Is it safe to use HttpClientFactory?

Question

In my asp.net core MVC application, I'm using HttpClientFactory to create HttpClient object for requests to API server.

Follows Microsoft document, HttpClient object is created new for each time I call HttpClientFactory.CreateClient(), so it will be safe for setting values to HttpClient.DefaultRequestHeaders.

About HttpMessageHandler objects, because they are pooled and can be re-used later. So, if they hold cookies information (For example: setting cookies to HttpClientHandler object), we will violate thread-safe.

Is my assumption is correct? How could we deal with this problem?

Is it OK if we set cookie in HttpRequestMessage, then we will send it with HttpClient?

Answer 1

I have found the solution to use HttpClientFactory. We should disable CookieContainer of primary HttpMessageHanlder (it's a HttpClientHandler):

services.AddHttpClient("configured-inner-handler")
.ConfigurePrimaryHttpMessageHandler(() =>
{
    return new HttpClientHandler()
    {
        UseCookies = false
    };
});