设置HttpClient的授权标头


483

我有一个用于REST API的HttpClient。但是,我在设置Authorization标头时遇到了麻烦。我需要将标头设置为通过执行OAuth请求收到的令牌。我看到了.NET的一些代码,这些代码建议如下:

httpClient.DefaultRequestHeaders.Authorization = new Credential(OAuth.token);

但是,WinRT中不存在Credential类。任何人有任何想法如何设置授权标头?


1
Credential类属于哪个名称空间?
kampsj

@kampsj我不知道,因为它是WinRT中不存在的.NET命名空间
Stephen Hynes 2013年

1
为什么不要求request.Headers.Add(“ Authorization”,令牌);
ahll

Answers:


815

因此,实现方法如下:

httpClient.DefaultRequestHeaders.Authorization =
    new AuthenticationHeaderValue("Bearer", "Your Oauth token");

14
您如何获得“您的Oauth令牌”?
秘密松鼠

3
我使用的是:client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Basic", "encrypted user/pwd");从Advanced Rest Client chrome扩展中获取加密的用户/密码。
Red

6
@Red fyi,第二个参数是base64编码的user:password(未加密)。
n00b

5
我的应用程序很长时间以来一直在愉快地使用它,然后突然我开始得到RuntimeBinderException。我不得不切换到httpClient.DefaultRequestHeaders.Add(“ Authorization”,“ Bearer”,“您的Oauth令牌”); 让它再次运行。
克拉格

8
@kraeg,您列出的代码未编译,是否表示要像这样连接最后两个字符串:client.DefaultRequestHeaders.Add(“ Authorization”,“ Bearer” +“您的Oauth令牌”);
TroySteven,

354
request.DefaultRequestHeaders.Authorization = 
    new AuthenticationHeaderValue(
        "Basic", Convert.ToBase64String(
            System.Text.ASCIIEncoding.ASCII.GetBytes(
               $"{yourusername}:{yourpwd}")));

27
@MickyDuncan HttpClient具有DefaultRequestHeaders.Authorization。这个答案挽救了我的一天。非常感谢WhiteRabbit。
Joey Schluchter 2014年

3
如果您检查Auhtorization标头中除了字符串Basic以外不包含其他任何内容,则此方法不起作用。
拉斐尔2014年

1
谁能解释为什么将用户名和密码转换为base64字符串很重要吗?它不提供真正的加密,那为什么重要呢?
乔纳森·伍德

3
@JonathanWood因为那是定义如何使用它的方式。Basic不提供加密,仅提供足够的编码以避免标题中选择密码字符时出现问题。
理查德

4
您在这里使用ASCII编码有什么特殊原因吗?我假设使用UTF8编码没有问题,因为无论如何我们都是Base64对其进行编码。我想我想知道基本身份验证规范是否说username:password组合应该仅使用ASCII?
暗恋

82

我正在寻找一种解决此问题的好方法,而且我正在寻找相同的问题。希望这个答案将帮助每个有同样问题的人,像我一样。

using (var client = new HttpClient())
{
    var url = "https://www.theidentityhub.com/{tenant}/api/identity/v1";
    client.DefaultRequestHeaders.Add("Authorization", "Bearer " + accessToken);
    var response = await client.GetStringAsync(url);
    // Parse JSON response.
    ....
}

来自https://www.theidentityhub.com/hub/Documentation/CallTheIdentityHubApi的参考


1
我正在做完全相同的事情@willie,但我仍然从我的API中获得401
SomethingOn

2
嗨@SomethingOn我认为您没有正确的令牌密钥,所以您收到401,我将在我的个人“问问题”中分享自己的方式,希望它可以帮助您解决问题。
郑威(Willie Cheng)

14
您不应该将HttpClient放在一个using块中。(是的,我知道这听起来很倒霉,但是如果您使用它using而不是仅回收HttpClient ,则会泄漏连接。)
Jonathan Allen

