We Keep Coding

How to reset AuthorizationHeader from HttpClientFactory?

I'm developing a Blazor App which consumes three different APIs, and everything is going fine until the API token expires.
My problem is about having the token with the HTTPClientFactory. Right now, I'm using this approach but feel free to tell me I'm completely wrong about it
services.AddHttpClient("first-api", options =>
{
options.BaseAddress = new Uri(first_api_uri);
});
First, I inject the HttpClient for any of the APIs. Let´s say it´s the first one.
After that, I configure the HttpClientFactory to my APIService and set the Default Header (bearer token) reading from my Protected Local Storage.
services.AddScoped<IAPIOneService, APIOneService>(context =>
{
var httpClientFactory = context.GetRequiredService<IHttpClientFactory>();
var httpClient = httpClientFactory.CreateClient("first-api");
var storage = context.GetRequiredService<ProtectedLocalStorage>();
AddHeader(httpClient, storage);
var apiClient = new APIClient(httpClient);
return new APIOneService(apiClient);
});
As I said before, the AddHeader set the Authorization Header to the HttpClient, which goes inside of a "handler" of requests (built by me), called APIClient.
If the token expires, I get a 401 from the server and send the user to the login page, but, when it logs in again, the HttpClient keeps the old token, probably because it does not pass through the DI section where the AddHeader writes the new Authentication Header.
I'm probably doing it wrong, but writing a HttpMessageHandler just does not work because AddHeader cannot read from my Protected Local Storage. It's something from Blazor rules.
Can someone help me and give me the right way to do it?

You can create a custom TokenRefreshHandler and add it to the HttpClient pipeline. The handler could check the response status code for each request and determine if it is a 401 Unauthorized error. If so, it can refresh the token and add this new token to the header before re-sending the request.
TokenRefreshHandler.cs
public class TokenRefreshHandler : DelegatingHandler
{
private readonly ProtectedLocalStorage _protectedLocalStorage;
public TokenRefreshHandler(ProtectedLocalStorage protectedLocalStorage)
{
_protectedLocalStorage = protectedLocalStorage;
}
protected async override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
{
HttpResponseMessage response = await base.SendAsync(request, cancellationToken);
if (response.StatusCode == HttpStatusCode.Unauthorized)
{
// Refresh the token
string newToken = await RefreshToken();
_protectedLocalStorage.Set("token", newToken);
// Add the new token to the header
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", newToken);
// Re-send the request with the new token
response = await base.SendAsync(request, cancellationToken);
}
return response;
}
private async Task<string> RefreshToken()
{
// Refresh the token and return the new token value
// ...
}
}
Register
services.AddHttpClient("first-api", options =>
{
options.BaseAddress = new Uri(first_api_uri);
})
.AddHttpMessageHandler<TokenRefreshHandler>();

C# Refit client is not sending authorization header

I'm using a C# Refit client to have my services talk to one another via http.
I'm trying to send a Bearer token through the Authorization header, but according to the error message, it's not setting the AZ header in the request (see bottom). I've tried setting it through providing all headers, and using the [Authorize] attribute, and all the other methods they describe in their readme.
Here is my Refit client api call definition:
[Post(PresentationsBasePath + "/{presentationId}/cart")]
Task AddItemToCartAsync(long presentationId, ShoppingCartItemView item, [HeaderCollection] IDictionary<string, string> headers);
//calling it here:
await _api.AddItemToCartAsync(presentationId, item, GetTokenHeader(presentationId, token));
private Dictionary<string, string> GetTokenHeader(long presentationId, string token) => new()
{
["pres_id"] = presentationId.ToString(),
[HeaderNames.Authorization] = $"Bearer {token}",
};
However, I'm getting a 401, and looking at the Refit.ApiException that's thrown, the RequestMessage.Headers does not contain the Authorization header.
Here's how I'm registering my refit api IPresentationsApi. I'm not doing anything relating to auth in the DI configuration
var refitSettings = GetRefitSettings();
void Configure<T>() where T : class => services
.AddRefitClient<T>()
.ConfigureHttpClient(ConfigureHttpClient);
Configure<IMarsPresentationApi>();
//other apis configured below
private static void ConfigureHttpClient(IServiceProvider sp, HttpClient client)
{
var config = sp.GetRequiredService<IMarsConfiguration>();
if (config.BaseUrl == null)
throw new InvalidOperationException("Mars:BaseUrl must be configured");
client.BaseAddress = new Uri(config.BaseUrl);
}
Error shown here- you can see I get 401, and AZ header is not set in the request:
What am I doing wrong? How do I get it to send the AZ header?

