title: Using multiple HttpClient objects in an ASP.NET Core application
body: <p>What would be the best application design when there are multiple clients (companies) working with ASP.NET Core application and a separate instance of HttpClient with the corresponding client certificate must be maintained in ASP.NET application for each of these companies?</p>
  
  <p>First, some important facts about the application:</p>
  
  <ul>
  <li>It's an ASP.NET Core 3.1 application.</li>
  <li>Each company using this ASP.NET Core application needs first to upload its own client certificate
  during the registration. Certificate and corresponding password are
  stored in the database. Certificate is necessary for communication
  with some external web service which must be notified on behalf of
  the company that some action was performed by the company in the
  mentioned ASP.NET Core application. In other words, for some actions
  company performs in the ASP.NET Core application, some external web
  service must be notified with POST method and corresponding body and
  its response must be processed and returned.</li>
  <li>After registration,
  company can start sending requests to the mentioned ASP.NET Core
  application. This ASP.NET Core application should obtain
  corresponding company certificate from the database, create
  HttpClient object and add certificate to it, prepare request data and call external web service for
  notification. Then response from this external web service should be
  processed and returned as response to the original company request.</li>
  <li>Of course, there can be simultaneous requests coming from different companies, but there can also be simultaneous requests coming for the same company from different company offices - all requests from the same company use the same company client certificate, but request data (body) to notify external web service will always be different.</li>
  </ul>
  
  <p>As far as I know, it's not the best practice to create new HttpClient object for every call to external web service. I have considered HttpClientFactory, but in my case each HttpClient object must contain corresponding client certificate for the company. I know ASP.NET Core supports named HttpClient to maintain separate HttpClient for each company, but AFAIK this named clients can only be created in the Startup class. This won't be sufficient because new company can be registered anytime while ASP.NET app is running, company can upload new certificate while app is running rendering existing named client invalid, etc.</p>
  
  <p>I am considering maintaining a static list containing one HttpClient object for each company. When first request for the company is initiated, new HttpClient is created with the corresponding client certificate and added to this list. For all subsequent requests from the same company (or office) the corresponding HttpClient is obtained from the mentioned static list and reused. Of course, I would have to establish some locking on the company's HttpClient instance so that it does not break in case of simultaneous requests from the same company. One concern I have with this design is that there might be couple of hundred companies and this list of http clients can be quite long.</p>
  
  <p>Do you have any other idea or proposal?</p>