title: Can data stored in CallContext leak between requests?
body: <p>In an MVC app I need to store some user data to verify if he has all the rights to access some pages (like he is an owner of an object etc.). I experimented with adding a private static field to one of my services for handling user data and adding a static, get-only property for accessing the private field. This property pulls user data from the database if the private field is null. Obviously that's a bad idea, because an MVC app does not live only during requests, so once the private static field was set, it would stayed there indefinitely.</p>
  
  <p>A search for an alternative to the above solution, led me to ThreadStatic attribute. Which seemed to work fine (at least on the first glance). But then I read more about the attribute and found out that one request can be actually handled by multiple threads (in my case that wasn't particularly a problem) and that some threads can be reused in several requests (extreme, but apparently rare case). Now this sounded like a real problem, it would mean that the user data I once pulled from the database, could possibly leak to another request and one user could be verified based on data of another.</p>
  
  <p>So I searched for yet another alternative and found CallContext. This time I also noticed that people gave warnings that it will probably not work the way one would expect it to. In case of ThreadStatic poeple explaind what are the risks of using it, but in case of CallContext not so much.</p>
  
  <p>So, can data stored in CallContext leak from one request to another (like it can happen with ThreadStatic fields) or the worst that can happen is loss of the data in the middle of a request (I can live with that)?</p>