{"id":98,"date":"2024-02-15T10:28:17","date_gmt":"2024-02-15T18:28:17","guid":{"rendered":"https:\/\/denispavlov.net\/Blog\/?p=98"},"modified":"2024-03-20T07:09:14","modified_gmt":"2024-03-20T14:09:14","slug":"thread-safe-httpservice-with-jwt-refresh","status":"publish","type":"post","link":"https:\/\/denispavlov.net\/Blog\/2024\/02\/15\/thread-safe-httpservice-with-jwt-refresh\/","title":{"rendered":"Thread Safe HttpService With JWT Refresh"},"content":{"rendered":"\n

One of the most common tasks for backend developers is integrating with third party APIs. And most of the time we end up solving the same problems over and over again, like automatically refreshing the auth token, which eventually expires.<\/p>\n\n\n\n

Let’s consider the following scenario. There is a third party API at https:\/\/denispavlov.net<\/code>, which requires authentication. We know that there is a GET \/auth<\/code> endpoint which returns an access token valid for 30 minutes. And we’re interested in a resource GET \/api<\/code>, which requires that token to be sent in request header as Authorization: Bearer {token}<\/code>.<\/p>\n\n\n\n

To refresh the JWT, I never like to rely on token expiration timestamp coming from a third party server, even when it’s available, because it’s not reliable imho (server clocks might be wrong, etc). Instead, I prefer to wait for the first 401 Unauthorized<\/code> response to be my indicator that it’s time for token renewal. Let’s consider the following code to accomplish this scenario.<\/p>\n\n\n\n

using System.Net;\n\npublic class HttpService\n{\n    private const string _authUrl = \"https:\/\/denispavlov.net\/auth\";\n    private readonly HttpClient _client;\n    private readonly string _authHeader = HttpRequestHeader.Authorization.ToString();\n    private static string _jwt = string.Empty;\n\n    public HttpService(HttpClient client)\n    {\n        _client = client;\n\n        SetJwt();\n    }\n\n    private void SetJwt()\n    {\n        using var request = new HttpRequestMessage(HttpMethod.Get, _authUrl);\n        using var response = _client.Send(request);\n        using var stream = response.Content.ReadAsStream();\n        using var reader = new StreamReader(stream);\n        _jwt = reader.ReadToEnd();\n    }\n\n    public async Task<string> GetContentAsync(string url)\n    {\n        var response = await SendAsync(HttpMethod.Get, url);\n\n        if (!response.IsSuccessStatusCode)\n        {\n            SetJwt();\n\n            response = await SendAsync(HttpMethod.Get, url);\n        }\n\n        return await response.Content.ReadAsStringAsync();\n    }\n\n    private async Task<HttpResponseMessage> SendAsync(HttpMethod method, string url)\n    {\n        var request = new HttpRequestMessage(method, url);\n        request.Headers.Add(_authHeader, $\"Bearer {_jwt}\");\n        return await _client.SendAsync(request);\n    }\n}<\/code><\/pre>\n\n\n\n
At the first glance, it looks fine. We inject HttpClient<\/code> using HttpClientFactory<\/code> Typed Client<\/a> pattern, we get the access token and store it in a field. When consumer of this class calls GetContentAsync and first response isn’t successful, refresh access token and retry.<\/p>\n\n\n\n
This solution will work in a single threaded application where requests come in one at a time. Unfortunately, that is not the reality for most production applications, and this code may have some issues when handling many concurrent requests. The problem is that our token refresh method is not thread safe, therefore you may end up with multiple threads trying to refresh the token simultaneously (potentially making extra unnecessary calls to the third party API, or worse, getting throttled because the GET \/auth<\/code> may have request rate limit). Let’s consider a better thread-safe solution.<\/p>\n\n\n\n