first try:
services.AddRefitClient<T>(new RefitSettings { AuthorizationHeaderValueGetter = () => Task.FromResult("TestToken") }).ConfigureHttpClient(ConfigureHttpClient);
second try:
services.AddRefitClient<T>().ConfigureHttpClient(ConfigureHttpClient).AddHttpMessageHandler<AuthorizationMessageHandler>();
where:
public class AuthorizationMessageHandler : DelegatingHandler
{
protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancelToken)
{
HttpRequestHeaders headers = request.Headers;
AuthenticationHeaderValue authHeader = headers.Authorization;
if (authHeader != null)
headers.Authorization = new AuthenticationHeaderValue(authHeader.Scheme, "TestToken");
return await base.SendAsync(request, cancelToken);
}
}

This discussion continued on a GitHub issue for Refit. Somebody usefully pointed out that by default Authorization headers get stripped off when HttpClient follows a redirect - https://github.com/reactiveui/refit/issues/1374#issuecomment-1212776451.
I also hit the same issue described. After reading the suggestion in the GitHub issue discussion I configured my HttpClient instance that disabled auto redirects.
var httpClient = new HttpClient(new HttpClientHandler() { AllowAutoRedirect = false })
This confirmed that the server API was returning 301-Moved Permanently responses to API endpoints that looked correct from the API documentation I had been given.
Looking at how I had configured my API endpoints they were configured like /{presentationId}/cart without slash at the end.
I updated the endpoints to end with a final slash /{presentationId}/cart/ and this stopped the server redirects being returned.

Azure Function To Azure Function Request using DefaultAzureCredential and HttpClient

I need to call a Http Azure Function from another Azure Function.
At present, I call an Azure Key Vault to get the target Function's Key, and put that in the URL as documented here: https://learn.microsoft.com/en-us/azure/azure-functions/functions-bindings-http-webhook-trigger?tabs=csharp#api-key-authorization
However, I want to start using a Managed Identity and DefaultAzureCredential but I cannot find out how to use DefaultAzureCredential with HttpClient or similar.
How could I use DefaultAzureCredential and HttpClient to call a Function from another Function?

The simplistic way of solving this issue is like this:
var targetFunctionAppAppRegistrationApplicationId = "A Guid that you must get from your target Function's Authentication configuration - 'App (client) ID'";
var url = "https://yourfunctionappname.azurewebsites.net/api/targetfunctionname";
var creds = new DefaultAzureCredential();
var token = await creds.GetTokenAsync(new Azure.Core.TokenRequestContext(new[] { targetFunctionAppAppRegistrationApplicationId }));
using (HttpClient client = new HttpClient())
{
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token.Token);
var result = await client.GetAsync(url);
// Anything else you want to do with the result
}
Credits for the above to https://spblog.net/post/2021/09/28/call-azure-ad-secured-azure-function-from-logic-app-or-another-function-with-managed-identity
However
The code above will soon cause socket exhaustion. The correct way is to use HttpClientFactory, as explained here: https://learn.microsoft.com/en-us/dotnet/architecture/microservices/implement-resilient-applications/use-httpclientfactory-to-implement-resilient-http-requests
Since this specific use case is not covered in those docs, below is an example of how it would look like.
First, you need a MessageHandler:
public class AzureDefaultCredentialsAuthorizationMessageHandler : DelegatingHandler
{
private readonly TokenRequestContext TokenRequestContext;
private readonly DefaultAzureCredential Credentials;
public AzureDefaultCredentialsAuthorizationMessageHandler()
{
// This parameter is actually a list of scopes.
// If your target Function has defined scopes then you should use them here.
// TokenRequestContext also supports many other options you should probably check out.
TokenRequestContext = new (new[] { "targetFunctionAppAppRegistrationApplicationId" });
Credentials = new DefaultAzureCredential();
}
protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
{
var tokenResult = await Credentials.GetTokenAsync(TokenRequestContext, cancellationToken);
var authorizationHeader = new AuthenticationHeaderValue("Bearer", tokenResult.Token);
request.Headers.Authorization = authorizationHeader;
return await base.SendAsync(request, cancellationToken);
}
}
You then need to register an HttpClient with this message handler in your Dependency Injection container. If you're using the standard IServiceCollection:
services
.AddScoped<AzureDefaultCredentialsAuthorizationMessageHandler>()
.AddHttpClient<YourClassUsingTheHttpClient>((serviceProvider, httpClient) =>
{
httpClient.BaseAddress = "https://yourfunctionappname.azurewebsites.net/api/targetfunctionname";
}).AddHttpMessageHandler<AzureDefaultCredentialsAuthorizationMessageHandler>();
Finally, just have a YourClassUsingTheHttpClient class that takes an HttpClient in its constructor:
public class YourClassUsingTheHttpClient
{
public YourClassUsingTheHttpClient(HttpClient httpClient) { ... }
}
Notes
It should be noted that the code above does not deal with other important concerns like:
Error handling
Token caching
Ability to have different HttpClients and MessageHandlers for different API endpoints.
Error handler should be straightforward to add. The rest go beyond the scope of this question.

