Monday, 13 October 2025

Yr weather service with Model Context Protocol

I have added a GitHub repo that uses the Model Context Protocol to query the Yr Weather service. - Overall goal of the DEMO : Provide a natural language interface using LLM (Claude) to query the Yr Weather service, which provides world-wide weather forecast services. Yr Weather is property of Norwegian Meteorological Institute in Oslo, Norway.

GitHub repo


The GitHub repo is here: https://github.com/toreaurstadboss/WeatherMCPDemo

Model Context Protocol

You can read more about the Model Context Protocol (MCP) here : https://modelcontextprotocol.io/docs/getting-started/intro In short, MCP allows you to connect AI applications such as a Large Language Model (LLM) to external systems, such as external APIs.

WeatherServer.Web.Http - Http-based serverside

First off, the following Nuget libs are added to the serverside.
WeatherServer.Web.Http.csproj

	<ItemGroup>
		<PackageReference Include="ModelContextProtocol.AspNetCore" Version="0.3.0-preview.2" />
		<PackageReference Include="Swashbuckle.AspNetCore" Version="9.0.6" />
		<PackageReference Include="Swashbuckle.AspNetCore.SwaggerUI" Version="9.0.6" />
		<PackageReference Include="ModelContextProtocol" Version="0.3.0-preview.2" />
		<PackageReference Include="Anthropic.SDK" Version="5.5.1" />
		<PackageReference Include="Microsoft.Extensions.AI" Version="9.9.0" />
		<PackageReference Include="Microsoft.Extensions.Hosting" Version="10.0.0-preview.6.25358.103" />
	</ItemGroup>


Note that the Anthropic SDK is used to chat with the Claude LLM. This is another LLM, such as Chat GPT. Anthropic is a good choice since MCP libraries are also provided by Anthropic corporation. The following code shows how we set up the MCP server with HttpTransport and also define which tools to support. We will focus on the Nominatim Tools and Yr Tools in this article. I have also added another set of tools of US weather forecast and weather alerts, but that will be presented in a later article, showing also how you can use STDIO as means of communications between client/server instead of HTTP. Lets first look at the startup file, Program.cs.

Program.cs


using Anthropic.SDK;
using Microsoft.Extensions.AI;
using System.Net.Http.Headers;
using WeatherServer.Common;
using WeatherServer.Tools;

namespace WeatherServer.Http
{
    public class Program
    {
        public static void Main(string[] args)
        {
            var builder = WebApplication.CreateBuilder(args);

            // Add services to the container.

            // Add MCP support
            builder.Services
                .AddMcpServer()
                .WithHttpTransport()
                .WithTools<YrTools>()
                .WithTools<UnitedStatesWeatherTools>()
                .WithTools<NominatimTools>();

            //Add swagger support
            builder.Services.AddControllers();
            builder.Services.AddEndpointsApiExplorer();
            builder.Services.AddSwaggerGen();

            // Configure logging
            builder.Logging.ClearProviders();
            builder.Logging.AddConsole(options =>
            {
                options.LogToStandardErrorThreshold = LogLevel.Warning;
            });
            builder.Logging.SetMinimumLevel(LogLevel.Debug);

            // Add named Http clients that fetches more data from external APIs

            builder.Services.AddHttpClient(WeatherServerApiClientNames.WeatherGovApiClientName, client =>
            {
                client.BaseAddress = new Uri("https://api.weather.gov");
                client.DefaultRequestHeaders.UserAgent.Add(new ProductInfoHeaderValue("us-weather-democlient2-tool", "1.0"));
            });

            builder.Services.AddHttpClient(WeatherServerApiClientNames.YrApiClientName, client =>
            {
                client.BaseAddress = new Uri("https://api.met.no");
                client.DefaultRequestHeaders.UserAgent.Clear();
                client.DefaultRequestHeaders.UserAgent.Add(new ProductInfoHeaderValue("yrweather-mcpdemoclient2-tore-tool", "1.0"));
                //client.DefaultRequestHeaders.UserAgent.ParseAdd("ToresMcpDemo/1.0 (+https://github.com/toreaurstadboss)");
            });

            builder.Services.AddHttpClient(WeatherServerApiClientNames.OpenStreetmapApiClientName, client =>
            {
                client.BaseAddress = new Uri("https://nominatim.openstreetmap.org");
                client.DefaultRequestHeaders.UserAgent.Clear();
                client.DefaultRequestHeaders.UserAgent.Add(new ProductInfoHeaderValue("nominatim-openstreetmap-client2-api-tool", "1.0"));
            });

            // Set up Anthropic client

            builder.Services.AddChatClient(_ =>
                new ChatClientBuilder(new AnthropicClient(new APIAuthentication(builder.Configuration["ANTHROPIC_API_KEY"])).Messages)
                    .UseFunctionInvocation()
                    .Build());

            var app = builder.Build();

            // Configure the HTTP request pipeline.

            app.UseHttpsRedirection();

            app.UseAuthorization();

            app.MapControllers();

            app.UseSwagger();
            app.UseSwaggerUI();

            app.MapMcp("/sse"); // This exposes the SSE endpoint at /sse

            app.Run();
        }
    }
}


As noted, the ANTHROPIC_API_KEY is set up in a User Secet. You must create an account on Anthropic website and set up an API key. You can check the API key setup from here:

https://console.anthropic.com/dashboard

Also, per API a named HTTP client is setup and note the setting of the User-Agent HTTP request headers. Most APIs demand you set this to a unique request header value and will for example do not return any useful data if this user agent header is not set to a somewhat proper value, do not reuse other systems user agent header values for example. A closer look at the MCP tools for the Nominatim tool is shown next. The Nominatim API is an OpenStreetMap API that provides latitude and longitude. We will use this API to look up provided location names such as a city to look up a given latitude and longitude pair values. Yr Weather forecast service demands latititude and longitude. For now, the code assumes just latitude and longitude, specifying altitude is skipped. It is expected that Yr provides the weather at ground-level, so specifying altitude is not done.

NominatimTools.cs


namespace WeatherServer.Tools;

using System.ComponentModel;
using ModelContextProtocol.Server;
using WeatherServer.Common;

[McpServerToolType]
public sealed class NominatimTools
{

    public string ToolId => "OpenStreetMap Nominatim tool";

    [McpServerTool(Name = "NominatimLookupLatLongForPlace"), Description("Get latitude and longitude for a place using Nominatim service of OpenStreetMap.")]
    public static async Task<string> GetLatitudeAndLongitude(
        IHttpClientFactory clientFactory,
        [Description("The place to get latitude and longitude for. Will use Nominatim service of OpenStreetMap")] string place)
    {
        var client = clientFactory.CreateClient(WeatherServerApiClientNames.OpenStreetmapApiClientName);

        using var jsonDocument = await client.ReadJsonDocumentAsync($"/search?q={Uri.EscapeDataString(place)}&format=geojson&limit=1");
        var features = jsonDocument.RootElement.GetProperty("features").EnumerateArray();

        if (!features.Any())
        {
            return $"No location data found for '{place}'. Try another place to query?";
        }

        var feature = features.First();

        var geometry = feature.GetProperty("geometry");

        var geometryType = geometry.GetProperty("type").GetString();

        if (string.Equals(geometryType, "point", StringComparison.OrdinalIgnoreCase))
        {
            var pointCoordinates = geometry.GetProperty("coordinates").EnumerateArray();
            if (pointCoordinates.Any())
            {
                return $"Latitude: {pointCoordinates.ElementAt(0)}, Longitude: {pointCoordinates.ElementAt(1)}";
            }
        }

        return $"No location data found for '{place}'. Try another place to query?";
    }

}
             

Pay notice to the use of the [McpServerTool] attribute and also the description attribute value. You can in written english provide instructions and even user stories here that MCP library will utilize. This is shown in the next tool, which will use the NominatimTool tool to look up the latitude. You can make a tool call another tool with MCP, which is practical in some cases.
YtTools.cs


namespace WeatherServer.Tools;

using Microsoft.Extensions.Logging;
using ModelContextProtocol.Server;
using System;
using System.ComponentModel;
using System.ComponentModel.DataAnnotations;
using System.Diagnostics;
using System.Globalization;
using System.Text;
using System.Text.Json;
using WeatherServer.Common;
using WeatherServer.Models;

[McpServerToolType]
public sealed class YrTools
{
    public string ToolId => "Yr tool";

    [McpServerTool(Name = "YrWeatherCurrentWeather")]
    [Description(
 $@"""
     Description of this tool method:
     Retrieves the current weather conditions for a specified location using the YrTools CurrentWeather API.

    Usage Instructions:
    1. Use the 'NominatimLookupLatLongForPlace' tool to resolve the latitude and longitude of the provided location.
    2. Pass the resolved coordinates from the tool above and pass them into to this method.
    3. If coordinates cannot be resolved, use latitude = 0 and longitude = 0. In this case, the method will return a message indicating no results were found.
    4. In case the place passed in is for a place in United States, use instead the tool 'UsWeatherForecastLocation'.
    5. This method is to be used when asked about the current weather right now. 
    6. Use the system clock to check the date of today.

