在创建 HttpClient 的地方访问 HttpClientHandler

Question

我有一项服务请求 URL 并验证服务器 SSL 证书。代码已经在完整的 .NET 框架中使用 HttpWebRequest 顺利运行，但现在我想将其迁移到 HttpClient 和 .NET Core。我可以像这样拿到证书（多篇博文和堆栈溢出答案都推荐这种方法）：

X509Certificate2 cert = null;

var httpClient = new HttpClient(new HttpClientHandler
{
    ServerCertificateCustomValidationCallback = (request, certificate, chain, errors) =>
    {
        cert = certificate;
        return true;
    }
});

httpClient.GetAsync(...);

这里的问题是我不断创建新的HttpClient 实例，不推荐这样做。我想移动到HttpClientFactory，为什么我在我的设置代码中添加以下内容：

services
    .AddHttpClient("sslclient", x =>
    {
        ...
    })
    .ConfigurePrimaryHttpMessageHandler(() => new HttpClientHandler
    {
        ServerCertificateCustomValidationCallback = (request, certificate, chain, errors) =>
        {
            return true;
        }
    });

现在的挑战是代码创建客户端不再有权访问ServerCertificateCustomValidationCallback：

var httpClient = httpClientFactory.CreateClient("sslclient");

有人知道怎么解决吗？

Answer 1

Reddit 的某人suggested 以下解决方案。一旦调用了AddHttpClient，就不能再修改HttpClientHandler。不过可以共享资源：

var certificates= new ConcurrentDictionary<string, X509Certificate2>();
services.AddSingleton(certificates);
services
    .AddHttpClient("sslclient", x =>
    {
        ...
    })
    .ConfigurePrimaryHttpMessageHandler(() => new HttpClientHandler
    {
        ServerCertificateCustomValidationCallback = (request, certificate, chain, errors) =>
        {
            certificates.TryAdd(request.RequestUri.Host, new X509Certificate2(certificate));
            return true;
        }
    });

在发出 HTTP 请求的代码中，您还需要注入 certificates 字典。提出请求后，您可以在字典中查找证书：

var response = await httpClient.GetAsync(url);
if (certificates.ContainsKey(uri.Host))
{
    // Happy days!
}