The Http Request Factory produces HttpRequestMessage instances that are preconfigured with a bearer access token suitable for the target resource and scopes. If no suitable access token can be resolved, it returns null.

• Create HttpRequestMessage instances for a given request URI and HTTP method.
• Resolve an access token that matches the resource and scopes for the request.
• Attach the resolved access token as a Bearer authorization header.
• Return null when an access token cannot be resolved.

• CreateRequestAsync

Given a request URI, HTTP method, and a set of scopes, the default implementation first delegates scope grouping and ordering to the Scope Sorter. If the provided scopes refer to multiple resources, the request is configured using the access token for the resource associated with the first scope in the list, after sorting. Only scopes associated with that same resource are used when resolving the access token.

Once the relevant scope set has been selected, the factory asks the Token Service for access tokens matching those scopes. If a token is available, the factory creates a new HttpRequestMessage and sets the Authorization header to Bearer <access_token>. If no token is available, the factory does not create a request and returns null.

The default implementation is HttpRequestFactory.

Dependencies:

• Token Service (ITokenService)
• Scope Sorter (IScopeSorter)

Behavior summary:

• Sorts and groups the provided scopes using the Scope Sorter.
• Uses the first resulting scope group to request access tokens from the Token Service.
• Creates and returns an HttpRequestMessage only when an access token is resolved.
• Sets the request Authorization header to Bearer using the resolved token value.

• Callers should handle a null return value, which indicates that no suitable access token was available for the requested scopes.
• When multiple resources are represented in the provided scopes, token selection is driven by the resource associated with the first scope in the sorted scope list.

• Microsoft Learn: HttpRequestMessage class
• IETF RFC 6750: The OAuth 2.0 Authorization Framework: Bearer Token Usage
• MDN Web Docs: Authorization header