    Response Requirements:
    - It is very important that the corret url is used, longitude and latitude here will be provided . $""weatherapi/locationforecast/2.0/compact?lat={{latitude}}&lon={{longitude}}""
    - Always include the latitude and longitude used.
    - Always inform about which url was used to get the data here.
    - Inform about the time when the weather is.
    - Always include the 'time' field from the result to indicate when the weather data is valid.
    - Clearly state that the data was retrieved using 'YrWeatherCurrentWeather'.
    - Do not modify or reformat the result; return it exactly as received.
    - Do not show the data in Json format, instead sum it up using a dashed list.
    - Inform the time the weather is for
    - Append the raw json data also
    - If the weather time has passed current time by say two days, inform that you could not retrieve weather conditions for now. Look at the 'time' value you got and compare it with today. This is probably due to API usage conditions are limits the service.
""")]
    public static async Task<string> GetCurrentWeatherForecast(
        IHttpClientFactory clientFactory,
        ILogger<YrTools> logger,
        [Description("Provide current weather. State the location, latitude and longitude used. Return precisely the data given. Return ALL the data you were given.")] string location, decimal latitude, decimal longitude)
    {
        if (latitude == 0 && longitude == 0)
        {
            return $"No current weather data found for '{location}'. Try another location to query?";
        }
        


        var client = clientFactory.CreateClient(WeatherServerApiClientNames.YrApiClientName);

        string url = $"weatherapi/locationforecast/2.0/compact?lat={latitude.ToString(CultureInfo.InvariantCulture)}&lon={longitude.ToString(CultureInfo.InvariantCulture)}";
        
        logger.LogWarning($"Accessing Yr Current Weather with url: {url} with client base address {client.BaseAddress}");

        using var jsonDocument = await client.ReadJsonDocumentAsync(url);
        var timeseries = jsonDocument.RootElement.GetProperty("properties").GetProperty("timeseries").EnumerateArray();

        if (!timeseries.Any())
        {
            return $"No current weather data found for '{location}'. Try another place to query?";
        }

        var currentWeatherInfos = GetInformationForTimeSeries(timeseries, onlyFirst: true);

        var sb = new StringBuilder();
        foreach (var info in currentWeatherInfos)
        {
            sb.AppendLine(info.ToString());
        }

        return sb.ToString();
    }

    [McpServerTool(Name = "YrWeatherTenDayForecast")]
    [Description(
$@"""
     Description of this tool method:
     Retrieves the ten days forecast weather for a specified location using the YrTools Forecast API.

    Usage Instructions:
    1. Use the 'NominatimLookupLatLongForPlace' tool to resolve the latitude and longitude of the provided location.
    2. Pass the resolved coordinates from the tool above and pass them into to this method.
    3. If coordinates cannot be resolved, use latitude = 0 and longitude = 0. In this case, the method will return a message indicating no results were found.
    4. In case the place passed in is for a place in United States, use instead the tool 'UsWeatherForecastLocation'.
    5. Usually, only ten days forecast will be available, but output all data you get here. In case you are asked to provide even further into the future weather information and
    there are no available data for that, inform about that in the output.
    6. In case asked for a forecast weather, use this method. In case asked about current weather, use instead tool 'YrWeatherCurrentWeather'
    7. Check the current day with the system clock. Forecast should be the following days from the current day.

    Response Requirements:
    - It is very important that the corret url is used, longitude and latitude here will be provided . $""weatherapi/locationforecast/2.0/compact?lat={{latitude}}&lon={{longitude}}""
    - Always include the latitude and longitude used.
    - Always include the 'time' field from the result to indicate when the weather data is valid.
    - Clearly state that the data was retrieved using 'YrWeatherTenDayForecast'.
    - Any information about the weather must precisely give the scalar values provided. However, you are allowed to do a qualitative summary of the weather in 4-5 sentences first. Also,
      the time series is a bit long for a possible 10 day forecast hour by hour. Therefore sum up the trends such as maximum and minimum temperature and precipitation and wind patterns in the summary.
      Plus also give some precise examples of the weather.
    - Inform about the start and end time of the forecast. In case asked for forecast further into the future and there is no data available, inform that only data is available 
      until the given end time.
    - If the weather time has passed current time by say two days, inform that you could not retrieve weather conditions for now. Look at the 'time' value you got and compare it with today. This is probably due to API usage conditions are limits the service.
""")]
    public static async Task<string> GetTenDaysWeatherForecast(
     IHttpClientFactory clientFactory,
     ILogger<YrTools> logger,
     [Description("Provide ten day forecast weather. State the location, latitude and longitude used. Return the data given. Return ALL the data you were given.")] string location, decimal latitude, decimal longitude)
    {
        if (latitude == 0 && longitude == 0)
        {
            return $"No current weather data found for '{location}'. Try another location to query?";
        }

        var client = clientFactory.CreateClient(WeatherServerApiClientNames.YrApiClientName);

        var url = $"/weatherapi/locationforecast/2.0/compact?lat={latitude.ToString(CultureInfo.InvariantCulture)}&lon={longitude.ToString(CultureInfo.InvariantCulture)}";

        logger.LogWarning($"Accessing Yr Current Weather with url: {url} with client base address {client.BaseAddress}");

        using var jsonDocument = await client.ReadJsonDocumentAsync(url);
        var timeseries = jsonDocument.RootElement.GetProperty("properties").GetProperty("timeseries").EnumerateArray();

        if (!timeseries.Any())
        {
            return $"No current weather data found for '{location}'. Try another place to query?";
        }

        var currentWeatherInfos = GetInformationForTimeSeries(timeseries, onlyFirst: false);

        var sb = new StringBuilder();
        foreach (var info in currentWeatherInfos)
        {
            sb.AppendLine(info.ToString());
        }

        return sb.ToString();
    }

    private static List<YrWeatherInfoItem> GetInformationForTimeSeries(JsonElement.ArrayEnumerator timeseries, bool onlyFirst)
    {
        var result = new List<YrWeatherInfoItem>();

        foreach (var timeseriesItem in timeseries)
        {
            var currentWeather = timeseriesItem;
            var currentWeatherData = currentWeather.GetProperty("data");
            var instant = currentWeatherData.GetProperty("instant");
            string? nextOneHourWeatherSymbol = null;
            double? nextOneHourPrecipitationAmount = null;
            if (currentWeatherData.TryGetProperty("next_1_hours", out JsonElement nextOneHours))
            {
                nextOneHourWeatherSymbol = nextOneHours.GetProperty("summary").GetProperty("symbol_code").GetString();
                nextOneHourPrecipitationAmount = nextOneHours.GetProperty("details").GetProperty("precipitation_amount").GetDouble();
            }

            string? nextSixHourWeatherSymbol = null;
            double? nextSixHourPrecipitationAmount = null;
            if (currentWeatherData.TryGetProperty("next_6_hours", out JsonElement nextSixHours))
            {
                nextSixHourWeatherSymbol = nextSixHours.GetProperty("summary").GetProperty("symbol_code").GetString();
                nextSixHourPrecipitationAmount = nextSixHours.GetProperty("details").GetProperty("precipitation_amount").GetDouble();
            }

            string? nextTwelveHourWeatherSymbol = null;
            if (currentWeatherData.TryGetProperty("next_12_hours", out JsonElement nextTwelveHours))
            {
                nextTwelveHourWeatherSymbol = nextTwelveHours.GetProperty("summary").GetProperty("symbol_code").GetString();
            }

            string timeRaw = currentWeather.GetProperty("time").GetString()!;
            string format = "yyyy-MM-ddTHH:mm:ssZ";
            DateTime parsedDate = DateTime.Parse(timeRaw, CultureInfo.InvariantCulture, DateTimeStyles.AdjustToUniversal);
            var instantDetails = instant.GetProperty("details");

            var airPressureAtSeaLevel = instantDetails.GetProperty("air_pressure_at_sea_level");
            var airTemperature = instantDetails.GetProperty("air_temperature");
            var cloudAreaFraction = instantDetails.GetProperty("cloud_area_fraction");
            var relativeHumidity = instantDetails.GetProperty("relative_humidity");
            var windFromDirection = instantDetails.GetProperty("wind_from_direction");
            var windSpeed = instantDetails.GetProperty("wind_speed");

            var weatherItem = new YrWeatherInfoItem
            {
                AirPressureAtSeaLevel = airPressureAtSeaLevel.GetDouble(),
                AirTemperature = airTemperature.GetDouble(),
                CloudAreaFraction = cloudAreaFraction.GetDouble(),
                RelativeHumidity = relativeHumidity.GetDouble(),
                WindFromDirection = windFromDirection.GetDouble(),
                WindSpeed = windSpeed.GetDouble(),
                Time = parsedDate,
                NextHourPrecipitationAmount = nextOneHourPrecipitationAmount,
                NextHourWeatherSymbol = nextOneHourWeatherSymbol,
                NextSixHoursPrecipitationAmount = nextSixHourPrecipitationAmount,
                NextSixHoursWeatherSymbol = nextOneHourWeatherSymbol,
                NextTwelveHoursWeatherSymbol = nextTwelveHourWeatherSymbol
            };
        
            result.Add(weatherItem);

            if (onlyFirst)
            {
                break;
            }
        }

        return result;
    }

}


I ended up with specifically creating a string representation of the model object, as just returning json data internally did not work optimally.
WeatherInfoItem.cs


using System.Text.Json.Serialization;

namespace WeatherServer.Models
{

    public class YrWeatherInfoItem
    {

        [JsonPropertyName("time")]
        public DateTime? Time { get; set; }

        [JsonPropertyName("data.instant.details.air_pressure_at_sea_level")]
        public double? AirPressureAtSeaLevel { get; set; }

