Prevent access to HttpContext throught HttpContextAccessor in TryRefreshAsync

src/Microsoft.Azure.AppConfiguration.AspNetCore/AzureAppConfigurationRefreshMiddleware.cs

@@ -4,6 +4,7 @@
 using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.Configuration.AzureAppConfiguration;
 using System.Collections.Generic;
+using System.Threading;
 using System.Threading.Tasks;
 
 namespace Microsoft.Azure.AppConfiguration.AspNetCore
@@ -24,9 +25,15 @@ public AzureAppConfigurationRefreshMiddleware(RequestDelegate next, IConfigurati
 
         public async Task InvokeAsync(HttpContext context)
         {
-            foreach (var refresher in Refreshers)
+            //
+            // Configuration refresh is meant to execute as an isolated background task.
+            // To prevent access of request-based resources, such as HttpContext, we suppress the execution context within the refresh operation.
+            using (var flowControl = ExecutionContext.SuppressFlow())
             {
-                _ = refresher.TryRefreshAsync();
+                foreach (IConfigurationRefresher refresher in Refreshers)
+                {
+                    _ = Task.Run(() => refresher.TryRefreshAsync());
+                }
             }
 
             // Call the next delegate/middleware in the pipeline

src/Microsoft.Azure.AppConfiguration.Functions.Worker/AzureAppConfigurationRefreshMiddleware.cs

@@ -1,11 +1,11 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 //
-
 using Microsoft.Azure.Functions.Worker;
 using Microsoft.Azure.Functions.Worker.Middleware;
 using Microsoft.Extensions.Configuration.AzureAppConfiguration;
 using System.Collections.Generic;
+using System.Threading;
 using System.Threading.Tasks;
 
 namespace Microsoft.Azure.AppConfiguration.Functions.Worker
@@ -24,9 +24,15 @@ public AzureAppConfigurationRefreshMiddleware(IConfigurationRefresherProvider re
 
         public async Task Invoke(FunctionContext context, FunctionExecutionDelegate next)
         {
-            foreach (IConfigurationRefresher refresher in Refreshers)
+            //
+            // Configuration refresh is meant to execute as an isolated background task.
+            // To prevent access of request-based resources, such as HttpContext, we suppress the execution context within the refresh operation.
+            using (var flowControl = ExecutionContext.SuppressFlow())
             {
-                _ = refresher.TryRefreshAsync();
+                foreach (IConfigurationRefresher refresher in Refreshers)
+                {
+                    _ = Task.Run(() => refresher.TryRefreshAsync());
+                }
             }
 
             await next(context).ConfigureAwait(false);

tests/Tests.AzureAppConfiguration.Functions.Worker/RefreshMiddlewareTests.cs

@@ -6,19 +6,26 @@
 using Microsoft.Azure.Functions.Worker.Middleware;
 using Microsoft.Extensions.Configuration.AzureAppConfiguration;
 using Moq;
+using System;
 using System.Threading;
+using System.Threading.Tasks;
 using Xunit;
 
 namespace Tests.AzureAppConfiguration.Functions.Worker
 {
     public class RefreshMiddlewareTests
     {
         [Fact]
-        public void RefreshMiddlewareTests_MiddlewareConstructorRetrievesIConfigurationRefresher()
+        public async Task RefreshMiddlewareTests_MiddlewareConstructorRetrievesIConfigurationRefresher()
         {
             // Arrange
             var mockRefresher = new Mock<IConfigurationRefresher>(MockBehavior.Strict);
-            mockRefresher.Setup(provider => provider.TryRefreshAsync(It.IsAny<CancellationToken>())).ReturnsAsync(true);
+
+            int callCount = 0;
+
+            mockRefresher.Setup(provider => provider.TryRefreshAsync(It.IsAny<CancellationToken>()))
+                .Callback(() => Interlocked.Increment(ref callCount))
+                .ReturnsAsync(true);
 
             var mockRefresherProvider = new Mock<IConfigurationRefresherProvider>(MockBehavior.Strict);
             mockRefresherProvider.SetupGet(provider => provider.Refreshers).Returns(new IConfigurationRefresher[] { mockRefresher.Object });
@@ -30,16 +37,28 @@ public void RefreshMiddlewareTests_MiddlewareConstructorRetrievesIConfigurationR
             var middleware = new AzureAppConfigurationRefreshMiddleware(mockRefresherProvider.Object);
             _ = middleware.Invoke(mockContext.Object, mockFunctionExecutionDelegate.Object);
 
+            using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(10));
+
+            while (callCount < 1)
+            {
+                await Task.Delay(TimeSpan.FromSeconds(1), cts.Token);
+            }
+
             // Assert
             mockRefresher.Verify(refresher => refresher.TryRefreshAsync(It.IsAny<CancellationToken>()), Times.Once);
         }
 
         [Fact]
-        public void RefreshMiddlewareTests_MiddlewareConstructorRetrievesMultipleIConfigurationRefreshers()
+        public async Task RefreshMiddlewareTests_MiddlewareConstructorRetrievesMultipleIConfigurationRefreshers()
         {
             // Arrange
             var mockRefresher = new Mock<IConfigurationRefresher>(MockBehavior.Strict);
-            mockRefresher.Setup(provider => provider.TryRefreshAsync(It.IsAny<CancellationToken>())).ReturnsAsync(true);
+
+            int callCount = 0;
+
+            mockRefresher.Setup(provider => provider.TryRefreshAsync(It.IsAny<CancellationToken>()))
+                .Callback(() => Interlocked.Increment(ref callCount))
+                .ReturnsAsync(true);
 
             var mockRefresherProvider = new Mock<IConfigurationRefresherProvider>(MockBehavior.Strict);
             mockRefresherProvider.SetupGet(provider => provider.Refreshers).Returns(new IConfigurationRefresher[] { mockRefresher.Object, mockRefresher.Object });
@@ -51,6 +70,13 @@ public void RefreshMiddlewareTests_MiddlewareConstructorRetrievesMultipleIConfig
             var middleware = new AzureAppConfigurationRefreshMiddleware(mockRefresherProvider.Object);
             _ = middleware.Invoke(mockContext.Object, mockFunctionExecutionDelegate.Object);
 
+            using var cts = new CancellationTokenSource(TimeSpan.FromSeconds(10));
+
+            while (callCount < 2)
+            {
+                await Task.Delay(TimeSpan.FromSeconds(1), cts.Token);
+            }
+
             // Assert
             mockRefresher.Verify(refresher => refresher.TryRefreshAsync(It.IsAny<CancellationToken>()), Times.Exactly(2));
         }