OutputCache - Racing condition returns empty response when locking enabled

[FP3ixoto]

Is there an existing issue for this?

• I have searched the existing issues

Describe the bug

When there's a racing condition on OutputCache, with "Locking" enabled, and the first request to hit the OutputCache middleware is cancelled by the client, the middleware resolves the second request to an empty response.

I suspect that the cancelled request ends up caching an empty response and that's the one served on the subsequent requests.

Note that it only happens with the locking feature enabled.

Expected Behavior

The OutputCache middleware should not cache the cancelled request, empty response, and the successful request should return content.

Steps To Reproduce

Minimal repo: https://github.com/FP3ixoto/OutputCacheIssue

Exceptions (if any)

No response

.NET Version

7.0.404; 8.0.100

Anything else?

No response

[mgravell]

Will aim to investigate and resolve this week (well clearly that didn't happen)

[ArkadiyShuvaev]

Is there a workaround for this issue?

[mgravell]

The problem is understood; moving to .NET 10 planning; there are two ways we can resolve this:

1. detect the cancellation condition in such a way that one of the other requests becomes activated (this has a niche edge case where a malicious actor could queue up and cancel a bunch of sequential requests, causing another party to be delayed indefinitely)
2. copy the machinery from HybridCache which tracks all shared consumers, meaning that the down-stream operation is only cancelled if all interested parties cancel

For the risk stated, 2 is a better option, but is much more complicated. But the basic design exists.