title: Creating a proxy to another web api with Asp.net core
body: <p>I'm developing an ASP.Net Core web application where I need to create a kind of "authentication proxy" to another (external) web service.</p>
  
  <p>What I mean by authentication proxy is that I will receive requests through a specific path of my web app and will have to check the headers of those requests for an authentication token that I'll have issued earlier, and then redirect all the requests with the same request string / content to an external web API which my app will authenticate with through HTTP Basic auth.</p>
  
  <p>Here's the whole process in pseudo-code</p>
  
  <ul>
  <li>Client requests a token by making a POST to a unique URL that I sent him earlier</li>
  <li>My app sends him a unique token in response to this POST</li>
  <li>Client makes a GET request to a specific URL of my app, say <code>/extapi</code> and adds the auth-token in the HTTP header</li>
  <li>My app gets the request, checks that the auth-token is present and valid</li>
  <li>My app does the same request to the external web API and authenticates the request using BASIC authentication</li>
  <li>My app receives the result from the request and sends it back to the client</li>
  </ul>
  
  <p>Here's what I have for now. It seems to be working fine, but I'm wondering if it's really the way this should be done or if there isn't a more elegant or better solution to this? Could that solution create issues in the long run for scaling the application?</p>
  
  <pre><code>[HttpGet]
  public async Task GetStatement()
  {
      //TODO check for token presence and reject if issue
  
      var queryString = Request.QueryString;
      var response = await _httpClient.GetAsync(queryString.Value);
      var content = await response.Content.ReadAsStringAsync();
  
      Response.StatusCode = (int)response.StatusCode;
      Response.ContentType = response.Content.Headers.ContentType.ToString();
      Response.ContentLength = response.Content.Headers.ContentLength;
  
      await Response.WriteAsync(content);
  }
  
  [HttpPost]
  public async Task PostStatement()
  {
      using (var streamContent = new StreamContent(Request.Body))
      {
          //TODO check for token presence and reject if issue
  
          var response = await _httpClient.PostAsync(string.Empty, streamContent);
          var content = await response.Content.ReadAsStringAsync();
  
          Response.StatusCode = (int)response.StatusCode;
  
          Response.ContentType = response.Content.Headers.ContentType?.ToString();
          Response.ContentLength = response.Content.Headers.ContentLength;
  
          await Response.WriteAsync(content);
      }
  }
  </code></pre>
  
  <p><code>_httpClient</code> being a <code>HttpClient</code> class instantiated somewhere else and being a singleton and with a <code>BaseAddress</code>of <code>http://someexternalapp.com/api/</code></p>
  
  <p>Also, is there a simpler approach for the token creation / token check than doing it manually?</p>