無法使用HttpClient獲取API資源

Question

我正在使用Identity Server4，並且已經使用ResourceOwnerPassword授予類型配置了Web API項目。

Web API方法：

[HttpGet]
[Authorize(Roles = "Badmin")]
[Route("GetUsers")]
public IActionResult GetUsers()
{
    List<ApplicationUser> users = _context.ApplicationUsers
        .AsNoTracking().ToListAsync().Result;

    return Json(users);
}

在我的控制台程序代碼中：

if (response != null)
{
    using (HttpClient client = new HttpClient())
    {
        Console.WriteLine("AccessToken:" + Environment.NewLine + response.AccessToken);
        Console.WriteLine(Environment.NewLine);

        HttpResponseMessage resourceOwnerPasswordResponse = await client.GetAsync("https://localhost:44366/identity/GetUsers");

        client.DefaultRequestHeaders.Add("Bearer", response.AccessToken);

        if (!resourceOwnerPasswordResponse.IsSuccessStatusCode)
        {
            Console.WriteLine(resourceOwnerPasswordResponse.StatusCode);
            Console.WriteLine("HttpClient ResourceOwnerPassword Result: " + resourceOwnerPasswordResponse.StatusCode);
            Console.WriteLine(Environment.NewLine);
        }
        else
        {
            string result = await resourceOwnerPasswordResponse.Content.ReadAsStringAsync();
            Console.WriteLine("HttpClient ResourceOwnerPassword Result: " + Environment.NewLine + JsonConvert.DeserializeObject(result));
            Console.WriteLine(Environment.NewLine);
        }
    }
}

第二種方式：

if (response != null)
{
    HttpWebRequest httpWebRequest = (HttpWebRequest)WebRequest.Create("https://localhost:44366/identity/GetUsers");
    httpWebRequest.ContentType = "application/json";
    httpWebRequest.Headers.Add("Authorization", string.Format("Bearer {0}", response.AccessToken));
    httpWebRequest.Method = "GET";

    HttpWebResponse httpWebResponse = (HttpWebResponse)httpWebRequest.GetResponse();

    string result = string.Empty;

    using (Stream responseStream = httpWebResponse.GetResponseStream())
    {
        if (responseStream != null)
        {
            StreamReader streamReader = new StreamReader(responseStream);
            result = streamReader.ReadToEnd();
            streamReader.Close();
        }
    }

    Console.WriteLine("HttpWebRequest ResourceOwnerPassword Result: " + Environment.NewLine + JsonConvert.DeserializeObject(result));
}

查看控制台結果：

所以我的問題是為什么當我使用HttpCliet ，我得到了未經授權（代碼401），而第二種方法成功地獲得了用戶數據。

Answer 1

發出請求之前 ，應將令牌添加到客戶端，並且需要確保它是“ 授權”標頭。

client.DefaultRequestHeaders.Authorization = 
    new AuthenticationHeaderValue("Bearer", response.AccessToken);

//OR

//client.DefaultRequestHeaders
//  .Add("Authorization", string.Format("Bearer {0}", response.AccessToken));

var resourceOwnerPasswordResponse = await client.GetAsync("https://localhost:44366/identity/GetUsers");

這就是為什么它在第二個示例而不是第一個示例中起作用的原因

如果使用ToListAsync則Web API操作也應該是異步的

[HttpGet]
[Authorize(Roles = "Badmin")]
[Route("GetUsers")]
public async Task<IActionResult> GetUsers() {
    var users = await _context.ApplicationUsers.AsNoTracking().ToListAsync();

    return Json(users);
}