42

由于重用HttpClient实例是一种好的做法,因此会导致性能和端口耗尽,并且由于没有答案可以提供此解决方案(甚至导致您陷入不良做法:(),因此我在此处提供了指向我做出的答案的链接在类似的问题上:

https://stackoverflow.com/a/40707446/717372

有关如何正确使用HttpClient的一些资料:


5
港口耗尽问题不是开玩笑。它在质量保证中几乎从未发生过,但会打击生产中任何频繁使用的项目。
乔纳森·艾伦

见我的文章为一个具体的例子stackoverflow.com/a/59052193/790635
EMP

41

我同意TheWhiteRabbit的回答,但是如果您使用HttpClient进行大量调用,我认为代码似乎有些重复。

我认为有两种方法可以改善答案。

创建一个帮助程序类来创建客户端:

public static class ClientHelper
{
    // Basic auth
    public static HttpClient GetClient(string username,string password)
    {
            var authValue = new AuthenticationHeaderValue("Basic", Convert.ToBase64String(Encoding.UTF8.GetBytes($"{username}:{password}")));

            var client = new HttpClient(){
                DefaultRequestHeaders = { Authorization = authValue}
                //Set some other client defaults like timeout / BaseAddress
            };
            return client;
    }

    // Auth with bearer token
    public static HttpClient GetClient(string token)
    {
            var authValue = new AuthenticationHeaderValue("Bearer", token);

            var client = new HttpClient(){
                DefaultRequestHeaders = { Authorization = authValue}
                //Set some other client defaults like timeout / BaseAddress
            };
            return client;
    }
}

用法:

using(var client = ClientHelper.GetClient(username,password))
{
    //Perform some http call
}

using(var client = ClientHelper.GetClient(token))
{
    //Perform some http call
}

创建扩展方法:

没有赢得美女奖,但是效果很好:)

    public static class HttpClientExtentions
    {
        public static AuthenticationHeaderValue ToAuthHeaderValue(this string username, string password)
        {
            return new AuthenticationHeaderValue("Basic",
        Convert.ToBase64String(
            System.Text.Encoding.ASCII.GetBytes(
                $"{username}:{password}")));
        }
    }

用法:

using (var client = new HttpClient())
{
    client.DefaultRequestHeaders.Authorization = _username.ToAuthHeaderValue(_password); 
}

同样,我认为上述2个选项使客户端using语句的重复性降低了。请记住,如果您要进行多个http调用,则最好重用HttpClient,但是我认为这超出了此问题的范围。


20
我可以看到您的答案是正确的,但我不推荐这种方法TL; DR其明显错误是因为套接字耗尽,这是解释链接
lacripta

2
@lacripta,这是真的,但是如果您读了最后两句话,我就是出于这个原因重用HttpClient的最佳实践,但是我认为这超出了此问题的范围。
Florian Schaal

1
我可以理解您的观点,但您的建议是说代码是重复的,这可能会导致滥用此工厂方法,因此最好在第一行指出这将在将来特别引起资源使用问题这个案例。而不仅仅是大多数人不会读的警告。
lacripta

1
使用HttpClientFactory可以更好地避免套接字耗尽的问题。
RyanOC '18

20

我正在设置不记名令牌

httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token);

它在一个端点上工作,但在另一个端点上却没有。问题是,我不得不小写b"bearer"。更改后,它现在适用于我正在使用的两个api。如果您甚至没有将它视为需要针锋相对的干草堆之一,那么就很容易错过。

确保拥有"Bearer"-拥有资本。


17

我建议你:

HttpClient.DefaultRequestHeaders.Add("Authorization", "Bearer <token>");

然后可以像这样使用它:

var response = await client.GetAsync(url);
if (response.IsSuccessStatusCode)
{
    responseMessage = await response.Content.ReadAsAsync<ResponseMessage>();
}