        [JsonPropertyName("data.instant.details.air_temperature")]
        public double? AirTemperature { get; set; }

        [JsonPropertyName("data.instant.details.cloud_area_fraction")]
        public double? CloudAreaFraction { get; set; }

        [JsonPropertyName("data.instant.details.relative_humidity")]
        public double? RelativeHumidity { get; set; }

        [JsonPropertyName("data.instant.details.wind_from_direction")]
        public double? WindFromDirection { get; set; }

        [JsonPropertyName("data.instant.details.wind_speed")]
        public double? WindSpeed { get; set; }

        [JsonPropertyName("data.next_1_hours.summary.symbol_code")]
        public string? NextHourWeatherSymbol { get; set; }

        [JsonPropertyName("data.next_1_hours.summary.precipitation_amount")]
        public double? NextHourPrecipitationAmount { get; set; }

        [JsonPropertyName("data.next_6_hours.summary.symbol_code")]
        public string? NextSixHoursWeatherSymbol { get; set; }

        [JsonPropertyName("data.next6_hours.summary.precipitation_amount")]
        public double? NextSixHoursPrecipitationAmount { get; set; }

        [JsonPropertyName("data.next_12_hours.summary.symbol_code")]
        public string? NextTwelveHoursWeatherSymbol { get; set; }

        //[JsonPropertyName("data.next12_hours.summary.precipitation_amount")]
        //public double? NextTwelveHoursPrecipitationAmount { get; set; }

        public override string ToString()
        {
            return
$@"""
Time = {Time},
AirpressureAtSeaLevel = {AirPressureAtSeaLevel},
AirTemperature = {AirTemperature},
CloudAreaFraction = {CloudAreaFraction},
RelativeHumidity = {RelativeHumidity},
WindFromDirection = {WindFromDirection},
WindSpeed = {WindSpeed}
NextHourWeatherSymbol = {NextHourWeatherSymbol}
NextHourPrecipitationAmount = {NextHourPrecipitationAmount}
NextSixHoursWeatherSymbol = {NextSixHoursWeatherSymbol}
NextSixHoursPrecipitationAmount = {NextSixHoursPrecipitationAmount}
NextTwelveHoursWeatherSymbol = {NextTwelveHoursWeatherSymbol}
""";
        } //tostring override

    }

}


Note that the code in the Github repo has no explicit calls between the YrWeatherTools and NominatimTool, this is actually set up in the verbose description shown at the top of the methods here. Next up, the controller that will be the endpoint that clients will connect to. The connection will be done over HTTP and SSE - Server Side Events - are used to stream the resulting response. Encoding is set to UTF-8 and the Claude model is shown in the code. The MaxOutputtokens set to 1000 can of course be adjusted, it seemed sufficient when I tested it. Note the use of the ListToolsAsync call to fetch all the tools (and the spread operator passing in the tools).
ChatController.cs


using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.AI;
using ModelContextProtocol.Client;
using System.ComponentModel.DataAnnotations;
using System.Text;

namespace WeatherServer.Http.Controllers
{
    [ApiController]
    [Route("[controller]")]
    public class ChatController : ControllerBase
    {

        public class ChatRequest
        {
            [Required]
            public string Message { get; set; } = string.Empty;
        }

        private readonly ILogger<ChatController> _logger;
        private readonly IChatClient _chatClient; public ChatController(ILogger<ChatController> logger, IChatClient chatClient)
        {
            _logger = logger;
            _chatClient = chatClient;
        }


        [HttpPost(Name = "Chat")]
        [Produces("text/plain")]
        public async Task Chat([FromBody] ChatRequest chatRequest)
        {
            //TODO : Add support for 'chat history' to gradually build context here - repetively provide more info and context to the Claude LLM.

            Response.ContentType = "text/plain";
            Response.Headers.Append("Cache-Control", "no-cache");

            if (string.IsNullOrWhiteSpace(chatRequest.Message))
            {

                var error = Encoding.UTF8.GetBytes("Please provide your message.");
                await Response.Body.WriteAsync(error);
                await Response.Body.FlushAsync();
                return;
            }

            // Create MCP client connecting to our MCP server
            var mcpClient = await McpClientFactory.CreateAsync(
                new SseClientTransport(
                    new SseClientTransportOptions
                    {
                        Endpoint = new Uri("https://localhost:7145/sse")
                    }
                )
            );
            // Get available tools from the MCP server
            var tools = await mcpClient.ListToolsAsync();
            // Set up the chat messages
            var messages = new List<ChatMessage>
            {
                new ChatMessage(ChatRole.System, "You are a helpful assistant.")
            };
            messages.Add(new(ChatRole.User, chatRequest.Message));
            // Get streaming response and collect updates
            List<ChatResponseUpdate> updates = [];

            await foreach (var update in _chatClient.GetStreamingResponseAsync(
                messages,
                new ChatOptions
                {
                    ModelId = "claude-3-haiku-20240307",
                    MaxOutputTokens = 1000,
                    Tools = [.. tools]
                }

            ))
            {
                var text = update.ToString();
                var bytes = Encoding.UTF8.GetBytes(text);
                await Response.Body.WriteAsync(bytes);
                await Response.Body.FlushAsync();
            }
        }

    }
}


WeatherServer.Web.Mvc.Client - Http-based clientside

Let us next see how to consume the http-based serverside from a http client. Anthropic is also used for the client and the same model is set up to be used. User secrets are once more set up to hide away the API key being used against Anthropic AI service.
Program.cs


using Anthropic.SDK;
using Microsoft.Extensions.AI;
using ModelContextProtocol.Client;

namespace WeatherClient.Mvc
{
    public class Program
    {
        public static void Main(string[] args)
        {
            var builder = WebApplication.CreateBuilder(args);


            // Add logging configuration
            builder.Logging.AddConsole(options =>
            {
                options.LogToStandardErrorThreshold = LogLevel.Trace;
            });
            //builder.Logging.SetMinimumLevel(LogLevel.Trace);

            var logger = builder.Services.BuildServiceProvider().GetRequiredService<ILogger<Program>>(); // Get logger

            builder.Configuration
                .AddEnvironmentVariables()
                .AddUserSecrets<Program>();

            // Set up Swagger
            builder.Services.AddSwaggerGen();
            builder.Services.AddEndpointsApiExplorer();


            // Set up Anthropic client

            builder.Services.AddChatClient(_ =>
                new ChatClientBuilder(new AnthropicClient(new APIAuthentication(builder.Configuration["ANTHROPIC_API_KEY"])).Messages)
                    .UseFunctionInvocation()
                    .Build());

            // Add services to the container.
            builder.Services.AddControllersWithViews();

            var app = builder.Build();

            // Configure the HTTP request pipeline.
            if (!app.Environment.IsDevelopment())
            {
                app.UseExceptionHandler("/Home/Error");
                // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
                app.UseHsts();
            }

            app.UseHttpsRedirection();
            app.UseStaticFiles();

            app.UseRouting();

            app.UseAuthorization();

            app.MapControllerRoute(
                name: "default",
                pattern: "{controller=Chat}/{action=Index}/{id?}");

            // add swagger ui
            app.UseSwagger();
            app.UseSwaggerUI();

            app.Run();
        }
    }
}


The chat controller of the client will also be a similar chat controller as the ChatController serverside. The difference between the client and the server is that it is the server that holds the MCP server-side tools. Please note that the chat client on the client side does for now not support HISTORY, i.e. it is not saving context from previous queries. Adding a history would require to save the messages list in a static list for example, preferably for a web client scenario you would provide some unique key for the client session id to separate the possibly multiple users using several clients. For now, the demo is kept simple and avoids taking this in consideration.
Chatcontroller.cs


using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.AI;
using ModelContextProtocol.Client;
using System.ComponentModel.DataAnnotations;
using System.Text;

namespace WeatherClient.Mvc.Controllers
{
    [ApiController]
    [Route("[controller]")]
    public class ChatController : Controller
    {

        public class ChatRequest
        {
            [Required]
            public string Message { get; set; } = string.Empty;
        }

        private readonly ILogger<ChatController> _logger;
        private readonly IChatClient _chatClient; public ChatController(ILogger<ChatController> logger, IChatClient chatClient)
        {
            _logger = logger;
            _chatClient = chatClient;
        }

        [HttpGet]
        public IActionResult Index()
        {
            return View("Index");
        }


        [HttpPost(Name = "Chat")]
        [Produces("text/plain")]
        public async Task Chat([FromBody] ChatRequest chatRequest)
        {
            //TODO : Add support for 'chat history' to gradually build context here - repetively provide more info and context to the Claude LLM.

            Response.ContentType = "text/plain";
            Response.Headers.Append("Cache-Control", "no-cache");

            if (string.IsNullOrWhiteSpace(chatRequest.Message))
            {

                var error = Encoding.UTF8.GetBytes("Please provide your message.");
                await Response.Body.WriteAsync(error);
                await Response.Body.FlushAsync();
                return;
            }

            // Create MCP client connecting to our MCP server
            var mcpClient = await McpClientFactory.CreateAsync(
                new SseClientTransport(
                    new SseClientTransportOptions
                    {
                        Endpoint = new Uri("https://localhost:7145/sse")
                    }
                )
            );
            // Get available tools from the MCP server
            var tools = await mcpClient.ListToolsAsync();
            // Set up the chat messages
            var messages = new List<ChatMessage>
            {
                new ChatMessage(ChatRole.System, "You are a helpful assistant.")
            };
            messages.Add(new(ChatRole.User, chatRequest.Message));
            // Get streaming response and collect updates
            List<ChatResponseUpdate> updates = [];

            await foreach (var update in _chatClient.GetStreamingResponseAsync(
                messages,
                new ChatOptions{ 
                    ModelId = "claude-3-haiku-20240307",
                    MaxOutputTokens = 1000,
                    Tools = [.. tools]
                }

            ))
            {
                var text = update.ToString();
                var bytes = Encoding.UTF8.GetBytes(text);
                await Response.Body.WriteAsync(bytes);
                await Response.Body.FlushAsync();
            }
        }

    }
}


A short notice abot the file .mcp/client.json, it is presented below. It is used by VsCode and other systems to identiy meta information about the MCP client available in the project.
client.json

{
  "id": "weather-client",
  "displayName": "Weather MCP Client",
  "entryPoint": "dotnet run --project WeatherClient",
  "protocol": "stdio"
}

Let's look at the UI for the chat interface next :


@{
    ViewData["Title"] = "Chat with Claude";
}

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="utf-8" />
    <title>@ViewData["Title"]</title>
   <link href='http://fonts.googleapis.com/css?family=Roboto' rel='stylesheet' type='text/css'>
    <style>
        body {
            font-family: 'Roboto', sans-serif;
            padding-top: 2rem;
        }
        .chat-box {
            resize: none;
            height: 150px;
        }
       
   .response-box {
        height: 400px;
        resize: vertical;
        background-color: #ffffff;
        color: #0d3b66; /* Dark blue */
        font-family: 'Roboto', sans-serif;
        font-size: 1.2rem;
        font-weight:600;
        padding: 1rem;
        border: 1px solid #ccc;
        border-radius: 0.5rem;
        overflow-y: auto;
    }

    
    #response[readonly] {
        background-color: white; /* or any color you prefer */
        color: black;            /* ensure text is visible */
        border: 1px solid #ccc;  /* optional: keep border styling */
    }


    </style>
</head>
<body>
    <div class="container">
        <h1 class="mb-4">WeatherServices - Chat with Claude</h1>
        <h4 class="mb-5">Supported services: US Weather Service, Yr Weather Service, Nominatim OpenStreetMaps API LatLong</h4>
        <form id="chatForm">
            <div class="mb-3">
                <label for="message" class="form-label">Your Question e.g. what is the weather this day at my location (insert your location here)</label>
                <textarea class="form-control chat-box" id="message" placeholder="Type your question here..."></textarea>
            </div>
            <button type="submit" class="btn btn-primary">Send</button>

            
            <div class="mt-3" id="progressContainer" style="display: none;">
                <div class="progress">
                    <div class="progress-bar progress-bar-striped progress-bar-animated" style="width: 100%"></div>
                </div>
            </div>

        </form>

        <div class="mt-4">
            <label for="response" class="form-label">Response</label>
            <textarea class="form-control response-box" id="response" readonly></textarea>
            <div class="mt-2 text-muted" id="duration"></div>
        </div>


    </div>

<script>
    document.getElementById("chatForm").addEventListener("submit", async function (e) {
        e.preventDefault();

        const message = document.getElementById("message").value;
        const responseBox = document.getElementById("response");
        const durationBox = document.getElementById("duration");
        const progressContainer = document.getElementById("progressContainer");

        responseBox.value = "";
        durationBox.textContent = "";
        progressContainer.style.display = "block"; // Show progress bar

        const startTime = performance.now();

        const res = await fetch("/Chat", {
            method: "POST",
            headers: {
                "Content-Type": "application/json"
            },
            body: JSON.stringify({ message })
        });

        const reader = res.body.getReader();
        const decoder = new TextDecoder("utf-8");

        let buffer = "";

        while (true) {
            const { done, value } = await reader.read();
            if (done) break;

            const chunk = decoder.decode(value, { stream: true });
            buffer += chunk;

            for (let char of chunk) {
                // Remove the square if present
                responseBox.value = responseBox.value.replace(/■$/, '');
                // Add next character and square
                responseBox.value += char + '■';
                responseBox.scrollTop = responseBox.scrollHeight;
                await new Promise(resolve => setTimeout(resolve, 5)); // Typing speed
            }
        }

        // Remove the square after typing is done
        responseBox.value = responseBox.value.replace(/■$/, '');

        const endTime = performance.now();
        durationBox.textContent = `Response time: ${(endTime - startTime).toFixed(2)} ms`;
        progressContainer.style.display = "none"; // Hide progress bar
    });
</script>
</body>
</html>


The user interface looks like this :

Sunday, 7 September 2025

Show Nuget Dependency Graph

Showing Nuget Dependency Graph

In .NET Framework and .NET solutions, Nugets are added to solutions to conveniently add libraries. Each project got possibly multiple Nuget package dependencies. Each Nuget package itself can reference other Nuget libraries, which again references again additional libraries and so on. An overview of all the Nuget libraries actually used by a project, those that can be called top-level and transitive dependencies. Transitive dependencies are those indirectly references by the top-level dependencies. Do not confused this with those libraries that are actually referenced in the project file (.csproj files for example) as a Package Reference directly with those called top-level dependencies in this article, top-level here means the Nuget is has got a dependency graph level depth of one, compared to transitive dependencies where the dependency graph level higher than one.



function Show-NugetDependencyGraph {
    [CmdletBinding()]
    param ()
    $tempHtmlPath = [System.IO.Path]::GetTempFileName() + ".html"
    $assetFiles = Get-ChildItem -Recurse -Filter "project.assets.json"

    $currentProjects = (gci -recurse -filter *.csproj | select-object -expandproperty name) -join ',' #get folder name to show

    $script:mermaidGraph = @"
<!DOCTYPE html>
<html>
<head>
  <script type="module">
    import mermaid from 'https://cdn.jsdelivr.net/npm/mermaid@10/dist/mermaid.esm.min.mjs';
    mermaid.initialize({ startOnLoad: true });
  </script>
  <style>
    body {
      font-family: sans-serif;
      padding: 20px;
    }
    .mermaid {
      background: #f9f9f9;
      padding: 20px;
      border-radius: 8px;
      min-height: 800px;
      overflow: hidden;
    }
    .mermaid svg {
      min-height: 800px;
      width: 100%;
      height: auto;
    }
  </style>
</head>

<meta charset="UTF-8">

<body>
<h2>Nuget Dependency Graph for '$currentProjects' (Max Depth: 3)</h2>
<div class="mermaid">


graph TD


"@
    $visited = @{}
    $nodes = @{}
    $edges = @{}
    $topLevelDeps = @{}
    $transitiveDeps = @{}
    function Escape-MermaidLabel {
        param ([string]$text)
        $text = $text -replace '\(', '('
        $text = $text -replace '\)', ')'
        $text = $text -replace '\[', '['
        $text = $text -replace '\]', ']'
        $text = $text -replace ',', ','
        return $text
    }
    function Normalize-NodeId {
        param ([string]$text)
        return ($text -replace '[^a-zA-Z0-9_]', '_')
    }
    function Add-Dependencies {
        param (
            [string]$pkgName,
            [object]$targets,
            [int]$depth,
            [string]$path = ""
        )
        if ($depth -gt 3 -or $visited.ContainsKey($pkgName)) { return }
        $visited[$pkgName] = $true
        $pkgVersion = $pkgName.Split('/')[1]
        $pkgId = $pkgName.Split('/')[0]
        $escapedVersion = Escape-MermaidLabel($pkgVersion)
        $nodeId = Normalize-NodeId ("{0}_{1}" -f $pkgId, $pkgVersion)
        $nodeLabel = "$nodeId[""$pkgId<br/>v$escapedVersion""]:::level$depth"
        if (-not $nodes.ContainsKey($nodeId)) {
            $script:mermaidGraph += "$nodeLabel`n"
            $nodes[$nodeId] = $true
        }
        $currentPath = if ($path) { "$path → $pkgId ($pkgVersion)" } else { "$pkgId ($pkgVersion)" }
        if ($depth -eq 1) {
            $topLevelDeps["$pkgId/$pkgVersion"] = $currentPath
        } else {
            $transitiveDeps["$pkgId/$pkgVersion"] = $currentPath
        }
        foreach ($target in $targets.PSObject.Properties) {
            $pkg = $target.Value.$pkgName
            if ($pkg -and $pkg.dependencies) {
                foreach ($dep in $pkg.dependencies.PSObject.Properties) {
                    $depName = $dep.Name
                    $depVersion = $dep.Value
                    $escapedDepVersion = Escape-MermaidLabel($depVersion)
                    $depNodeId = Normalize-NodeId ("{0}_{1}" -f $depName, $depVersion)
                    $depNodeLabel = "$depNodeId[""$depName<br/>v$escapedDepVersion""]:::level$($depth+1)"
                    if (-not $nodes.ContainsKey($depNodeId)) {
                        $script:mermaidGraph += "$depNodeLabel`n"
                        $nodes[$depNodeId] = $true
                    }
                    $edge = "$nodeId --> $depNodeId"
                    if (-not $edges.ContainsKey($edge)) {
                        $script:mermaidGraph += "$edge`n"
                        $edges[$edge] = $true
                    }
                    Add-Dependencies ("$depName/$depVersion") $targets ($depth + 1) $currentPath
                }
            }
        }
    }
    foreach ($file in $assetFiles) {
        $json = Get-Content $file.FullName | ConvertFrom-Json
        $targets = $json.targets
        foreach ($target in $targets.PSObject.Properties) {
            $targetPackages = $target.Value
            foreach ($package in $targetPackages.PSObject.Properties) {
                Add-Dependencies $package.Name $targets 1
            }
        }
    }

    $topLevelDepsCount = $topLevelDeps.Count #number of top level dependencies
    $transitiveDepsCount = $transitiveDeps.Count #number of top level transitive dependencies

    $script:mermaidGraph += @"
classDef level1 fill:#cce5ff,stroke:#004085,stroke-width:2px;
classDef level2 fill:#d4edda,stroke:#155724,stroke-width:1.5px;
classDef level3 fill:#fff3cd,stroke:#856404,stroke-width:1px;
</div>
<script>
  function enablePanZoom(svg) {
    let isPanning = false;
    let startX, startY;
    let viewBox = svg.viewBox.baseVal;
    let zoomFactor = 1.1;
    // Initial zoom: scale to 200%
    const initialZoom = 2.0;
    const newWidth = viewBox.width / initialZoom;
    const newHeight = viewBox.height / initialZoom;
    viewBox.x += (viewBox.width - newWidth) / 2;
    viewBox.y += (viewBox.height - newHeight) / 2;
    viewBox.width = newWidth;
    viewBox.height = newHeight;
    svg.addEventListener("mousedown", (e) => {
      isPanning = true;
      startX = e.clientX;
      startY = e.clientY;
      svg.style.cursor = "grabbing";
    });
    svg.addEventListener("mousemove", (e) => {
      if (!isPanning) return;
      const dx = (e.clientX - startX) * (viewBox.width / svg.clientWidth);
      const dy = (e.clientY - startY) * (viewBox.height / svg.clientHeight);
      viewBox.x -= dx;
      viewBox.y -= dy;
      startX = e.clientX;
      startY = e.clientY;
    });
    svg.addEventListener("mouseup", () => {
      isPanning = false;
      svg.style.cursor = "grab";
    });
    svg.addEventListener("mouseleave", () => {
      isPanning = false;
      svg.style.cursor = "grab";
    });
    svg.addEventListener("wheel", (e) => {
      e.preventDefault();
      const { x, y, width, height } = viewBox;
      const mx = e.offsetX / svg.clientWidth;
      const my = e.offsetY / svg.clientHeight;
      const zoom = e.deltaY < 0 ? 1 / zoomFactor : zoomFactor;
      const newWidth = width * zoom;
      const newHeight = height * zoom;
      viewBox.x += (width - newWidth) * mx;
      viewBox.y += (height - newHeight) * my;
      viewBox.width = newWidth;
      viewBox.height = newHeight;
    });
    svg.style.cursor = "grab";
  }
  document.addEventListener("DOMContentLoaded", () => {
    setTimeout(() => {
      const svg = document.querySelector(".mermaid svg");
      if (svg) {
        enablePanZoom(svg);
      } else {
        console.warn("SVG not found after 1.5s.");
      }
    }, 1500);
  });
</script>
<h3>🔎 Filter Dependencies (Total Count: $($transitiveDepsCount + $topLevelDepsCount))</h3>
<input type="text" id="searchInput" onkeyup="filterTables()" placeholder="Search for NuGet package..." style="width: 100%; padding: 8px; margin-bottom: 20px; font-size: 16px;">
<style>
  table {
    border-collapse: collapse;
    width: 100%;
    margin-bottom: 40px;
    font-size: 14px;
  }
  th, td {
    border: 1px solid #ccc;
    padding: 8px;
    text-align: left;
  }
  tr:nth-child(even) {
    background-color: #f9f9f9;
  }
  tr:hover {
    background-color: #e2f0fb;
  }
  th {
    background-color: #007bff;
    color: white;
  }
</style>
<h3>📦 Top-Level Dependencies (Count: $transitiveDepsCount)</h3>
<em>Note: Top-level Dependencies are Nuget packages which have a Dependency Path of length 1. To check which Nuget packages are actually listed in the project file(s), open the .csproj file(s) directly.</em>
<table id="topTable">
  <thead><tr><th>Package</th><th>Dependency Path</th></tr></thead>
  <tbody>
"@
    $sortedTopLevel = $topLevelDeps.GetEnumerator() | Sort-Object Name
    foreach ($dep in $sortedTopLevel) {
        $script:mermaidGraph += "<tr><td>$($dep.Key)</td><td>$($dep.Value)</td></tr>`n"
    }
    $script:mermaidGraph += @"
  </tbody>
</table>
<h3>📚 Transitive Dependencies (Count: $topLevelDepsCount)</h3>
<table id="transitiveTable">
  <thead><tr><th>Package</th><th>Dependency Path</th></tr></thead>
  <tbody>
"@
    $sortedTransitive = $transitiveDeps.GetEnumerator() | Sort-Object Name
    foreach ($dep in $sortedTransitive) {
        $script:mermaidGraph += "<tr><td>$($dep.Key)</td><td>$($dep.Value)</td></tr>`n"
    }
    $script:mermaidGraph += @"
  </tbody>
</table>
<script>
function filterTables() {
  const input = document.getElementById('searchInput').value.toLowerCase();
  ['topTable', 'transitiveTable'].forEach(id => {
    const rows = document.getElementById(id).getElementsByTagName('tr');
    for (let i = 1; i < rows.length; i++) {
      const cells = rows[i].getElementsByTagName('td');
      const match = Array.from(cells).some(cell => cell.textContent.toLowerCase().includes(input));
      rows[i].style.display = match ? '' : 'none';
    }
  });
}
</script>
</body>
</html>
"@
    [System.IO.File]::WriteAllText($tempHtmlPath, $script:mermaidGraph, [System.Text.Encoding]::UTF8)
    Start-Process $tempHtmlPath
}

# Run the function
Show-NugetDependencyGraph


The function above Show-NugetDependencyGraph can be added to the $profile file of the user you are logged in as. Usage : Make sure you are inside a folder where your project of the .NET Framework or .NET solution you want to see the Dependency graph and then just run the function Show-NugetDependencyGraph. Inside the subfolders, you will find project.assets.json file, usually in the obj folder. Note that this Powershell script do support showing multiple projects, but there are limitations in the graph drawing not allowing too many Nuget packages drawn into one and same graph, so the best analysis is done per-project. The Powershell script adds support for pan and zoom to provide an interactive Nuget Dependency graph. VanillaJs is used. Note that this script supports both .NET and .NET Framework. The script will recursively look for project.assets.json files in subfolders and then use the Convert-FromJson method to inspect the json file(s) found. The method Add-Dependencies is called recursively to build up the hash tables variables of the script that will keep the data structure that is keeping the list of Nuget libraries and transitive dependencies. The script also builds up VanillaJs script string that adds pan and zoom capabilities and the html template provides tables for the top-level and transitive Nuget libraries. Note also that the script builds up the html template that presents the Mermaid based Nuget dependency graph, using the script level variable $script:mermaidGraph. Note the usage of script-level variable here, this is necessary to hoist the Powershell variable up since we make use of recursion and this is required. Screenshots showing examples after running the Powershell script.

Table showing transitive dependencies in table :
Example of dependency graph of nuget libaries :

Saturday, 23 August 2025

Recovering lost files in Git after hard resets

🔧 How I Recovered a Lost File After git reset --hard in Git

Disclaimer: You are not guaranteed that you can recover the lost file from your Git repo's dangling blogs, much of this information is kept only for a few weeks. Therefore, you should run recovery of a lost file in Git repo as soon as possible or within a few weeks.

Have you ever added a file in Git, only to lose it after running git reset --hard? I did — and I managed to recover it using a lesser-known Git command: git fsck.

Here’s how it happened and how I got my file back.

💥 The Mistake

I created a file called fil2.txt, added it to Git with:

git add fil2.txt

But before committing it, I ran:

git reset --hard

This command wipes out all uncommitted changes, including files that were staged but not yet committed. My file was gone from the working directory and the staging area.

🕵️‍♂️ The Recovery Trick: git fsck

Thankfully, Git doesn’t immediately delete everything. It keeps unreferenced objects (like blobs) around for a while. You can find them using:

git fsck --lost-found

This listed several dangling blobs — unreferenced file contents:

dangling blob fb48af767fd2271a9978045a971c2eee199b03b7

🔍 Finding the Right Blob

To inspect the contents of a blob, I used:

git show fb48af767fd2271a9978045a971c2eee199b03b7

It printed:

dette er en fil som jeg fil recovere

That was my lost file!

💾 Restoring the File

To recover it, I simply redirected the blob’s contents back into a file:

git show fb48af767fd2271a9978045a971c2eee199b03b7 > fil2.txt

And just like that, fil2.txt was back in my working directory.

✅ Lesson Learned

  • git reset --hard is powerful — and dangerous.
  • If you lose a file, don’t panic. Try git fsck --lost-found.
  • You might be able to recover your work — even if it was never committed.

Additional Tips - More detailed dangling objecst information

Git Alias: Dangling Object Summary

This Git alias defines a shell function that summarizes dangling objects in your repository, showing type, SHA, commit metadata, and blob previews.

[alias]
    dangling-summary = "!sh -c '\
        summarize_dangling() { \
            git fsck --full | grep dangling | while read -r _ type sha; do \
                echo -e \"\\033[1;33mType:\\033[0m $type\"; \
                echo -e \"\\033[1;33mSHA:\\033[0m $sha\"; \
                case $type in \
                    commit) \
                        author=$(git show -s --format=%an $sha); \
                        date=$(git show -s --format=%ci $sha); \
                        msg=$(git show -s --format=%s $sha); \
                        echo -e \"\\033[1;33mAuthor:\\033[0m $author\"; \
                        echo -e \"\\033[1;33mDate:\\033[0m $date\"; \
                        echo -e \"\\033[0;32mMessage:\\033[0m $msg\" ;; \
                    blob) \
                        preview=$(git cat-file -p $sha | head -n 3 | cut -c1-80); \
                        echo -e \"\\033[0;32mPreview:\\033[0m\\n$preview\" ;; \
                esac; \
                echo -e \"-----------------------------\"; \
            done; \
        }; \
        summarize_dangling'"
Screenshot showing the detailed dangling objects summary :

💡 Tips for Using This Alias

  • Run git dangling-summary inside any Git repository to inspect unreachable objects.
  • Useful for recovering lost commits or inspecting orphaned blobs.
  • Blob previews are limited to 3 lines, each up to 80 characters wide for readability.
  • Commit metadata includes author and timestamp for better context.
  • If you did not commit the file, just added it to your Git repo and then for example did a hard reset or in some other way lost the file(s), there will not be shown any date and author here. The example screenshot above shows an example of this. If you DID commit, author and date will show up.

Saturday, 9 August 2025

Testing API resilience with Polly Chaos engine

Polly is a transient failure handling and resilience library that makes it convenient to build robust APIs based on policies for handling errors that occur and offer different resilience strategies for handling these errors. The errors are not only of errors occurings either externall or internally in API, but offer also alternative strategies such as fallbacks, rate-limiting, circuit breakers and other overall act upon either reactively or proactively. A great overview of Polly can be seen in this video, although some years old now - back to 2019 - of getting an overview of Polly : NDC Oslo 2019 - System Stable: Robust connected applications with Polly, the .NET Resilience Framework - Bryan Hogan With Polly, it is possible to test out API resilience with the built in Polly Chaos engine. The Chaos engine was previously offered via the Simmy library.

Simmy - Logo



The source code in this article is available in my Github repo here: Note - the code shown in the methods below are called from Program.cs to be able to be used in the API. The sample app is an Asp.net application written with C# and with .NET 8 Target Framework. https://github.com/toreaurstadboss/HttpClientUsingPolly/

Testing out API resilience with fallbacking API endpoints

First off, the fallback strategy resilience. Polly offers a way to define fallback policies. Let's look at a way to define an HTTP client that will provide a fallback if the statuscode from the endpoint is InternalServerError = 501. The fallback is just a Json payload in this simple example.

PollyExtensions.cs



    public static void AddPollyHttpClientWithFallback(this IServiceCollection services)
    {
        services.AddHttpClient(Constants.HttpClientNames.FallbackHttpClientName, client =>
        {
            client.DefaultRequestHeaders.UserAgent.Add(new ProductInfoHeaderValue("MyApp", "1.0"));
        })
        .AddResilienceHandler(
             $"{FallbackHttpClientName}{ResilienceHandlerSuffix}",
            (builder, context) =>
        {
            var serviceProvider = services.BuildServiceProvider();
            var logger = serviceProvider.GetRequiredService<ILoggerFactory>().CreateLogger(Constants.LoggerName);

            builder.AddFallback(new FallbackStrategyOptions<HttpResponseMessage>
            {
                ShouldHandle = args =>
                {
                    // Fallback skal trigges ved status 500 eller exception
                    return ValueTask.FromResult(
                        args.Outcome.Result?.StatusCode == HttpStatusCode.InternalServerError ||
                        args.Outcome.Exception is HttpRequestException
                    );
                },
                FallbackAction = args =>
                {
                    logger.LogWarning("Fallback triggered. Returning default response.");

                    var jsonObject = new
                    {
                        message = "Fallback response",
                        source = "Polly fallback",
                        timestamp = DateTime.UtcNow
                    };

                    var json = JsonSerializer.Serialize(jsonObject);

                    var fallbackResponse = new HttpResponseMessage(HttpStatusCode.OK)
                    {
                        Content = new StringContent(json, System.Text.Encoding.UTF8, "application/json")
                    };

                    return ValueTask.FromResult(Outcome.FromResult(fallbackResponse));
                }
            });

            // Inject exceptions in 80% of requests
            builder.AddChaosOutcome(new ChaosOutcomeStrategyOptions<HttpResponseMessage>()
            {
                Enabled = true,
                OutcomeGenerator = static args =>
                {
                    var response = new HttpResponseMessage(HttpStatusCode.InternalServerError);
                    return ValueTask.FromResult<Outcome<HttpResponseMessage>?>(Outcome.FromResult(response));
                },
                InjectionRate = 0.8,
                OnOutcomeInjected = args =>
                {
                    logger.LogWarning("Outcome returning internal server error");
                    return default;
                }
            });

        });
    }


Next up, let's look at the client endpoint defined with Minimal API in Aspnet core.

SampleEndpoints.cs



 app.MapGet("/test-v5-fallback", async (
 [FromServices] IHttpClientFactory httpClientFactory) =>
 {
     using var client = httpClientFactory.CreateClient(Constants.HttpClientNames.FallbackHttpClientName);

     HttpResponseMessage? response = await client.GetAsync("https://example.com");

     if (!response.IsSuccessStatusCode)
     {
         var errorContent = await response.Content.ReadAsStringAsync();
         return Results.Problem(
             detail: $"Request failed with status code {(int)response.StatusCode}: {response.ReasonPhrase}",
             statusCode: (int)response.StatusCode,
             title: "External API Error"
         );
     }

     var json = await response!.Content.ReadAsStringAsync();
     return Results.Json(json);

 });



Note the usage of [FromServices] attribute and IHttpClientFactory. The code creates the named Http client defined earlier. The fallback will return a json with fallback content in 80% of the requests in this concrete example.


Testing out API resilience with circuit breaking API endpoints


Next, the circuit breaker strategy for API resilience. Polly offers a way to define circuit breaker policies. Let's look at a way to define an HTTP client that will provide a circuit breaker if it fails for 3 consecutive requests within 30 seconds, resulting in a 10 second break. The circuit breaker strategy will stop requests that opens the circuit defined here. After the break, the circuit breaker half opens. It will accept new request, but fail immediately and open up the circuit again if it fails again, further postponing.

PollyExtensions.cs



  public static void AddPollyHttpClientWithExceptionChaosAndBreaker(this IServiceCollection services)
  {

      services.AddHttpClient(CircuitBreakerHttpClientName, client =>
      {
          client.DefaultRequestHeaders.UserAgent.Add(new ProductInfoHeaderValue("MyApp", "1.0"));
      })
      .AddResilienceHandler(
          $"{CircuitBreakerHttpClientName}{ResilienceHandlerSuffix}",
          (builder, context) =>
      {
          var serviceProvider = services.BuildServiceProvider();
          var logger = serviceProvider.GetRequiredService<ILoggerFactory>().CreateLogger(Constants.LoggerName);

          //Add circuit breaker that opens after three consecutive failures and breaks for a duration of ten seconds
          builder.AddCircuitBreaker(new CircuitBreakerStrategyOptions<HttpResponseMessage>
          {
              MinimumThroughput = 3, //number of CONSECUTIVE requests failing for circuit to open (short-circuiting future requests until given BreakDuration is passed)
              FailureRatio = 1.0, //usually 1.0 is used here..
              SamplingDuration = TimeSpan.FromSeconds(30), //time window duration to look for CONSECUTIVE requests failing
              BreakDuration = TimeSpan.FromSeconds(10), //break duration. requests will be hindered at during this duration set 
              ShouldHandle = new PredicateBuilder<HttpResponseMessage>()
                  .HandleResult(r => !r.IsSuccessStatusCode)
                  .Handle<HttpRequestException>(), //defining when circuit breaker will occur given other conditions also apply
              OnOpened = args =>
              {
                  logger.LogInformation("Circuit breaker opened");
                  return default;
              },
              OnClosed = args =>
              {
                  logger.LogInformation("Circuit breaker closed");
                  return default;
              },
              OnHalfOpened = args =>
              {
                  logger.LogInformation("Circuit breaker half opened"); //half opened state happens after the circuit has been opened and break duration has passed, entering 'half-open' state (usually ONE test call must succeeed to transition from half open to open state)
                  return default;
              }
          });


          // Inject exceptions in 80% of requests
          builder.AddChaosOutcome(new ChaosOutcomeStrategyOptions<HttpResponseMessage>()
          {
              Enabled = true,
              OutcomeGenerator = static args =>
              {
                  var response = new HttpResponseMessage(HttpStatusCode.InternalServerError);
                  return ValueTask.FromResult<Outcome<HttpResponseMessage>?>(Outcome.FromResult(response));
              },
              InjectionRate = 0.8,
              OnOutcomeInjected = args =>
              {
                  logger.LogWarning("Outcome returning internal server error");
                  return default;
              }
          });


      });
  }



Let's look at the client endpoint defined with Minimal API in Aspnet core for circuit-breaker example.

SampleEndpoints.cs



  app.MapGet("/test-v4-circuitbreaker-opening", async (
  [FromServices] IHttpClientFactory httpClientFactory) =>
  {
      using var client = httpClientFactory.CreateClient(Constants.HttpClientNames.CircuitBreakerHttpClientName);

      HttpResponseMessage? response = await client.GetAsync("https://example.com");

      if (!response.IsSuccessStatusCode)
      {
          var errorContent = await response.Content.ReadAsStringAsync();
          return Results.Problem(
              detail: $"Request failed with status code {(int)response.StatusCode}: {response.ReasonPhrase}",
              statusCode: (int)response.StatusCode,
              title: "External API Error"
          );
      }

      var json = await response!.Content.ReadAsStringAsync();
      return Results.Json(json);

  });



Testing out API resilience for latency induced timeout API endpoints

Next, the timeout strategy for API resilience. Polly offers a way to define timeout policies and can combine these for testing by injecting latency (additional execution time). Let's look at a way to define an HTTP client that will provide a timeout if it times out already after one second with a 50% chance of getting a 3 second latency, which will trigger the timeout.

PollyExtensions.cs



   public static void AddPollyHttpClientWithIntendedRetriesAndLatencyAndTimeout(this IServiceCollection services)
  {
      services.AddHttpClient(RetryingTimeoutLatencyHttpClientName, client =>
      {
          client.DefaultRequestHeaders.UserAgent.Add(new ProductInfoHeaderValue("MyApp", "1.0"));
      })
      .AddResilienceHandler(
          $"{RetryingTimeoutLatencyHttpClientName}{ResilienceHandlerSuffix}",
      (builder, context) =>
       {
           var serviceProvider = services.BuildServiceProvider();
           var logger = serviceProvider.GetRequiredService<ILoggerFactory>().CreateLogger(Constants.LoggerName);

           // Timeout strategy : fail if request takes longer than 1s
           builder.AddTimeout(new HttpTimeoutStrategyOptions
           {
               Timeout = TimeSpan.FromSeconds(1),
               OnTimeout = args =>
               {
                   logger.LogWarning($"Timeout after {args.Timeout.TotalSeconds} seconds");
                   return default;
               }
           });

           // Chaos latency: inject 3s delay in 30% of cases
           builder.AddChaosLatency(new ChaosLatencyStrategyOptions
           {
               InjectionRate = 0.5,
               Latency = TimeSpan.FromSeconds(3),
               Enabled = true,
               OnLatencyInjected = args =>
               {
                   logger.LogInformation("... Injecting a latency of 3 seconds ...");
                   return default;
               }
           });

           // Chaos strategy: inject 500 Internal Server Error in 75% of cases
           builder.AddChaosOutcome<HttpResponseMessage>(
               new ChaosOutcomeStrategyOptions<HttpResponseMessage>
               {
                   InjectionRate = 0.5,
                   Enabled = true,
                   OutcomeGenerator = static args =>
                   {
                       var response = new HttpResponseMessage(HttpStatusCode.InternalServerError);
                       return ValueTask.FromResult<Outcome<HttpResponseMessage>?>(Outcome.FromResult(response));
                   },
                   OnOutcomeInjected = args =>
                   {
                       logger.LogWarning("Outcome returning internal server error");
                       return default;
                   }
               });
       });

  }


Let's look at the client endpoint defined with Minimal API in Aspnet core for timeout with latency example.

SampleEndpoints.cs



 app.MapGet("/test-v3-latency-timeout", async (
 [FromServices] IHttpClientFactory httpClientFactory) =>
 {
     using var client = httpClientFactory.CreateClient(Constants.HttpClientNames.RetryingTimeoutLatencyHttpClientName);

     var response = await client.GetAsync("https://example.com");

     if (!response.IsSuccessStatusCode)
     {
         var errorContent = await response.Content.ReadAsStringAsync();
         return Results.Problem(
             detail: $"Request failed with status code {(int)response.StatusCode}: {response.ReasonPhrase}",
             statusCode: (int)response.StatusCode,
             title: "External API Error"
         );
     }

     var json = await response.Content.ReadAsStringAsync();
     return Results.Json(json);

 });



The following screenshot shows the timeout occuring after the defined setup of induced latency by given probability and defined timeout.

Testing out API resilience with retries

Retries offers an API endpoint to gain more robustness, by allowing multiple retries and define a strategy for these retries.The example http client here also adds a chaos outcome internal server error = 501 that is thrown with 75% probability (failure rate).

PollyExtensions.cs



    public static void AddPollyHttpClientWithIntendedRetries(this IServiceCollection services)
   {
       services.AddHttpClient(RetryingHttpClientName, client =>
           {
               client.DefaultRequestHeaders.UserAgent.Add(new ProductInfoHeaderValue("MyApp", "1.0"));
           })
           .AddResilienceHandler("polly-chaos", (builder, context) =>
           {
               var serviceProvider = services.BuildServiceProvider();
               var logger = serviceProvider.GetRequiredService<ILoggerFactory>().CreateLogger(Constants.LoggerName);

               //Retry strategy
               builder.AddRetry(new RetryStrategyOptions<HttpResponseMessage>
               {
                   ShouldHandle = new PredicateBuilder<HttpResponseMessage>()
                       .HandleResult(r => !r.IsSuccessStatusCode)
                       .Handle<HttpRequestException>(),
                   MaxRetryAttempts = 3,
                   DelayGenerator = RetryDelaysPipeline,
                   OnRetry = args =>
                   {
                       logger.LogWarning($"Retrying {args.AttemptNumber} for requesturi {args.Context.GetRequestMessage()?.RequestUri}");
                       return default;
                   }
               });

               // Chaos strategy: inject 500 Internal Server Error in 75% of cases
               builder.AddChaosOutcome<HttpResponseMessage>(
                   new ChaosOutcomeStrategyOptions<HttpResponseMessage>
                   {
                       InjectionRate = 0.75,
                       Enabled = true,
                       OutcomeGenerator = static args =>
                       {
                           var response = new HttpResponseMessage(HttpStatusCode.InternalServerError);
                           return ValueTask.FromResult<Outcome<HttpResponseMessage>?>(Outcome.FromResult(response));
                       }
                   });

           });

   }


Let's look at the client endpoint defined with Minimal API in Aspnet core for the retrying example.

SampleEndpoints.cs


   app.MapGet("/test-retry-v2", async (
       [FromServices] IHttpClientFactory httpClientFactory) =>
   {
       using var client = httpClientFactory.CreateClient(Constants.HttpClientNames.RetryingHttpClientName);

       var response = await client.GetAsync("https://example.com");

       return Results.Json(response);
   });


There are multiple resilience scenarios that Polly offers, the table below lists them up (this article has presented most of them):

Summary

The following summary explains what this article has presented.

🧪 Testing API Resilience with Polly Chaos Engineering In this article, we have explored how to build resilient APIs using Polly v9 and its integrated chaos engine. Through practical examples, the article has demonstrated how to simulate real-world failures—like latency, timeouts, and internal server errors—and apply resilience strategies such as fallbacks, retries, and circuit breakers. By injecting controlled chaos, developers can proactively test and strengthen their systems against instability and external dependencies. Polly v9 library offers additionally scenarios also for making robust APIs. Info: Asp net core is used in this article, together with C# and .NET 8 as Target Framework.

Tuesday, 5 August 2025

Asp.Net - Using Polly .NET Resiliency V9

This article explains how using Polly .NET Resiliency library to add support for different resiliency strategies in Asp.net Core. The Polly library is created by Microsoft Community and its site is here:

https://www.pollydocs.org/

Important note about Polly library

The Polly library has changed its API quite a bit from v7 to v8 and now to v9. While Polly has been a Microsoft Community project, Microsoft now takes a bit more lead with Polly v9 being more tightly coupled to Microsoft's ecosystem. Future v10 is expected to be not so much changed as earlier major versions of Polly, only stabilize and
improve. The following Nuget libraries are added to the demo solution, SwashBuckle Nuget also added here for Swagger support used when testing.

<ItemGroup>
  <PackageReference Include="Microsoft.Extensions.Http.Polly" Version="9.0.7" />
  <PackageReference Include="Microsoft.Extensions.Http.Resilience" Version="9.7.0" />
  <PackageReference Include="Swashbuckle.AspNetCore" Version="9.0.3" />
</ItemGroup>



The source code shown in this article is available to clone from my Github repo here: https://github.com/toreaurstadboss/HttpClientUsingPolly

Extension methods to add Polly v9 support http clients

The following extension methods offers creating a HttpClient via IHttpClientFactory or via a pipeline provided by ResiliencyProvider. Note that only the retry resilience strategy is shown here. There are multiple strategies available with Polly.

