Asana API 403 Response in C#

I am trying to implement a Xamarin app that works with the Asana API.

I have successfully implemented the OAuth as documented in the Asana documentation here... at least I assume it is successful. I get an access token from the token endpoint in an HTTPResponse with HTTP Status "OK".

But then when I turn around and try to make an API call with that same access token, I get a 403 Forbidden error. I tried the same API call in my browser (after logging in to Asana), and it works fine, which leads me to believe that I do have access to the resource, I must have an issue with authorizing the request on my end.

The API call in question is (documented here): https://app.asana.com/api/1.0/workspaces.

My C# code is as follows (abbreviated to relevant parts, and assume that ACCESS_TOKEN contains the access token I got from the token exchange endpoint):

HttpClient client = new HttpClient();
client.BaseAddress = "https://app.asana.com/api/1.0";
client.DefaultRequestHeaders.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", ACCESS_TOKEN);
client.DefaultRequestHeaders.Add("Accept", "application/json");

And then I use this HttpClient (named client) in the following function:

// Returns a list of the Asana workspace names for the logged in user.
private async Task<List<string>> GetWorkspacesAsync()
{
    List<string> namesList = new List<string>();

    // Send the HTTP Request and get a response.
    this.UpdateToken(); // Refreshes the token if needed using the refresh token.
    using (HttpResponseMessage response = await client.GetAsync("/workspaces"))
    {
        // Handle a bad (not ok) response.
        if (response.StatusCode != HttpStatusCode.OK)
        {
            //  !!!THIS KEEPS TRIGGERING WITH response.StatusCode AS 403 Forbidden!!!

            // Set up a stream reader to read the response.
            // This is for TESTING ONLY
            using (StreamReader reader = new StreamReader(await response.Content.ReadAsStreamAsync()))
            {
                // Extract the json object from the response.
                string content = reader.ReadToEnd();
                Debug.WriteLine(content);
            }

            throw new HttpRequestException("Bad HTTP Response was returned.");
        }

        // If execution reaches this point, the Http Response returned with code OK.

        // Set up a stream reader to read the response.
        using (StreamReader reader = new StreamReader(await response.Content.ReadAsStreamAsync()))
        {
            // Extract the json object from the response.
            string content = reader.ReadToEnd();
            JsonValue responseJson = JsonValue.Parse(content);

            foreach (JsonValue workspaceJson in responseJson["data"])
            {
                string workspaceName = workspaceJson["name"];
                Debug.WriteLine("Workspace Name: " + workspaceName);

                namesList.Add(workspaceName);
            }
        }
    }

    // I have other awaited interactions with app storage in here, hence the need for the function to be async.

    return namesList;
}

Solution

Finally found the answer. It looks like I was using HttpClient incorrectly; a subtle thing that should be equivalent, but is not due to the way it is implemented.

The answer

I needed to place the final slash at the end of the BaseAddress property of HttpClient, and NOT at the start of the relative address for the specific request. This answered question explains this.

To fix my code

I needed to change the setting up of the BaseAddress:

HttpClient client = new HttpClient();
client.BaseAddress = "https://app.asana.com/api/1.0/"; // FINAL SLASH NEEDED HERE

And remove the slash from the request's relative address:

// DO NOT put slash before relative address "workspaces" here
using (HttpResponseMessage response = await client.GetAsync("workspaces"))

Why I got the original error

When HttpClient combined the BaseAddress with the relative URI I specified in GetAsync(), it dropped off some of the base address, since the final slash was not included. The resulting address from combining the BaseAddress with the relative URI was a valid URL, but not a valid page/API call in Asana. Asana thus did an automatic redirect to a login page, which, of course, the rest of the API call would be forbidden from there.

How I discovered this

In debugging, I grabbed the access token returned during my app's authorization with Asana. I then recreated the request to the "/workspaces" API myself in Postman, and the request worked as expected. This confirmed that my authorization worked fine, and the issue must be with the specific request rather than the authorization. In debugging I then looked into the HttpResponseMessage, which has a property called RequestMessage, that includes the actual URL the GetAsync() made the request against. I observed the Login URL from Asana, rather than the BaseAddress I specified... which led me to the question/ answer linked above.

Hope this explanation helps anyone who comes across a similar error!