Is JwtSecurityTokenHandler thread safe

Question

I'm using JwtSecurityTokenHandler to issue tokens in a aspnet core web api app:

JwtSecurityToken token = BuildJwtSecurityToken(...);
public string toks = new JwtSecurityTokenHandler().WriteToken(token);

each time a token is requested and created, a new JwtSecurityTokenHandler is instantiated, can I use a global instance of it and use it for every token generation?

private JwtSecurityTokenHandler handler = new JwtSecurityTokenHandler();
private GenToken(JwtSecurityToken token) => handler.WriteToken(token);

Is there any problems to use like this?

user_567091 · Answer

Docs say instance members for JwtSecurityTokenHandler are not guaranteed to be thread safe.

https://msdn.microsoft.com/en-us/library/system.identitymodel.tokens.jwtsecuritytokenhandler(v=vs.114).aspx

user_162215 · Answer

Most examples I see, such as this one on blog.wille-zone.de, create it separately for each request.

I would not get too clever on this; even if it's currently threadsafe, noone here can commit Microsoft to keeping it that way.

If you do want a commitment from them, you could start by raising an issue at https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet. They can write it into the specification/code/docs.

Is JwtSecurityTokenHandler thread safe

2 Answers