HttpClient error calling webapi from another webapi - asp.net-web-api2

Question

I have two webapi developed in asp.net core 2.0 and is secured with identityserver4 framework. Both the apis are ssl enabled
I am accessing the webapi using angular2 application.
Everything works fine when i access the webapi individually from the angular application. But when i try to access the another webapi from one webapi, i am getting
System.Net.Http.HttpRequestException: An error occurred while sending the request. ---> System.Net.Http.WinHttpException: A security error occurred
Below is the code i am using in one of the webapi:
var request = CurrentContext.Request;
var authHeader = request.Headers["Authorization"];
var authHeaderVal = AuthenticationHeaderValue.Parse(authHeader);
var client = new System.Net.Http.HttpClient
{
BaseAddress = new Uri($"https://localhost:5001/")
};
client.DefaultRequestHeaders.Accept.Clear();
client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
client.DefaultRequestHeaders.Authorization = authHeaderVal;
var response = await client.GetAsync("api/alerts/1");
if(response.IsSuccessStatusCode)
{
var content = await response.Content.ReadAsStringAsync();
}
else
{
}

Answer 1

It seams like a CORS issue.
CORS stands for Cross-Origin Resource Sharing.
As the name implies you trying to access resources from a different origin, it could be a different domain, protocol or port.
CORS Requests are enforced by your browser on servers that don't have CORS enabled, check MS docs on how to enable CORS on your api.
The CORS rule is not mandatory to be enforced but most browsers enforce it for security issues, hence some developer tools such as PostMan ignore it to make development easier.
Another solution would be to install a plugin to browser that disables the restriction such as this extension if you're using Chrome.

Answer 2

Most likely you are failing SSL verification since you are running on localhost. You can override verification. Also, HttpClient should be static so you should update the code accordingly.
var request = CurrentContext.Request;
var authHeader = request.Headers["Authorization"];
var authHeaderVal = AuthenticationHeaderValue.Parse(authHeader);
using (var httpClientHandler = new HttpClientHandler())
{
httpClientHandler.ServerCertificateCustomValidationCallback = (msg, cert, chain, err) => { return true; };
using (var client = new HttpClient(httpClientHandler)
{
BaseAddress = new Uri($"https://localhost:5001/")
})
{
client.DefaultRequestHeaders.Accept.Clear();
client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
client.DefaultRequestHeaders.Authorization = authHeaderVal;
var response = await client.GetAsync("api/alerts/1");
if(response.IsSuccessStatusCode)
{
var content = await response.Content.ReadAsStringAsync();
}
else
{
//do something
}
}
}