CookieContainer has no information on thread safety

[russellfoster]

Type of issue

Missing information

Description

Most classes have details on thread-safety, but CookieContainer does not. In the HttpClient guidelines at:

https://learn.microsoft.com/en-us/dotnet/fundamentals/networking/http/httpclient-guidelines

it's stated:

If your app requires cookies, consider disabling automatic cookie handling or avoiding IHttpClientFactory. Pooling the HttpMessageHandler instances results in sharing of CookieContainer objects. Unanticipated CookieContainer object sharing often results in incorrect code.

I can't tell if the "results in incorrect code" is because the CookieContainer is not thread safe or some other reason. If I have two instances of HttpClient using the same CookieContainer (because of IHttpClientFactory) and operating on separate threads, but never accessing the same remote, will this result in a threading issue or "incorrect code"?

"Incorrect code" seems a bit vague as well, how do I determine the source of the "incorrect code"? If a shared HttpClientHandler (because of IHttpClientFactory) can never be used with a CookieContainer in a multiple threaded context, then I think it would be better to point that out directly rather than saying "consider disabling automatic cookie handling".

Page URL

https://learn.microsoft.com/en-us/dotnet/api/system.net.cookiecontainer?view=net-9.0

Content source URL

https://github.com/dotnet/dotnet-api-docs/blob/main/xml/System.Net/CookieContainer.xml

Document Version Independent Id

0ec76522-d0b5-329f-3370-43625633a07d

Article author

@karelz

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/ncl