Import APIs to Azure API Management (APIM) progrmatically using Microsoft.Azure.Management.ApiManagement

I want to import APIs from swagger/open api specification to Azure Api Management (APIM) using Microsoft.Azure.Management.ApiManagement
it so easy to do it with powershel:
Import-AzApiManagementApi -Context $ApiMgmtContext -SpecificationFormat "Swagger" -SpecificationPath $swaggerOutputFilePath -Path $apiPath -ApiType "Http" -Protocol "Https"
I have a technical need to do it pragmatically with C# using Azure SDK through Microsoft.Azure.Management.ApiManagement
I started from this post:
implement ServiceClientCredentials to retrieve valid token and add it to headers authorization
public class AzureApiManagementServiceCredentials : ServiceClientCredentials
{
private string AuthenticationToken { get; set; }
public override void InitializeServiceClient<T>(ServiceClient<T> client)
{
var authenticationContext = new AuthenticationContext("https://login.windows.net/{tenantID}");
var credential = new ClientCredential(clientId: "xxxxx-xxxx-xx-xxxx-xxx", clientSecret: "{clientSecret}");
var result = authenticationContext.AcquireToken(resource: "https://management.core.windows.net/", clientCredential: credential);
if (result == null)
{
throw new InvalidOperationException("Failed to obtain the JWT token");
}
AuthenticationToken = result.AccessToken;
}
// override ProcessHttpRequestAsync to use the authentication token as an Authorization header:
public override async Task ProcessHttpRequestAsync(HttpRequestMessage request, CancellationToken cancellationToken)
{
if (request == null) throw new ArgumentNullException("request");
if (AuthenticationToken == null) throw new InvalidOperationException("Token Provider Cannot Be Null");
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", AuthenticationToken);
request.Headers.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
await base.ProcessHttpRequestAsync(request, cancellationToken);
}
}
From the other side, I have an AzureApiManagementService class to handle APIs and products:
public async Task<ApiContract> CreateApi(ApimCreateApi apimCreateApi )
{
var serviceCredentials = new AzureApiManagementServiceCredentials();
ApiManagementClient myClient = new ApiManagementClient(serviceCredentials);
//here where I stuck
//I can use myClient.Api.CreateOrUpdateAsync(...)
//but it's going to create just an empty API on APIM
myClient.
...
}
I'm able just to create an API entity, I can not find the right methods to create/import an API from an openApi specification /swagger.
So I'm posting this this to get more ideas and challenge me in this topic!
Thank you!

