Merge pull request #164 from ovska/fix-nonawaited-task

Fix unawaited task in UpdateClientAssertion event

Author: josephdecock

src/OAuth2IntrospectionHandler.cs

@@ -178,7 +178,7 @@ private static async Task<TokenIntrospectionResponse> LoadClaimsForToken(
 	        OAuth2IntrospectionOptions options)
         {
             var introspectionClient = await options.IntrospectionClient.Value.ConfigureAwait(false);
-            using var request = CreateTokenIntrospectionRequest(token, context, scheme, events, options);
+            using var request = await CreateTokenIntrospectionRequest(token, context, scheme, events, options);
 
             var requestSendingContext = new SendingRequestContext(context, scheme, options)
             {
@@ -190,7 +190,7 @@ private static async Task<TokenIntrospectionResponse> LoadClaimsForToken(
             return await introspectionClient.IntrospectTokenAsync(request).ConfigureAwait(false);
         }
 
-        private static TokenIntrospectionRequest CreateTokenIntrospectionRequest(
+        private static async ValueTask<TokenIntrospectionRequest> CreateTokenIntrospectionRequest(
 	        string token,
 	        HttpContext context,
 	        AuthenticationScheme scheme,
@@ -199,7 +199,9 @@ private static TokenIntrospectionRequest CreateTokenIntrospectionRequest(
         {
             if (options.ClientSecret == null && options.ClientAssertionExpirationTime <= DateTime.UtcNow)
             {
-                lock (options.AssertionUpdateLockObj)
+                await options.AssertionUpdateLock.WaitAsync();
+
+                try
                 {
                     if (options.ClientAssertionExpirationTime <= DateTime.UtcNow)
                     {
@@ -208,13 +210,17 @@ private static TokenIntrospectionRequest CreateTokenIntrospectionRequest(
                             ClientAssertion = options.ClientAssertion ?? new ClientAssertion()
                         };
 
-                        events.UpdateClientAssertion(updateClientAssertionContext);
+                        await events.UpdateClientAssertion(updateClientAssertionContext);
 
                         options.ClientAssertion = updateClientAssertionContext.ClientAssertion;
                         options.ClientAssertionExpirationTime =
                             updateClientAssertionContext.ClientAssertionExpirationTime;
                     }
                 }
+                finally
+                {
+                    options.AssertionUpdateLock.Release();
+                }
             }
 
             return new TokenIntrospectionRequest

src/OAuth2IntrospectionOptions.cs

@@ -7,6 +7,7 @@
 using Microsoft.AspNetCore.Http;
 using System;
 using System.Net.Http;
+using System.Threading;
 
 namespace IdentityModel.AspNetCore.OAuth2Introspection
 {
@@ -45,7 +46,7 @@ public OAuth2IntrospectionOptions()
         /// </summary>
         public string ClientSecret { get; set; }
 
-        internal object AssertionUpdateLockObj = new object();
+        internal readonly SemaphoreSlim AssertionUpdateLock = new SemaphoreSlim(1, 1);
 
         internal ClientAssertion ClientAssertion { get; set; }