例如,如果令牌每隔1小时超时一次,则必须使用此解决方案更新HttpClient。我建议检查您的令牌是否仍然有效,否则请刷新令牌并将其添加到HttpRequestMessage中
JohanFranzén

13

使用C#HttpClient设置基本身份验证。以下代码为我工作。

   using (var client = new HttpClient())
        {
            var webUrl ="http://localhost/saleapi/api/";
            var uri = "api/sales";
            client.BaseAddress = new Uri(webUrl);
            client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
            client.DefaultRequestHeaders.ConnectionClose = true;

            //Set Basic Auth
            var user = "username";
            var password = "password";
            var base64String =Convert.ToBase64String( Encoding.ASCII.GetBytes($"{user}:{password}"));
            client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Basic",base64String);

            var result = await client.PostAsJsonAsync(uri, model);
            return result;
        }

正是我需要的,谢谢。
rchrd

9

这就是我的做法:

using (HttpClient httpClient = new HttpClient())
{
   Dictionary<string, string> tokenDetails = null;
   var messageDetails = new Message { Id = 4, Message1 = des };
   HttpClient client = new HttpClient();
   client.BaseAddress = new Uri("http://localhost:3774/");
   var login = new Dictionary<string, string>
       {
           {"grant_type", "password"},
           {"username", "sa@role.com"},
           {"password", "lopzwsx@23"},
       };
   var response = client.PostAsync("Token", new FormUrlEncodedContent(login)).Result;
   if (response.IsSuccessStatusCode)
   {
      tokenDetails = JsonConvert.DeserializeObject<Dictionary<string, string>>(response.Content.ReadAsStringAsync().Result);
      if (tokenDetails != null && tokenDetails.Any())
      {
         var tokenNo = tokenDetails.FirstOrDefault().Value;
         client.DefaultRequestHeaders.Add("Authorization", "Bearer " + tokenNo);
         client.PostAsJsonAsync("api/menu", messageDetails)
             .ContinueWith((postTask) => postTask.Result.EnsureSuccessStatusCode());
      }
   }
}

这段YouTube影片对我有很大帮助。请检查一下。 https://www.youtube.com/watch?v=qCwnU06NV5Q


9

使用基本授权和Json参数。

using (HttpClient client = new HttpClient())
                    {
                        var request_json = "your json string";

                        var content = new StringContent(request_json, Encoding.UTF8, "application/json");

                        var authenticationBytes = Encoding.ASCII.GetBytes("YourUsername:YourPassword");

                        client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Basic",
                               Convert.ToBase64String(authenticationBytes));
                        client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));

                        var result = await client.PostAsync("YourURL", content);

                        var result_string = await result.Content.ReadAsStringAsync();
                    }

2
在这样的示例中,您不应包含禁用SSL证书检查的代码。人们可能会盲目地复制您的代码而没有意识到它的作用。我已经为您删除了这些行。
约翰(John)

9

如果您想重复使用HttpClient,建议不要使用,DefaultRequestHeaders因为它们是随每个请求一起发送的。

您可以尝试以下方法:

var requestMessage = new HttpRequestMessage
    {
        Method = HttpMethod.Post,
        Content = new StringContent("...", Encoding.UTF8, "application/json"),
        RequestUri = new Uri("...")
    };

requestMessage.Headers.Authorization = new AuthenticationHeaderValue("Basic", 
    Convert.ToBase64String(System.Text.ASCIIEncoding.ASCII.GetBytes($"{user}:{password}")));

var response = await _httpClient.SendAsync(requestMessage);

8

6年后,但添加此内容以防某人受到帮助。

https://www.codeproject.com/Tips/996401/Authenticate-WebAPIs-with-Basic-and-Windows-Authen

var authenticationBytes = Encoding.ASCII.GetBytes("<username>:<password>");
using (HttpClient confClient = new HttpClient())
{
  confClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Basic", 
         Convert.ToBase64String(authenticationBytes));
  confClient.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue(Constants.MediaType));  
  HttpResponseMessage message = confClient.GetAsync("<service URI>").Result;
  if (message.IsSuccessStatusCode)
  {
    var inter = message.Content.ReadAsStringAsync();
    List<string> result = JsonConvert.DeserializeObject<List<string>>(inter.Result);
  }
}

