Issue tokens concurrently with synchronization per client I have an API application with token authorization. A token is valid for one hour. Each business client has its own instance of the API application:


{"client_1": "http://localhost:1"},
...
{"client_n": "http://localhost:n"}



In another application I have a class ApiService to make HTTP requests to the API. I create one instance of ApiService. Requests happen concurrently and I want to be sure that for each client token will be issued only once. I use Flurl to make HTTP requests.

public class TokenDetails
{
    public string Token { get; set; }
    public DateTime Expires { get; set; }
}

public class ClientDetails
{
    public string ClientId { get; set; }
    public string BaseAddress { get; set; }
    public string Username { get; set; }
    public string Password { get; set; }
}

public class ClientService
{
    private readonly ConcurrentDictionary&lt;string, Task&lt;TokenDetails&gt;&gt; _tokens =
        new ConcurrentDictionary&lt;string, Task&lt;TokenDetails&gt;&gt;();

    private readonly ConcurrentDictionary&lt;string, object&gt; _locks =
        new ConcurrentDictionary&lt;string, object&gt;();

    public async Task&lt;string&gt; GetDataAsync(ClientDetails client)
    {
        var token = await GetTokenAsync(client).ConfigureAwait(false);

        return await new Url(client.BaseAddress).AppendPathSegment("/data")
            .WithOAuthBearerToken(token.Token)
            .GetStringAsync().ConfigureAwait(false);
    }

    private Task&lt;TokenDetails&gt; GetTokenAsync(ClientDetails client)
    {
        //try find valid token task
        if (!_tokens.TryGetValue(client.ClientId, out var tokenTask) 
            || tokenTask.IsFaulted 
            || tokenTask.IsCanceled 
            || (tokenTask.IsCompleted &amp;&amp; tokenTask.Result.Expires &lt; DateTime.UtcNow))
        {
            //token task not found or token is expired - enter lock to make http call
            var lockObject = _locks.GetOrAdd(client.ClientId, id =&gt; new object());
            lock (lockObject)
            {
                //try find valid token task again after aquiring lock
                if (!_tokens.TryGetValue(client.ClientId, out tokenTask) 
                    || tokenTask.IsFaulted 
                    || tokenTask.IsCanceled 
                    || (tokenTask.IsCompleted &amp;&amp; tokenTask.Result.Expires &lt; DateTime.UtcNow))
                {
                    //http call
                    tokenTask = new Url(client.BaseAddress).AppendPathSegment("/login")
                        .WithBasicAuth(client.Username, client.Password)
                        .GetJsonAsync&lt;TokenDetails&gt;();
                    _tokens.AddOrUpdate(client.ClientId, key =&gt; tokenTask, (key, oldToken) =&gt; tokenTask);
                }

            }
        }

        return tokenTask;
    }
}
The pattern looks correct. One disadvantage here is you're blocking threads waiting for the lock. You could instead use a SemaphoreSlim and its WaitAsync method for a nonblocking lock.

Even better, have a look at LazyCache. (Scott Hanselman blogged about this recently.) It basically does all of this for you - caching, asynchronous double-check locking, and guaranteeing refresh only happens once. You could replace most of what you've done here with a GetTokenAsync implementation that looks something like this:

return await _tokenCache.GetOrAddAsync(
    $"tokens-{client.ClientId}",
    () =&gt; client.BaseAddress
        .AppendPathSegment("/login")
        .WithBasicAuth(client.Username, client.Password)
        .GetJsonAsync&lt;TokenDetails&gt;(),
    TimeSpan.FromHours(1));


One little caveat here is you need to know ahead of time how long to cache the token, i.e. you can't use the Expires value returned from the server. But in your case it sounds like you know it's an hour, so hopefully that's a non-issue.