HttpClient HttpRequestMessage 在 net6 中失败，但在 net4.8 中有效

Question

I have two different projects, one written in.Net 4.8 and another in.Net6.

The code works fine in .net 4.8, but fails in .net6. The exceptions I get, and it's inner exceptions, is

The SSL connection could not be established, see inner exception

Authentication failed, see inner exception

The token supplied to the function is invalid

The code is written in the same way, no difference at all. First the part for the System.Net.Http.HttpClient _httpRequestClient:

        ServicePointManager.ServerCertificateValidationCallback = delegate { return true; };
        ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls11;
        string baseAddress = host;

        string credentials = Convert.ToBase64String(new ASCIIEncoding().GetBytes(string.Format("{0}:{1}", connection.Username, connection.Password)));


        _httpRequestClient = new HttpClient();
        _httpRequestClient.BaseAddress = new Uri(baseAddress);
        _httpRequestClient.DefaultRequestHeaders.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("basic",
                 credentials);

        _httpRequestClient.DefaultRequestHeaders.Accept.Add(new System.Net.Http.Headers.MediaTypeWithQualityHeaderValue("application/json"));

And when making a call to the server from an async Task it throws the exeption:

using (var response = await _httpRequestClient.SendAsync(
                    new HttpRequestMessage(HttpMethod.Get, command), HttpCompletionOption.ResponseHeadersRead)
                    )

While debugging, the _httpRequestClient.DefaultRequestHeaders.Authorization is exactly the same in both projects (as well as most of the values) except that in .net6 the _httpRequestClient also has DefaultRequestVersion and DefaultVersionPolicy.

For now at least, I really cannot figure out what's wrong. Please help:)

Answer 1

First of, thanks for pointing me to the right direction.

However, .Net framework and.Net standard has some differences.

In .net standard, the following code doesn't seem to do anything in my usage:

ServicePointManager.ServerCertificateValidationCallback = delegate { return true; };
    ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls11;

Instead, I had to create an instance of HttpClientHandler and pass it to the HttpClient constructor. See below:

        _httpClientHandler = new HttpClientHandler();
        _httpClientHandler.ClientCertificateOptions = ClientCertificateOption.Manual;
        _httpClientHandler.ServerCertificateCustomValidationCallback =
            (httpRequestMessage, cert, cetChain, policyErrors) =>
            {
                //TODO Add custom validation
                return true;
            };


        string credentials = Convert.ToBase64String(Encoding.UTF8.GetBytes($"{connection.Username}:{connection.Password}"));

        //Added _httpClientHandler to constructor
        _httpRequestClient = new HttpClient(_httpClientHandler);
        _httpRequestClient.BaseAddress = new Uri(baseAddress);
        _httpRequestClient.DefaultRequestHeaders.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("basic",
                 credentials);

        _httpRequestClient.DefaultRequestHeaders.Accept.Add(new System.Net.Http.Headers.MediaTypeWithQualityHeaderValue("application/json"));

The final, and main hint to what was wrong, was found here: https://stackoverflow.com/a/46626858/2488982

Again, thank everyone:)

Edit: Certificate validation should not be tampered with. If self signed certificates are to be used, add them to trusted CA for the clients.

This means my code has been reduced to this:

string credentials = Convert.ToBase64String(Encoding.UTF8.GetBytes($"{connection.Username}:{connection.Password}"));


        _httpRequestClient = new HttpClient();
        _httpRequestClient.BaseAddress = new Uri(baseAddress);
        _httpRequestClient.DefaultRequestHeaders.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("basic",
                 credentials);

        _httpRequestClient.DefaultRequestHeaders.Accept.Add(new System.Net.Http.Headers.MediaTypeWithQualityHeaderValue("application/json"));
        _httpRequestClient.DefaultRequestHeaders.Accept.Add(new System.Net.Http.Headers.MediaTypeWithQualityHeaderValue("application/xml"));
        _httpRequestClient.DefaultRequestHeaders.Accept.Add(new System.Net.Http.Headers.MediaTypeWithQualityHeaderValue("application/vnd.assaabloy.arx.integrated-alarm-1.0+json"));

No custom validation is done anymore.

Thanks Panagiotis Kanavos for your input.