AWS Cloudfront API 可在浏览器上运行，但来自 .net HttpClient 的 403 错误

Question

我尝试从浏览器访问 API，它正确返回数据。

以下是 Chrome 开发工具 - 网络选项卡的输出

GET /xxxxxxx/api/xxxxxxx/xxxxxxxxxxxxx?referencenumber=AVXD13198802469/1 HTTP/1.1
Host: xxxx.xxxxxxx.xxx
Connection: keep-alive
Cache-Control: max-age=0
sec-ch-ua: " Not A;Brand";v="99", "Chromium";v="96", "Google Chrome";v="96"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-GB,en;q=0.9,en-US;q=0.8,hi;q=0.7,te;q=0.6
Cookie: _ga=GA1.2.324340773.1637687185; _hjSessionUser_1162220=eyJpZCI6IjVjN2Q4ZjZiLTE3NGYtNWRlOS1iN2ZjLWFhMzU3NGJjYmFjNSIsImNyZWF0ZWQiOjE2Mzc2ODcxODUzMzYsImV4aXN0aW5nIjpmYWxzZX0=; OptanonAlertBoxClosed=2021-11-23T17:06:55.324Z; OptanonConsent=isGpcEnabled=0&datestamp=Tue+Nov+23+2021+22%3A37%3A28+GMT%2B0530+(India+Standard+Time)&version=6.18.0&isIABGlobal=false&hosts=&consentId=e2272ab8-8e01-4859-902a-e8e84fbe8b35&interactionCount=1&landingPath=NotLandingPage&groups=C0001%3A1%2CC0003%3A1%2CC0002%3A1%2CC0004%3A1&geolocation=%3B&AwaitingReconsent=false; AWSALB=hSe9Dtqo8cPvWzIyv/lT0nhcCJ822BzrFDng1sT+fBBmde4CPOMbJJpCE3PESkURtsxxEGKsTwlnlN8ybLLed4pVYfE6tDiFKz9WD5fBYeydSBZw/k1tMkG+/2fa; AWSALBCORS=hSe9Dtqo8cPvWzIyv/lT0nhcCJ822BzrFDng1sT+fBBmde4CPOMbJJpCE3PESkURtsxxEGKsTwlnlN8ybLLed4pVYfE6tDiFKz9WD5fBYeydSBZw/k1tMkG+/2fa; dtCookie=v_4_srv_3_sn_2832183B98BD4E50DD4D6456885CECA3_perc_100000_ol_0_mul_1_app-3A86e062a5b6c28a86_1_rcs-3Acss_0

但是当我尝试从 .net 应用程序执行相同的 url 时，会出现 403 错误。我的.net代码如下

public HttpResponseMessage SendRequestPostNew(string destinationMethod, string destinationURL,string requestContent,string TimeoutValue)
        {
            var httpClientHandler = new HttpClientHandler();
            httpClientHandler.ServerCertificateCustomValidationCallback = delegate { return true; };
            httpClientHandler.ServerCertificateCustomValidationCallback = (message, cert, chain, errors) => { return true; };
            HttpClient clientNew = new HttpClient(httpClientHandler);

            try
            {

                using (var newRequest = new HttpRequestMessage(new HttpMethod(destinationMethod), destinationURL))
                {
                    newRequest.Headers.Accept.Clear();
                    newRequest.Headers.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
                    //newRequest.Content = new StringContent(requestContent, Encoding.UTF8, request.ContentType);
                    newRequest.Content = new StringContent(requestContent, Encoding.UTF8, "application/json");

                    ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls13 | SecurityProtocolType.Tls12 | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls;
                    
                    ServicePointManager.ServerCertificateValidationCallback +=(sender, cert, chain, sslPolicyErrors) => { return true; };
                    //System.Net.ServicePointManager.Expect100Continue = false;

                    client.Timeout = TimeSpan.FromSeconds(Convert.ToInt32(TimeoutValue));

                    var response = clientNew.SendAsync(newRequest);
                    {
                        return response.Result;
                    }
                    
                }
            }catch(Exception ex)
            {
                throw ex;
            }
            finally
            {
                clientNew.Dispose();
            }

        }

403 错误

无法满足请求。

错误的请求。目前我们无法连接到此应用程序或网站的服务器。可能存在流量过多或配置错误。请稍后重试，或联系应用程序或网站所有者。

如果您通过 CloudFront 向客户提供内容，您可以通过查看 CloudFront 文档找到故障排除步骤并帮助防止此错误。

由cloudfront (CloudFront)生成请求ID：EXUpjNsCEJfyHq_q0PobrhVpOr1e3EfbH8grxVhVTsz036MSbIrkmg==

问题可能出在哪里？

Answer 1

如果“user-agent”标头不存在或没有意义，CloudFront 可能会阻止请求。 可能还缺少一些标头。尝试与一组标题进行比较：

• 您的浏览器发送的内容
• 您的申请发送的

Answer 2

基本上，解决方案是将

"User-Agent"

标头添加到请求中。

using var request = new HttpRequestMessage(HttpMethod.Get, url);
request.Headers.Add("User-Agent", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36");

您也可以尝试提供

"Accept-Encoding"

，但在阅读内容之前您需要将其解压缩。但看起来最低限度需要在标题中添加

"User-Agent"

。