为我工作。相对于郑伟利的回答,这对我没有用。
user890332 '19

5

UTF8选项

request.DefaultRequestHeaders.Authorization = 
new AuthenticationHeaderValue(
    "Basic", Convert.ToBase64String(
        System.Text.Encoding.UTF8.GetBytes(
           $"{yourusername}:{yourpwd}")));

3

使用组装AuthenticationHeaderValueSystem.Net.Http

public AuthenticationHeaderValue(
    string scheme,
    string parameter
)

我们可以像这样设置或更新现有的Authorization标头httpclient

httpclient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", TokenResponse.AccessToken);

1
欢迎使用SO,但请添加更多上下文。
JP赫勒蒙斯

答案就在眼前,但是让一名班轮工解释他的代码应该做什么并不会有什么坏处。只是说。
iiminov

2

BaseWebApi.cs

public abstract class BaseWebApi
{
    //Inject HttpClient from Ninject
    private readonly HttpClient _httpClient;
    public BaseWebApi(HttpClient httpclient)
    {
        _httpClient = httpClient;
    }

    public async Task<TOut> PostAsync<TOut>(string method, object param, Dictionary<string, string> headers, HttpMethod httpMethod)
    {
        //Set url

        HttpResponseMessage response;
        using (var request = new HttpRequestMessage(httpMethod, url))
        {
            AddBody(param, request);
            AddHeaders(request, headers);
            response = await _httpClient.SendAsync(request, cancellationToken);
        }

        if(response.IsSuccessStatusCode)
        {
             return await response.Content.ReadAsAsync<TOut>();
        }
        //Exception handling
    }

    private void AddHeaders(HttpRequestMessage request, Dictionary<string, string> headers)
    {
        request.Headers.Accept.Clear();
        request.Headers.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));

        if (headers == null) return;

        foreach (var header in headers)
        {
            request.Headers.Add(header.Key, header.Value);
        }
    }

    private static void AddBody(object param, HttpRequestMessage request)
    {
        if (param != null)
        {
            var content = JsonConvert.SerializeObject(param);
            request.Content = new StringContent(content);
            request.Content.Headers.ContentType = new MediaTypeHeaderValue("application/json");
        }
    }

SubWebApi.cs

public sealed class SubWebApi : BaseWebApi
{
    public SubWebApi(HttpClient httpClient) : base(httpClient) {}

    public async Task<StuffResponse> GetStuffAsync(int cvr)
    {
        var method = "get/stuff";
        var request = new StuffRequest 
        {
            query = "GiveMeStuff"
        }
        return await PostAsync<StuffResponse>(method, request, GetHeaders(), HttpMethod.Post);
    }
    private Dictionary<string, string> GetHeaders()
    {
        var headers = new Dictionary<string, string>();
        var basicAuth = GetBasicAuth();
        headers.Add("Authorization", basicAuth);
        return headers;
    }

    private string GetBasicAuth()
    {
        var byteArray = Encoding.ASCII.GetBytes($"{SystemSettings.Username}:{SystemSettings.Password}");
        var authString = Convert.ToBase64String(byteArray);
        return $"Basic {authString}";
    }
}

1

如果您要发送HttpClient带有Bearer Token的请求,此代码可能是一个很好的解决方案:

var requestMessage = new HttpRequestMessage
{
    Method = HttpMethod.Post,
    Content = new StringContent(".....", Encoding.UTF8, "application/json"),
    RequestUri = new Uri(".....")
};

requestMessage.Headers.Authorization = new AuthenticationHeaderValue("Bearer", "Your token");

var response = await _httpClient.SendAsync(requestMessage);

