Authentication against WebApi using C#

Question

I am making a call to a web api using the below code -

public HttpWebRequest CreateSOAPWebRequest()
            {
                //Making Web Request    
                HttpWebRequest Req = (HttpWebRequest)WebRequest.Create(@"web api url here");

                Req.Proxy = apiWebProxy;
                //SOAPAction    
                Req.Headers.Add(@"SOAPAction:api url here");
                //Content_type    
                Req.ContentType = "text/xml;charset=\"utf-8\"";
                Req.Accept = "text/xml";
                //HTTP method    
                Req.Method = "POST";
                //return HttpWebRequest    
                return Req;
            }  



public void InvokeService(FileRequest fileRequest)
        {            
            //Calling CreateSOAPWebRequest method    
            HttpWebRequest request = CreateSOAPWebRequest();            
            XmlDocument SOAPReqBody = new XmlDocument();
            //SOAP Body Request 
            SOAPReqBody.LoadXml(@"<?xml version=""1.0"" encoding=""utf-8""?>
                                <soap:Envelope xmlns:xsi=""http://www.w3.org/2001/XMLSchema-instance"" xmlns:xsd=""http://www.w3.org/2001/XMLSchema"" xmlns:soap=""http://schemas.xmlsoap.org/soap/envelope/"">
                                  <soap:Body>
                                    <Create xmlns=""web api url here"">
                                      <fileRequest>" + fileRequest+ @"</fileRequest>
                                        </Create>
                                      </soap:Body>
                                    </soap:Envelope>");


            using (Stream stream = request.GetRequestStream())
            {
                SOAPReqBody.Save(stream);
            }

            ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;
            //Geting response from request    
            using (WebResponse response = request.GetResponse())
            {                    
                using (StreamReader rd = new StreamReader(response.GetResponseStream()))
                {
                    //reading stream    
                    var ServiceResult = rd.ReadToEnd();
                    //writting stream result on console    
                    Console.WriteLine(ServiceResult);
                    Console.ReadLine();
                }
            }            
        }  

My code is failing and giving exception at line using (WebResponse response = request.GetResponse())
If I use ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12 I get

'500 - Internal Server Error'

And when I use ServicePointManager.SecurityProtocol = SecurityProtocolType.Ssl3 I get this exception message

“The underlying connection was closed: An unexpected error occurred on a send. Authentication failed because the remote party has closed the transport stream.”

A token was provided by the remote party, which has to be passed in my request object. So, fileRequest object also contains the value for token.

I am unable to understand what I am missing in order to establish the connectivity with the web api and how to get my code working. Please suggest!

TIA

Answer 1

Ok,

'500 - Internal Server Error'

This means "The server got your request, started to process it then something so unexpected happened that it choked and died without giving you any useful information".

Often this means that there's a serious problem on the server side that you have nothing to do with and no control over. Like, for example, their database has run out of disk space or something. Nothing you could do about that.

Alternatively, your message could be so far different from what the server is expecting that it just gets completely confused. Maybe it's expecting some contact information instead of a binary file stream. Maybe it's expecting base64 encoding and you're sending binary. Maybe it's expecting ISO date format and you're sending MM-dd-yyyy - all guesses, but the 500 error can't tell you anything.

Normally if there's something wrong with your request you'd get a 400 style error with a message sugesting what's wrong.

Either way, your quickest route is going to be to contact the people who own the server, send them your message and the response and the timestamp of the request, and ask them what's happening. Probably there's something in the log on the server. Possibly they'll take one look at your request and say "no, format it this other way"

If you can't do that, try finding more example requests on the web, and send one verbatim.

The TLS vs SSL3 thing is pretty much irrelevant.

The TLS1.2 call gets to the server code (and confuses it). This is the good outcome.

The SSL3 call is being discarded by the web server before it reaches any application code. This will probably be because the server admin has said "don't do SSL3", because SSL3 is no longer considered a secure protocol. Don't use it. (This is also a good outcome, TBH, nobody wants to be doing unsafe integration).