C# 在MVC和Web API中为身份验证传递头中的令牌

将MVC应用程序与Web API集成，Azure用户身份验证使用OWIN完成，希望删除身份验证cookie并在API调用的标头中传递令牌。怎么做？我使用MSAL.cs文件进行Azure AD身份验证。要在api调用头中传递令牌。首先加载MVC应用程序页面，认证后调用WebAPI方法。 我使用以下代码进行azure广告授权

 private async Task OnAuthorizationCodeReceived(AuthorizationCodeReceivedNotification notification)
            {
                // Extract the code from the response notification
                var code = notification.Code;

                string signedInUserID = notification.AuthenticationTicket.Identity.FindFirst(ClaimTypes.NameIdentifier).Value;
                TokenCache userTokenCache = new MSALSessionCache(signedInUserID, notification.OwinContext.Environment["System.Web.HttpContextBase"] as HttpContextBase).GetMsalCacheInstance();
                ConfidentialClientApplication cca = new ConfidentialClientApplication(ClientId, Authority, RedirectUri, new ClientCredential(ClientSecret), userTokenCache, null);
                try
                {
                    AuthenticationResult result = await cca.AcquireTokenByAuthorizationCodeAsync(code, Scopes);
                }
                catch (Exception ex)
                {
                    //TODO: Handle
                    throw;
                }
            }

---

首次使用ASP.Net OpenID Connect OWIN中间件从azure ad登录用户后，如果要调用web api，可以将令牌添加到请求标头：

string userObjectID = ClaimsPrincipal.Current.FindFirst("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier").Value;
string tenantID = ClaimsPrincipal.Current.FindFirst("http://schemas.microsoft.com/identity/claims/tenantid").Value;
string authority = String.Format(CultureInfo.InvariantCulture, Startup.aadInstance, tenantID, string.Empty);
ClientCredential credential = new ClientCredential(Startup.clientSecret);

// Here you ask for a token using the web app's clientId as the scope, since the web app and service share the same clientId.
app = new ConfidentialClientApplication(Startup.clientId, redirectUri, credential, new NaiveSessionCache(userObjectID, this.HttpContext)){};
result = await app.AcquireTokenSilentAsync(new string[] { Startup.clientId });

 HttpClient client = new HttpClient();
 HttpRequestMessage request = new HttpRequestMessage(HttpMethod.Get, serviceUrl + "/api/todolist");
 request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", result.Token);

 HttpResponseMessage response = await client.SendAsync(request);

---

有关更多详细信息，请参阅。

欢迎来到StackOverflow。请提供答案，否则此问题可能会被关闭。请在问题中包括相关详细信息（例如cookie和头名称），以及您迄今为止尝试过的内容。