fix: AuthenticationClient: use a shared static HttpClient instead of one per instance

Author: anthonyreilly

CHANGELOG.md

@@ -3,8 +3,7 @@
 ### 2026-10-06 v6.0.1
 
 * fix: ForceClient, JsonClient and AuthenticationClient no longer dispose an HttpClient passed in by the caller - the caller owns it
-    - AuthenticationClient still disposes the HttpClient it creates when none is passed
-    - ForceClient now disposes the AuthenticationClient it uses internally to log in
+* fix: AuthenticationClient now uses a shared static HttpClient by default, like ForceClient and JsonClient, instead of creating a new HttpClient (and connection pool) per instance - repeated logins no longer leak sockets
 
 ### 2026-10-06 v6.0.0
 

src/NetCoreForce.Client.Tests/DisposeTests.cs

@@ -1,6 +1,7 @@
 using System;
 using System.Net;
 using System.Net.Http;
+using System.Reflection;
 using System.Threading.Tasks;
 using NetCoreForce.Client;
 using Xunit;
@@ -47,6 +48,32 @@ public async Task AuthenticationClientDisposeLeavesCallerHttpClientUsable()
             await AssertHttpClientUsable(httpClient);
         }
 
+        [Fact]
+        public void AuthenticationClientDefaultUsesSharedHttpClient()
+        {
+            // a new HttpClient per instance means a new connection pool per login
+            AuthenticationClient client1 = new AuthenticationClient();
+            AuthenticationClient client2 = new AuthenticationClient();
+
+            HttpClient httpClient1 = GetHttpClient(client1);
+            HttpClient httpClient2 = GetHttpClient(client2);
+
+            Assert.Same(httpClient1, httpClient2);
+
+            client1.Dispose();
+            client2.Dispose();
+
+            // throws ObjectDisposedException if the shared HttpClient was disposed
+            httpClient1.CancelPendingRequests();
+        }
+
+        private static HttpClient GetHttpClient(AuthenticationClient client)
+        {
+            FieldInfo field = typeof(AuthenticationClient).GetField("_httpClient", BindingFlags.NonPublic | BindingFlags.Instance);
+
+            return (HttpClient)field.GetValue(client);
+        }
+
         private static HttpClient CreateHttpClient()
         {
             var mockHandler = new MockHttpClientHandler();

src/NetCoreForce.Client/AuthenticationClient.cs

@@ -23,11 +23,17 @@ public class AuthenticationClient : IDisposable
         private const string UserAgent = "netcoreforce-client";
         private const string IntrospectTokenEndpointUrl = "https://login.salesforce.com/services/oauth2/introspect";
         private const string TokenRequestEndpointUrl = "https://login.salesforce.com/services/oauth2/token";
+        //best practice is to reuse HttpClient - a new instance per login would mean a new connection pool per login
+        private static readonly HttpClient _SharedHttpClient;
         private readonly HttpClient _httpClient;
-        private readonly bool _disposeHttpClient;
+
+        static AuthenticationClient()
+        {
+            _SharedHttpClient = HttpClientFactory.CreateHttpClient();
+        }
 
         /// <summary>
-        /// Initialize the AuthenticationClient with the libary's default Salesforce API version, and default HttpClient
+        /// Initialize the AuthenticationClient with the libary's default Salesforce API version, and the default shared static HttpClient
         /// <para>See the DefaultApiVersion property</para>
         /// </summary>
         public AuthenticationClient() : this(null, null) { }
@@ -36,7 +42,7 @@ public AuthenticationClient() : this(null, null) { }
         /// Initialize the AuthenticationClient with the specified Salesforce API version and/or HttpClient
         /// </summary>
         /// <param name="apiVersion">Target Salesforce API version</param>
-        /// <param name="httpClient">Custom HttpClient (Optional). Not disposed by this client; the caller retains ownership.</param>
+        /// <param name="httpClient">Optional HttpClient object. Defaults to a shared static instance for best performance. Not disposed by this client; the caller retains ownership.</param>
         public AuthenticationClient(string apiVersion = null, HttpClient httpClient = null)
         {
             if (!string.IsNullOrEmpty(apiVersion))
@@ -48,9 +54,8 @@ public AuthenticationClient(string apiVersion = null, HttpClient httpClient = nu
                 ApiVersion = DefaultApiVersion;
             }
 
-            //only dispose the HttpClient if this client created it
-            _disposeHttpClient = httpClient == null;
-            _httpClient = httpClient ?? new HttpClient();
+            //use the instance client when supplied, otherwise use the default shared instance.
+            _httpClient = httpClient ?? _SharedHttpClient;
         }
 
         /// <summary>
@@ -369,15 +374,11 @@ public async Task ClientCredentialsAsync(string clientId, string clientSecret,st
         }
 
         /// <summary>
-        /// Dispose client - only disposes the HttpClient if this client created it.
-        /// <para>A caller-supplied HttpClient is owned by the caller, and is left as-is.</para>
+        /// Dispose client - does not dispose the HttpClient.
+        /// <para>A caller-supplied HttpClient is owned by the caller, and the shared static HttpClient is left as-is.</para>
         /// </summary>
         public void Dispose()
         {
-            if (_disposeHttpClient)
-            {
-                _httpClient.Dispose();
-            }
         }
     }
 }