将处理程序委托为 Transient 或 Singleton

Question

We are using http client factory and delegating handler to invoke a partner api and process the response. AuthenticationDelegating handler as shown below has a responsibility to get the required token for partner api authentication and provide it part of the api request.

Question - Should i register AuthenticationDelegationHandler as Transient or Singleton if the token expiration is set to 24 hours?

startup.cs

        services.AddTransient<AuthenticationDelegatingHandler>();
        var apiSettings = Configuration.GetSection(nameof(APIParameters)).Get<APIParameters>();
        var apRegistrationParameters = Configuration.GetSection(nameof(AppRegistrationParameters)).Get<AppRegistrationParameters>();

        services.AddHttpClient("ApiSecuredClient", client =>
        {
            client.BaseAddress = new Uri(ApiSettings.BaseUrl);
            client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue(ApiSettings.MediaType));
           
        })
        .AddHttpMessageHandler<AuthenticationDelegatingHandler>().SetHandlerLifetime(TimeSpan.FromMinutes(apRegistrationParameters.LifetimeOfAuthenticationHandlerInMinutes));

httpclient factory

   public virtual async Task<HttpResponseMessage> GetRequestAsync<T>(T req,                                                                            Sales360APIParameters 
 _paramenters) where T : class, IApiBaseRequest
    {
        using (var client = _httpClientFactory.CreateClient("XXXClient"))
        {
            client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue(_paramenters.MediaType));
            var json = JsonConvert.SerializeObject(req);
            var data = new StringContent(json, Encoding.UTF8, _paramenters.MediaType);
            data.Headers.ContentType.Parameters.Add(new NameValueHeaderValue("version", _paramenters.Version));
            HttpResponseMessage Res = await client.PostAsync(_paramenters.API, data);
            return Res;
        }
    }

AuthenticationDelegatingHandler

 public class AuthenticationDelegatingHandler : DelegatingHandler
 {
    private AppRegistrationParameters _appRegistrationInfo;
    private DateTime _tokenExpirationLocalTime;
    private ILogger<AuthenticationDelegatingHandler> _logger;
    public AuthenticationDelegatingHandler(ILogger<AuthenticationDelegatingHandler> logger, IConfiguration config)
    {
        _appRegistrationInfo = config.GetSection(nameof(AppRegistrationParameters)).Get<AppRegistrationParameters>();
        _logger = logger;

    }

    protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
    {
        try
        {
            Task<HttpResponseMessage> response = null;
            if (_tokenExpirationLocalTime != null && _tokenExpirationLocalTime > DateTime.Now.AddSeconds(_appRegistrationInfo.TimeoutRequestInSeconds))
            {
                response = ProcessRequest(request);

                if (response.Result.StatusCode == HttpStatusCode.Unauthorized || response.Result.StatusCode == HttpStatusCode.Forbidden)
                    response = ProcessRequest(request, true);
            }
            else
            {
                response = ProcessRequest(request, true);
            }

            return response.Result;
        }
        catch (Exception ex)
        {
            _logger.LogError("{systemId} - Error Authenticating with App. {errorCode} for " + request.Content, Constants.SystemId, Constants.ErrorCode3100);
            _logger.LogError(ex.Message);
            throw;
        }
    }

Answer 1

Custom delegating handler must always be registered as transient dependencies. All the examples in the Microsoft documentation show that custom delegating handlers must be registered as transient dependencies.

This stackoverflow question and this article explain the reasons behind this.

To summarize: always register your custom delegating handlers with transient lifetime when you are using the ASP.NET core HTTP client factory .

Notice that this guideline has nothing to do with your business logic to handle both the access token and its lifetime. It is a side effect of the way the ASP.NET core HTTP client factory handles the DI scope which uses to resolve dependencies (read the linked article for an in depth explanation).

If you want to take some ideas about how to handle access tokens and their expiration by using a delegating handler, this project can offer you some insights.

Answer 2

The concept of token expired and HttpDelegationHandler is just quite un-relative. One that should stick with HttpRequestMessage and the other should stick with HttpClient .

In short, you're trying to interact with the request, response in the exact time that the request was sent, which possibility can get an unauthorize response. That can be done right, but it's quite complicated.

Instead, why not just consider another approach? Like a background service that run every 30 mins, if your token expire in 3 hour or less, take a new token and store it either on cache or database? I think that just much more clean and easier than the way you're trying to solve the same problem.