Skip to content

HCR002.md

Latest commit

 

History

History
49 lines (32 loc) · 2.95 KB

HCR002.md

File metadata and controls

49 lines (32 loc) · 2.95 KB
Raw

HCR002

Long-lived manual HttpClient should configure PooledConnectionLifetime.

Why

A static or otherwise long-lived manual HttpClient can keep connections alive longer than DNS changes or infrastructure rotation. Configure SocketsHttpHandler.PooledConnectionLifetime when manually owning the client.

Bad

private static readonly HttpClient Client = new();
services.AddSingleton<GitHubClient>();

public sealed class GitHubClient
{
    private readonly HttpClient _client = new();
}

Better

private static readonly HttpClient Client = new(
    new SocketsHttpHandler
    {
        PooledConnectionLifetime = TimeSpan.FromMinutes(2)
    });

Current Detection

The implementation reports static HttpClient fields/properties and instance HttpClient fields/properties on known singleton services when they are initialized or assigned with a default handler. This includes direct new HttpClient(...) assignments and simple local handoffs such as var client = new HttpClient(); Client = client; when the local has not been reassigned before the long-lived assignment. Known singleton services include AddSingleton<TService>(), AddSingleton<TService, TImplementation>(), AddSingleton(typeof(TService), ...), and visible singleton factory registrations that directly construct an implementation with new Implementation(...). Resolved custom types named HttpClient or SocketsHttpHandler are skipped. Qualified singleton registrations are matched against the declared containing type namespace so same-named services in other namespaces are skipped. It does not report ordinary instance members, clients initialized or assigned with a SocketsHttpHandler object initializer that sets PooledConnectionLifetime, or clients initialized from a visible local, field, or property handler whose initializer sets PooledConnectionLifetime. Local handler variables are also treated as configured when handler.PooledConnectionLifetime = ... is assigned before the HttpClient is created and the handler local is not reassigned before that use.

Code Fix

For simple parameterless field HttpClient initializers, the code fix replaces the default initializer with a SocketsHttpHandler configured with PooledConnectionLifetime = System.TimeSpan.FromMinutes(2). When the client already receives a handler argument, or when the diagnostic is on an assignment/property shape, the analyzer reports the issue but does not offer an automatic rewrite because preserving member and handler configuration requires manual review.

Suppression

Suppress only when DNS rotation is impossible or the handler lifetime is managed elsewhere and the analyzer cannot see it.

References