0

在net .core中,您可以使用

var client = new HttpClient();
client.SetBasicAuthentication(userName, password);

要么

var client = new HttpClient();
client.SetBearerToken(token);

1
第一个示例不起作用,因为SetBasicAuthentication()默认情况下不可用,因此它必须是扩展方法。它在哪里定义?
ViRuSTriNiTy

0

使用现有库可能会更容易。

例如,下面的扩展方法是随Identity Server 4 https://www.nuget.org/packages/IdentityModel/添加的。

 public static void SetBasicAuthentication(this HttpClient client, string userName, string password);
    //
    // Summary:
    //     Sets a basic authentication header.
    //
    // Parameters:
    //   request:
    //     The HTTP request message.
    //
    //   userName:
    //     Name of the user.
    //
    //   password:
    //     The password.
    public static void SetBasicAuthentication(this HttpRequestMessage request, string userName, string password);
    //
    // Summary:
    //     Sets a basic authentication header for RFC6749 client authentication.
    //
    // Parameters:
    //   client:
    //     The client.
    //
    //   userName:
    //     Name of the user.
    //
    //   password:
    //     The password.
    public static void SetBasicAuthenticationOAuth(this HttpClient client, string userName, string password);
    //
    // Summary:
    //     Sets a basic authentication header for RFC6749 client authentication.
    //
    // Parameters:
    //   request:
    //     The HTTP request message.
    //
    //   userName:
    //     Name of the user.
    //
    //   password:
    //     The password.
    public static void SetBasicAuthenticationOAuth(this HttpRequestMessage request, string userName, string password);
    //
    // Summary:
    //     Sets an authorization header with a bearer token.
    //
    // Parameters:
    //   client:
    //     The client.
    //
    //   token:
    //     The token.
    public static void SetBearerToken(this HttpClient client, string token);
    //
    // Summary:
    //     Sets an authorization header with a bearer token.
    //
    // Parameters:
    //   request:
    //     The HTTP request message.
    //
    //   token:
    //     The token.
    public static void SetBearerToken(this HttpRequestMessage request, string token);
    //
    // Summary:
    //     Sets an authorization header with a given scheme and value.
    //
    // Parameters:
    //   client:
    //     The client.
    //
    //   scheme:
    //     The scheme.
    //
    //   token:
    //     The token.
    public static void SetToken(this HttpClient client, string scheme, string token);
    //
    // Summary:
    //     Sets an authorization header with a given scheme and value.
    //
    // Parameters:
    //   request:
    //     The HTTP request message.
    //
    //   scheme:
    //     The scheme.
    //
    //   token:
    //     The token.
    public static void SetToken(this HttpRequestMessage request, string scheme, string token);


-1

如果您从服务接收到json或xml,这可能会起作用,并且我认为如果使用函数MakeXmlRequest(在xmldocumnet中放入结果)和MakeJsonRequest,它也可以使您了解标头和T类型的工作原理(将json放入您希望的类中,该类具有与json响应相同的结构)

/*-------------------------example of use-------------*/
MakeXmlRequest<XmlDocument>("your_uri",result=>your_xmlDocument_variable =     result,error=>your_exception_Var = error);

MakeJsonRequest<classwhateveryouwant>("your_uri",result=>your_classwhateveryouwant_variable=result,error=>your_exception_Var=error)
/*-------------------------------------------------------------------------------*/


public class RestService
{
    public void MakeXmlRequest<T>(string uri, Action<XmlDocument> successAction, Action<Exception> errorAction)
    {
        XmlDocument XMLResponse = new XmlDocument();
        string wufooAPIKey = ""; /*or username as well*/
        string password = "";
        StringBuilder url = new StringBuilder();
        url.Append(uri);
        HttpWebRequest request = (HttpWebRequest)HttpWebRequest.Create(url.ToString());
        string authInfo = wufooAPIKey + ":" + password;
        authInfo = Convert.ToBase64String(Encoding.Default.GetBytes(authInfo));
        request.Timeout = 30000;
        request.KeepAlive = false;
        request.Headers["Authorization"] = "Basic " + authInfo;
        string documento = "";
        MakeRequest(request,response=> documento = response,
                            (error) =>
                            {
                             if (errorAction != null)
                             {
                                errorAction(error);
                             }
                            }
                   );
        XMLResponse.LoadXml(documento);
        successAction(XMLResponse);
    }