From APIM perspective import is the same gesture as create new API (same PUT call underneath), so I'd expect this to be exposed on ApimCreateContract, look for format/value properties similar to how REST API is built: https://learn.microsoft.com/en-us/rest/api/apimanagement/2019-12-01/apis/createorupdate

Refit and OAuth authentication in c#, why Http once again

I just found out about the Refit library on GitHub (link: https://github.com/reactiveui/refit) . Besides my first steps in this huge world, I tried to understand why the use of this library comes handy instead of the use of the usual HttpClient when we need to make http calls towards, for example, an API service. By reading around I understood the reason that creating the httpClient by ourselves, setting the headers and other configurations, is too old style and low-level. That's where Refit takes place. I then tried to make one step forward and read about the authentication part. I noticed, according to the github page of the library, that in order to make authentication work, we need to deal again with the HttpClient that we finally managed to get rid off. The example shown on the official page is:
class AuthenticatedHttpClientHandler : HttpClientHandler
{
private readonly Func<Task<string>> getToken;
public AuthenticatedHttpClientHandler(Func<Task<string>> getToken)
{
if (getToken == null) throw new ArgumentNullException("getToken");
this.getToken = getToken;
}
protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
{
// See if the request has an authorize header
var auth = request.Headers.Authorization;
if (auth != null)
{
var token = await getToken().ConfigureAwait(false);
request.Headers.Authorization = new AuthenticationHeaderValue(auth.Scheme, token);
}
return await base.SendAsync(request, cancellationToken).ConfigureAwait(false);
}
}
class LoginViewModel
{
AuthenticationContext context = new AuthenticationContext(...);
private async Task<string> GetToken()
{
// The AcquireTokenAsync call will prompt with a UI if necessary
// Or otherwise silently use a refresh token to return
// a valid access token
var token = await context.AcquireTokenAsync("http://my.service.uri/app", "clientId", new Uri("callback://complete"));
return token;
}
public async void LoginAndCallApi()
{
var api = RestService.For<IMyRestService>(new HttpClient(new AuthenticatedHttpClientHandler(GetToken)) { BaseAddress = new Uri("https://the.end.point/") });
var location = await api.GetLocationOfRebelBase();
}
}
I am wondering what concept am I missing here. The purpose of the library is to use more high level code, setting interfaces that are enough to call an API service. This purpose is achieved before the authentication part because all the Http settings and so on are made on purpose under the hood. But as soon as we step in this field we find again HttpHandlers, HttpRequestMessages and HttpClients losing what's the purpose of the library itself. Can someone explain me please what am I missing in the bigger picture? thanks in advance

I've been trying to figure out authentication myself, here are my own observations in using Refit.
TL;DR: there are alternatives to set the authentication that do not require using the HttpClient, observations 2 and 3 below.
There are at least three way to handle authentication:
1) As noted in the GitHub page, you can pass in an HttpClient with an HttpClientHandler and in the handler set the Authorization header. In terms of why you need to use the handler, I have noticed that Refit will set the Authorization header to whatever value is specified in the attribute before making the HTTP request, if you set the header in the HttpClient prior to creating the Refit instance it will not work, for example this won't work:
[Get("/secretStuff")]
[Headers("Authorization: Bearer")]
Task<Location> GetLocationOfRebelBase();
. . .
var client = new HttpClient() { BaseAddress = new Uri("https://the.end.point/") };
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", someToken);
var api = RestService.For<IMyRestService>(client);
var location = await api.GetLocationOfRebelBase();
The Authorization header will be "Authorization: Bearer", the token will not be there. You need to alter the HttpClient just prior to the HTTP request is made, in the HttpClientHandler (or DelgatingHandler).
2) When creating a new instance of the Refit api client, pass in the base address to RestService.For rather than an HttpClient and specify the AuthorizationHeaderValueGetter, e.g.:
var gitHubApi = RestService.For<IGitHubApi>("https://api.github.com", new RefitSettings {
AuthorizationHeaderValueGetter = () => {
var token = SomeMethodToGetAToken();
Task.FromResult(token);
}
});
3) Pass the token into the api method, e.g.:
[Get("/users/{user}")]
Task<User> GetUser(string user, [Header("Authorization")] string authorization);
This is mentioned in the Refit GitHub page: https://github.com/reactiveui/refit#dynamic-headers.