResponseMessage response = client.PostAsJsonAsync("/v2/bb/sa", payModel).GetAwaiter().GetResult();
    
    var responseString = response.Content.ReadAsStringAsync().GetAwaiter().GetResult();
    result = responseString;
    dynamic data = JObject.Parse(result);
    string throwresult = Convert.ToString(data);
    result = data.authToken?.ToString() ?? string.Empty;
    logErr.ControlLog(throwresult);
}
return result;

内容的提问来源于stack exchange，提问作者padma priya