[Bug] The default HttpClient factory creates HttpClient objects on each request (but does not use them)

[bgavrilMS]

Library version used

4.74.0

.NET version

all

Scenario

ConfidentialClient - service to service (AcquireTokenForClient)

Is this a new or an existing app?

The app is in production, and I have upgraded to a new version of MSAL

Issue description and reproduction steps

SimpleHttpClientFactory has a bug where it creates HttpClient objects on each request.

            return s_httpClientPool.GetOrAdd("non_mtls", CreateHttpClient());

Actual:

• GetOrAdd is called and both arguments are evaluated. CreateHttpClient() is invoked and returns a new HttpClient
• The inner logic will notice a cache hit, so it will pull the old HttpClient from the cache

Expected:

• Do not call CreateHttpClient() as it is mildly expensive

Note: Because the new HttpClient is never used, the socket exhaustion classical problem of HttpClient will not manifest. The new HttpClient will be garbage collected.

Relevant code snippets

Expected behavior

No response

Identity provider

Microsoft Entra ID (Work and School accounts and Personal Microsoft accounts)

Regression

No response

Solution and workarounds

No response