Disposal of HttpClient instances in OidcClient

[steve85]

I'm using the Duende.IdentityModel.OidcClient v6.0.1 package in a solution I'm working on and have seen some issues on my local machine that would indicate http socket exhaustion when executing the solution.

After reading the stack traces and looking through the code, I noticed that instaces of HttpClient created within OidcClient and also AuthorizeClient are not being disposed after use.

Is this something I can push a PR for?

[wcabus]

Do you happen to have a repo we can look at to reproduce the exhaustion issue locally?

In the mean time, there is a way you can configure the OidcClientOptions to use a custom HttpClientFactory expression to share an HttpClient instance, which is probably fine in most scenario's.

While we would welcome a PR, HttpClient has been known to cause a variety of issues related to lifetime management. In general, our advice to solve this is to configure a custom HttpClientFactory as mentioned earlier.

[steve85]

I don't have a reproducible example that I can share unfortunately, but basically I am using this library in conjunction with Playwright to to automatically prepare and login to our SSO provdider as part of our automated testing suite for our end-to-end application testing solution.

After reading your response and the assoicated links I realised what I proposed is not the ideal solution in this case. I will update our code to pass in IHttpClientFactory via the options as this looks like the best approach here.

Appreciate the quick response on this.