Skip to content

Backport to 5.2 — Fix per-request composer leaked into cached endpoint pipeline (#1040)#1042

Merged
mauroservienti merged 2 commits into
release-5.2from
backport-to-5.2
May 12, 2026
Merged

Backport to 5.2 — Fix per-request composer leaked into cached endpoint pipeline (#1040)#1042
mauroservienti merged 2 commits into
release-5.2from
backport-to-5.2

Conversation

@mauroservienti
Copy link
Copy Markdown
Member

dvdstelt and others added 2 commits May 12, 2026 18:34
CompositionEndpointBuilder.Build() builds a fresh `composer` lambda
per request that closes over that request's `argumentsByComponent`.
The first request also builds the endpoint filter pipeline which
closes over that first composer; subsequent requests find
`cachedPipeline` non-null and reuse it, so they re-run the first
request's composer with the first request's bound arguments.

Symptom: every contract-less handler observed the first request's
route values and body. e.g. `GET /existingCart/aaaa` then
`GET /existingCart/bbbb` both saw `orderId == aaaa`; POSTing
different quantities all stored the first quantity.

Fix: stash the per-request composer in `HttpContext.Items` and read
it back from there inside the cached pipeline's innermost delegate.
The pipeline itself stays cached and structural; only the composer
varies per request.

Adds Per_request_arguments_are_not_shared as a regression test:
fires two sequential GETs against an `int id` route and asserts
both responses echo their own id.
@mauroservienti mauroservienti enabled auto-merge (squash) May 12, 2026 16:34
@mauroservienti mauroservienti merged commit ef90649 into release-5.2 May 12, 2026
3 checks passed
@mauroservienti mauroservienti deleted the backport-to-5.2 branch May 12, 2026 16:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants