Fix threading issue in HttpClientManager

src/Microsoft.Identity.Client/AppConfig/IMsalHttpClientFactory.cs

@@ -30,8 +30,13 @@
 namespace Microsoft.Identity.Client
 {
     /// <summary>
-    /// Http Client Factory
+    /// Factory responsible for creating HttpClient
+    /// .Net recommends to use a single instance of HttpClient
     /// </summary>
+    /// <remarks>
+    /// Implementations must be thread safe. Consider creating and configuring an HttpClient in the constructor
+    /// of the factory, and returning the same object in <see cref="GetHttpClient"/>
+    /// </remarks>
     public interface IMsalHttpClientFactory
     {
         /// <summary>

src/Microsoft.Identity.Client/Http/HttpManager.cs

@@ -37,6 +37,14 @@
 
 namespace Microsoft.Identity.Client.Http
 {
+    /// <remarks>
+    /// We invoke this class from different threads and they all use the same HttpClient. 
+    /// To prevent race conditions, make sure you do not get / set anything on HttpClient itself,
+    /// instead rely on HttpRequest objects which are thread specific.
+    ///
+    /// In particular, do not change any properties on HttpClient such as BaseAddress, buffer sizes and Timeout. You should
+    /// also not access DefaultRequestHeaders because the getters are not thread safe (use HttpRequestMessage.Headers instead). 
+    /// </remarks>
     internal class HttpManager : IHttpManager
     {
         private readonly IMsalHttpClientFactory _httpClientFactory;
@@ -210,7 +218,7 @@ private async Task<HttpResponse> ExecuteAsync(
                     await client.SendAsync(requestMessage).ConfigureAwait(false))
                 {
                     HttpResponse returnValue = await CreateResponseAsync(responseMessage).ConfigureAwait(false);
-                    returnValue.UserAgent = client.DefaultRequestHeaders.UserAgent.ToString();
+                    returnValue.UserAgent = requestMessage.Headers.UserAgent.ToString();
                     return returnValue;
                 }
             }