Why doesn't AuthorizationOptions use ConcurrentDictionary - asp.net-core

Question

Recently, I am occasionally facing an error at my AuthorizationPolicyProvider class:
public class AuthorizationPolicyProvider : DefaultAuthorizationPolicyProvider
{
private readonly AuthorizationOptions options;
public AuthorizationPolicyProvider(IOptions<AuthorizationOptions> options)
: base(options)
{
this.options = options.Value;
}
/// this method is supposed to be the place where the error arises
public override async Task<AuthorizationPolicy> GetPolicyAsync(string policyName)
{
AuthorizationPolicy policy = await base.GetPolicyAsync(policyName);
if (policy == null)
{
policy = new AuthorizationPolicyBuilder()
.AddRequirements(new PermissionRequirement(policyName))
.Build();
this.options.AddPolicy(policyName, policy);
}
return policy;
}
}
Here is some of the error stack:
System.NullReferenceException:
at System.Collections.Generic.Dictionary`2.TryInsert (System.Private.CoreLib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
at System.Collections.Generic.Dictionary`2.set_Item (System.Private.CoreLib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e)
at Microsoft.AspNetCore.Authorization.AuthorizationOptions.AddPolicy (Microsoft.AspNetCore.Authorization, Version=3.1.6.0, Culture=neutral, PublicKeyToken=adb9793829ddae60)
.....
Based on the error stack, I have a guess that the error might be caused by multithreads problem of Dictionary, because the implementation of AuthorizationOptions use Dictionary, instead of ConcurrentDictionary:
namespace Microsoft.AspNetCore.Authorization
{
/// <summary>
/// Provides programmatic configuration used by <see cref="IAuthorizationService"/> and <see cref="IAuthorizationPolicyProvider"/>.
/// </summary>
public class AuthorizationOptions
{
// Why dont they use ConcurrentDictionary here
private IDictionary<string, AuthorizationPolicy> PolicyMap { get; } = new Dictionary<string, AuthorizationPolicy>(StringComparer.OrdinalIgnoreCase);
....
public AuthorizationPolicy GetPolicy(string name)
{
if (name == null)
{
throw new ArgumentNullException(nameof(name));
}
return PolicyMap.ContainsKey(name) ? PolicyMap[name] : null;
}
}
}
And I follow the guide of Microsoft in: link and add the custom AuthorizationPolicyProvider as Singleton:
services.AddSingleton<IAuthorizationPolicyProvider, AuthorizationPolicyProvider>();
So do you guys know why dont they use ConcurrentDictionary, is it a bug from Microsoft, or because of my implementation, thank you.

Answer 1

Do it yourself :
public class DynamicAuthorizationPolicyProvider : DefaultAuthorizationPolicyProvider
{
private ConcurrentDictionary<string, AuthorizationPolicy> DynamicPolicyMap { get; } = new ConcurrentDictionary<string, AuthorizationPolicy>(StringComparer.OrdinalIgnoreCase);
public DynamicAuthorizationPolicyProvider(IOptions<AuthorizationOptions> options) : base(options)
{
}
public override async Task<AuthorizationPolicy> GetPolicyAsync(string policyName)
{
AuthorizationPolicy policy = await base.GetPolicyAsync(policyName);
if (policy == null)
{
return DynamicPolicyMap.GetOrAdd(policyName, CreateDynamicPolicy);
}
return policy;
}
private AuthorizationPolicy CreateDynamicPolicy(string policyName)
{
}
}