HttpClient treatment in C# and effect on IDS

[ghost]

• I read and understood how to enable logging

Question / Issue

HttpClient in C# is a disposable object that does not release socket on dispose. This has an effect of opening a new socket for each new HttpClient that is closed only due to inactivity.
We have experienced a delay on token checking that went into 20 seconds because of this issue.

Please consider having HttpClient as static throughout the entire Identity Server or Identity Server can experience port exhaustion. This can be turn into an attack rather quickly as well.

Test: Repeatedly run the relevant code where HttpClient is created and use netstat to check the occupied sockets.