title: Reusing HttpClient in a web app when new authorization header is needed on each request
body: <p>I've read a good deal about how HttpClient instances should be reused as much as possible, perhaps even throughout application lifecycle. For completeness sake, here are a couple of the resources that I'm basing my statements on:</p>
  
  <ul>
  <li><a href="https://stackoverflow.com/questions/15705092/do-httpclient-and-httpclienthandler-have-to-be-disposed">Do HttpClient and HttpClientHandler have to be disposed?</a></li>
  <li><a href="http://aspnetmonsters.com/2016/08/2016-08-27-httpclientwrong/" rel="nofollow noreferrer">You're Using HttpClient Wrong and it is Destabilizing Your Software</a></li>
  <li><a href="https://stackoverflow.com/a/22561368/4544312">What is the overhead of creating a new HttpClient per call in a WebAPI client?</a></li>
  </ul>
  
  <p>I have a couple of questions regarding this:</p>
  
  <ol>
  <li>How do I create an application-scoped instance of HttpClient in ASP.NET MVC to be shared among all requests? Let's assume there is no IoC container in picture, so I can't just bind it in Singleton scope with <em>container-name-here</em> and call it a day. How would I do it "<strong>manually</strong>?"</li>
  <li>Also, the web service I'm interacting with requires a <strong>new authorization token on <em>each</em> request</strong>, so even if come up with a way to do #1 above, how do I supply a new authorization header on every request, so that it doesn't collide with potential multiple concurrent requests (coming from different users and whatnot)? My understanding is that HttpClient is fairly thread-safe itself, when it comes to GetAsync and other methods, but setting DefaultAuthorizationHeaders doesn't seem thread-safe to me, is it?</li>
  <li>How do I keep it unit-testable?</li>
  </ol>
  
  <p>This is how my in-progress code looks like so far (in a somewhat simplified form for brevity here):</p>
  
  <pre><code>public class MyHttpClientWrapper : IDisposable
  {
      private readonly HttpClient _httpClient;
      private readonly TokenManager _tokenManager;
  
      public HttpServiceClient(HttpClient httpClient, TokenManager tokenManager)
      {
          _httpClient = httpClient;
          _tokenManager = tokenManager;
  
          _httpClient.BaseAddress = new Uri("https://someapp/api/");
          _httpClient.DefaultRequestHeaders.Accept.Add(new 
              MediaTypeWithQualityHeaderValue("application/json"));
      }
  
      public string GetDataByQuery(string query)
      {
          _httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(
              "amx", _tokenManager.GetNewAuthorizationCode());
  
          var response = _httpClient.GetAsync(query).Result;
          return response.Content.ReadAsStringAsync().Result;
      }
  
      public void Dispose()
      {
          HttpClient?.Dispose();
      }
  }
  </code></pre>
  
  <p>Side note: I am using dependency injection here, but not necessarily an IoC container (for the reasons irrelevant to this discussion).</p>