    public void MakeJsonRequest<T>(string uri, Action<T> successAction, Action<Exception> errorAction)
    {
        string wufooAPIKey = "";
        string password = "";
        StringBuilder url = new StringBuilder();
        url.Append(uri);
        HttpWebRequest request = (HttpWebRequest)HttpWebRequest.Create(url.ToString());
        string authInfo = wufooAPIKey + ":" + password;
        authInfo = Convert.ToBase64String(Encoding.Default.GetBytes(authInfo));
        request.Timeout = 30000;
        request.KeepAlive = false;
        request.Headers["Authorization"] = "Basic " + authInfo;
       // request.Accept = "application/json";
      //  request.Method = "GET";
        MakeRequest(
           request,
           (response) =>
           {
               if (successAction != null)
               {
                   T toReturn;
                   try
                   {
                       toReturn = Deserialize<T>(response);
                   }
                   catch (Exception ex)
                   {
                       errorAction(ex);
                       return;
                   }
                   successAction(toReturn);
               }
           },
           (error) =>
           {
               if (errorAction != null)
               {
                   errorAction(error);
               }
           }
        );
    }
    private void MakeRequest(HttpWebRequest request, Action<string> successAction, Action<Exception> errorAction)
    {
        try{
            using (var webResponse = (HttpWebResponse)request.GetResponse())
            {
                using (var reader = new StreamReader(webResponse.GetResponseStream()))
                {
                    var objText = reader.ReadToEnd();
                    successAction(objText);
                }
            }
        }catch(HttpException ex){
            errorAction(ex);
        }
    }
    private T Deserialize<T>(string responseBody)
    {
        try
        {
            var toReturns = JsonConvert.DeserializeObject<T>(responseBody);
             return toReturns;
        }
        catch (Exception ex)
        {
            string errores;
            errores = ex.Message;
        }
        var toReturn = JsonConvert.DeserializeObject<T>(responseBody);
        return toReturn;
    }
}
}

-1
static async Task<AccessToken> GetToken()
{
        string clientId = "XXX";
        string clientSecret = "YYY";
        string credentials = String.Format("{0}:{1}", clientId, clientSecret);

        using (var client = new HttpClient())
        {
            client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Basic", Convert.ToBase64String(Encoding.UTF8.GetBytes(credentials)));
            List<KeyValuePair<string, string>> requestData = new List<KeyValuePair<string, string>>();
            requestData.Add(new KeyValuePair<string, string>("grant_type", "client_credentials"));
            FormUrlEncodedContent requestBody = new FormUrlEncodedContent(requestData);
            var request = await client.PostAsync("https://accounts.spotify.com/api/token", requestBody);
            var response = await request.Content.ReadAsStringAsync();
            return JsonConvert.DeserializeObject<AccessToken>(response);
        }
    }

欢迎使用stackoverflow。除了您提供的答案之外,请考虑简要说明为什么以及如何解决此问题。
jtate

-2

这可能有助于设置标题:

WebClient client = new WebClient();

string authInfo = this.credentials.UserName + ":" + this.credentials.Password;
authInfo = Convert.ToBase64String(Encoding.Default.GetBytes(authInfo));
client.Headers["Authorization"] = "Basic " + authInfo;

9
他在用HttpClient,不是WebClient
Jean Hominal 2014年
By using our site, you acknowledge that you have read and understand our Cookie Policy and Privacy Policy.
Licensed under cc by-sa 3.0 with attribution required.