HttpClient与HttpWebRequest无法发起空POST及特定请求问题咨询

Hey there! I’ve run into similar OAuth2 flow quirks in C# before, so let’s work through your two issues step by step.

Issue 1: Can’t send empty POST requests with HttpClient/HttpWebRequest #

The problem usually comes down to how .NET’s HTTP clients handle requests without a body by default. For Fitbit’s endpoints, you need to be explicit about the request structure to avoid unexpected behavior:

Fix for HttpWebRequest #

When sending an empty POST, always set ContentLength = 0. If you skip this, .NET might default to chunked transfer encoding, which many OAuth2 servers (including Fitbit) reject:

var fitbitTokenUrl = "https://api.fitbit.com/oauth2/token";
var webRequest = (HttpWebRequest)WebRequest.Create(fitbitTokenUrl);

webRequest.Method = "POST";
webRequest.ContentLength = 0; // Critical for empty body
// Add required headers (like Authorization) here

using (var response = (HttpWebResponse)webRequest.GetResponse())
using (var reader = new StreamReader(response.GetResponseStream()))
{
    var responseBody = reader.ReadToEnd();
    // Process response
}

Fix for HttpClient #

If you call PostAsync(url, null) directly, the framework might omit headers the server expects. Instead, explicitly send an empty content instance with the correct Content-Type (if required by Fitbit):

using (var client = new HttpClient())
{
    var request = new HttpRequestMessage(HttpMethod.Post, "https://api.fitbit.com/oauth2/token");
    // Use empty StringContent to ensure Content-Type is set (if needed)
    request.Content = new StringContent(string.Empty, Encoding.UTF8, "application/x-www-form-urlencoded");
    // Add Authorization header here (Fitbit requires Basic auth for token requests)

    var response = await client.SendAsync(request);
    response.EnsureSuccessStatusCode();
    var responseBody = await response.Content.ReadAsStringAsync();
}

Issue 2: Validation error when sending POST with URI-encoded params, no body, and Content-Type header #

First, a quick note: Fitbit’s OAuth2 token endpoint typically expects parameters (like grant_type, code, etc.) in the request body (as application/x-www-form-urlencoded), not the URL. But since you got it working in Postman, let’s fix the C# implementation to match that behavior.

The root cause here is that when you set a Content-Type header but don’t provide a body, .NET’s clients might send inconsistent request metadata (like incorrect Content-Length) that triggers Fitbit’s validation. Here’s how to fix it:

Correct HttpClient Approach #

using (var client = new HttpClient())
{
    // Build your URL with encoded params
    var tokenUrl = "https://api.fitbit.com/oauth2/token?grant_type=authorization_code&code=YOUR_AUTH_CODE&redirect_uri=YOUR_REDIRECT_URI&client_id=YOUR_CLIENT_ID";
    
    var request = new HttpRequestMessage(HttpMethod.Post, tokenUrl);
    // Add Content-Type without attaching a body
    request.Headers.TryAddWithoutValidation("Content-Type", "application/x-www-form-urlencoded");
    // Critical: Explicitly set Content to null to avoid auto-generated body
    request.Content = null;

    // Don't forget Fitbit's required Basic Authorization header!
    var clientId = "YOUR_CLIENT_ID";
    var clientSecret = "YOUR_CLIENT_SECRET";
    var authToken = Convert.ToBase64String(Encoding.ASCII.GetBytes($"{clientId}:{clientSecret}"));
    request.Headers.Authorization = new AuthenticationHeaderValue("Basic", authToken);

    var response = await client.SendAsync(request);
    response.EnsureSuccessStatusCode();
    var responseBody = await response.Content.ReadAsStringAsync();
}

Correct HttpWebRequest Approach #

var tokenUrl = "https://api.fitbit.com/oauth2/token?grant_type=authorization_code&code=YOUR_AUTH_CODE&redirect_uri=YOUR_REDIRECT_URI&client_id=YOUR_CLIENT_ID";
var webRequest = (HttpWebRequest)WebRequest.Create(tokenUrl);

webRequest.Method = "POST";
webRequest.ContentType = "application/x-www-form-urlencoded";
webRequest.ContentLength = 0; // Must set to 0 since there's no body
// Add Basic Auth header
var clientId = "YOUR_CLIENT_ID";
var clientSecret = "YOUR_CLIENT_SECRET";
var authToken = Convert.ToBase64String(Encoding.ASCII.GetBytes($"{clientId}:{clientSecret}"));
webRequest.Headers.Add("Authorization", $"Basic {authToken}");

using (var response = (HttpWebResponse)webRequest.GetResponse())
using (var reader = new StreamReader(response.GetResponseStream()))
{
    var responseBody = reader.ReadToEnd();
}

Key Notes #

• Basic Auth is mandatory: Fitbit’s token endpoint requires you to send your client ID and secret as a Base64-encoded Basic auth header. Missing this is a common cause of validation errors.
• Avoid auto-generated content: If you don’t set Content = null (HttpClient) or ContentLength = 0 (HttpWebRequest), .NET might add an empty body with unexpected encoding, which Fitbit rejects.

内容的提问来源于stack exchange，提问作者UberFace