PollyExtensions.cs



using Microsoft.Extensions.Http.Resilience;
using Microsoft.Extensions.Logging;
using Polly;
using Polly.Retry;
using System.Net;
using System.Net.Http;
using System.Net.Http.Headers;

namespace HttpClientUsingPolly
{

    /// <summary>
    /// Contains helper methods to add support for Polly V9 resilience strategies
    /// </summary>
    public static class PollyExtensions
    {
      
        public static void AddPollyHttpClient(this IServiceCollection services)
        {
            services.AddHttpClient(GithubEndpoints.HttpClientName, client =>
                {
                    client.DefaultRequestHeaders.UserAgent.Add(new ProductInfoHeaderValue("MyApp", "1.0"));
                })
                .ConfigurePrimaryHttpMessageHandler(() =>
                {
                    var handler = new RandomHttpErrorHandler(errorChance: 75);
                    handler.InnerHandler = new HttpClientHandler(); // Assign the terminal handler
                    return handler;
                }) //IMPORTANT to make Polly retry here using ConfigurePrimaryHttpMessageHandler and set the Innerhandler to HttpClientHandler
                .AddResilienceHandler(RetryResiliencePolicy, builder =>
                {
                    var serviceProvider = services.BuildServiceProvider();
                    var logger = serviceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("NamedPolly");

                    var options = CreateRetryStrategyOptions(logger);
                    builder.AddRetry(options);
                });
        }    

        public static void AddNamedPollyPipelines(this IServiceCollection services)
        {
            services.AddResiliencePipeline<string>(RetryResiliencePolicy, builder =>
            {
                var serviceProvider = services.BuildServiceProvider();
                var logger = serviceProvider.GetRequiredService<ILoggerFactory>().CreateLogger("NamedPolly");

                builder.AddRetry(new RetryStrategyOptions
                {
                    MaxRetryAttempts = 3,
                    DelayGenerator = RetryDelaysClient,
                    ShouldHandle = new PredicateBuilder().Handle<HttpRequestException>(),
                    OnRetry = args =>
                    {
                        var httpEx = args.Outcome.Exception as HttpRequestException;
                        logger.LogInformation($"[NamedPolicy] Retrying due to: {httpEx?.Message}. Attempt: {args.AttemptNumber}");
                        return default;
                    }
                });
            });
        }

        private static HttpRetryStrategyOptions CreateRetryStrategyOptions(ILogger logger)
        {
            HttpRetryStrategyOptions options = new HttpRetryStrategyOptions
            {
                MaxRetryAttempts = 3,
                DelayGenerator = RetryDelaysPipeline,
                ShouldHandle = args =>
                {
                    if (args.Outcome.Exception is HttpRequestException ||
                        args.Outcome.Exception is TaskCanceledException)
                        return ValueTask.FromResult(true);

                    if (args.Outcome.Result is HttpResponseMessage response &&
                        TransientStatusCodes.Contains(response.StatusCode))
                        return ValueTask.FromResult(true);

                    return ValueTask.FromResult(false);
                },
                OnRetry = args =>
                {
                    logger.LogInformation($"Retrying... Attempt {args.AttemptNumber}");
                    return default;
                }
            };

            return options;
        }

        public const string RetryResiliencePolicy = "RetryResiliencePolicy";

        static readonly HttpStatusCode[] TransientStatusCodes = new[]
        {
            HttpStatusCode.RequestTimeout,      // 408
            HttpStatusCode.InternalServerError, // 500
            HttpStatusCode.BadGateway,          // 502
            HttpStatusCode.ServiceUnavailable,  // 503
            HttpStatusCode.GatewayTimeout       // 504
        };

        static Func<RetryDelayGeneratorArguments<HttpResponseMessage>, ValueTask<TimeSpan?>>? RetryDelaysPipeline =
             args => CommonDelayGenerator(args.AttemptNumber);

        static Func<RetryDelayGeneratorArguments<object>, ValueTask<TimeSpan?>>? RetryDelaysClient =
             args => CommonDelayGenerator(args.AttemptNumber);


        static ValueTask<TimeSpan?> CommonDelayGenerator(int attemptNumber)
        {
            var delay = attemptNumber switch
            {
                1 => TimeSpan.FromSeconds(1),
                2 => TimeSpan.FromSeconds(2),
                3 => TimeSpan.FromSeconds(4),
                _ => TimeSpan.FromSeconds(0) // fallback, shouldn't hit
            };
            return new ValueTask<TimeSpan?>(delay);
        }

    }
}



Note that the use of ConfigurePrimaryHttpMessageHandler here took a lot of time to find out. The Polly docs did not offer a good example of using IHttpClientFactory combined with throwing errors, which will be shown later in this article in the RandomHttpErrorHandler DelegatingHandler. It is also important to configure the primary http message handler here before the resilience handler is added using AddResilienceHandler. The following summary of resilience strategies shows that Polly offers more strategies than just the retry strategy. Every resilience strategy here can be combined to offer multiple resilience strategy to obtain the desired level of QoS = Quality of Service.
Polly Resilience Strategies
Strategy Description Can Be Combined?
Retry Retries a failed operation based on rules (e.g., delay, max attempts). ✅ Yes
Circuit Breaker Stops calls when failures exceed a threshold, allowing time to recover. ✅ Yes
Timeout Limits how long an operation can run before it's considered failed. ✅ Yes
Bulkhead Limits concurrent executions to prevent overload. ✅ Yes
Fallback Provides an alternative result or action when the primary fails. ✅ Yes
Rate Limiter Controls the rate of requests to avoid overwhelming a service. ✅ Yes


Adding support to test out random http request errors

To verify that the retry resilience strategy works, the following DelegatingHandler shown in the code in PollyExtensions will random throw HttpRequestException with a set estimated failure rate in percentage to be able to to end-to-end testing of retries. Debugging the endpoints to be defined later in this article shows the retries are working with this setup.

RandomHttpErrorHandler.cs



namespace HttpClientUsingPolly
{

    public class RandomHttpErrorHandler : DelegatingHandler
    {

        private readonly Random _random = new();
        private readonly double _errorChance;

        public RandomHttpErrorHandler(double errorChance)
        {
            _errorChance = errorChance;
        }

        protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
        {
            if (_random.NextDouble() < (_errorChance / 100))
            {
                // Pick a random transient status code
                var httpErrorsPossible = new[]
                {
                        System.Net.HttpStatusCode.RequestTimeout,        // 408
                        System.Net.HttpStatusCode.InternalServerError,   // 500
                        System.Net.HttpStatusCode.BadGateway,            // 502
                        System.Net.HttpStatusCode.ServiceUnavailable,    // 503
                        System.Net.HttpStatusCode.GatewayTimeout         // 504
                    };

                var chosenStatus = httpErrorsPossible[_random.Next(httpErrorsPossible.Length)];

                throw new HttpRequestException($"Simulated Http error: {(int)chosenStatus}", null, chosenStatus);

            }

            return await base.SendAsync(request, cancellationToken);
        }

    }
}




PollyPipelineHelper.cs

The following code makes it easier to use the ResiliencePipelineProvider that will look up configured resilience pipelines that are defined in the method AddNamedPollyPipelines further up in the article.



using Polly.Registry;

namespace HttpClientUsingPolly
{
    public static class PollyPipelineHelper
    {

        public static ValueTask<HttpResponseMessage> ExecuteWithPolicyAsync(
            this ResiliencePipelineProvider<string> pipelineProvider,
            string policyName,
            Func<CancellationToken, Task<HttpResponseMessage>> action,
            CancellationToken cancellationToken = default)
        {
            var pipeline = pipelineProvider.GetPipeline(policyName);

            return pipeline.ExecuteAsync(
                async ct => await action(ct),
                cancellationToken);
        }

    }
}





Program.cs

The folllowing setup is done in Program.cs, using the extension methods defined further up in the article. The setup below is the setup for the demo code, which is an Asp.net Web Api application. Minimal Api endpoints will be defined for the demo.



namespace HttpClientUsingPolly
{
    public class Program
    {
        public static void Main(string[] args)
        {
            var builder = WebApplication.CreateBuilder(args);

            // Add services to the container.

            builder.Services.AddControllers();

            builder.Services.AddSwaggerGen();

            builder.Services.AddPollyHttpClient(); //set up polly v9 enabled http client (http client will be created via IHttpClientFactory)
            builder.Services.AddNamedPollyPipelines(); // set up polly v9 enabled resilience pipepline (http client will be created via ResiliencePipelineProvider 

            var app = builder.Build();

            // Configure the HTTP request pipeline.

            app.UseHttpsRedirection();

            app.UseAuthorization();

            app.MapGitHubUserEndpoints();

            app.MapControllers();

            if (app.Environment.IsDevelopment())
            {
                app.UseSwagger();
                app.UseSwaggerUI();
            }

            app.Run();
        }
    }
}




Finally, the following Minimal Api endpoint methods first uses the resilience provider. As we can see, there is quite a bit of setup to make use of Polly using a resilience pipeline.

Minimal Api Endpoints using Polly enabled resilience pipeline

The following Github endpoints uses Polly resilience pipeline defined further up in the article. Both the IHttpClientFactory and ResiliencePipelineProvider are injected from DI container using the [FromService] attribute. There is some juggling to get to the httpClient to perform the request.

GithubEndpoints.cs



using Microsoft.AspNetCore.Mvc;
using Polly.Registry;
using System.Net.Http.Headers;
using System.Text.Json;

namespace HttpClientUsingPolly
{

    public static class GithubEndpoints
    {

        public const string HttpClientName = "GitHubClient";

        public static void MapGitHubUserEndpoints(this WebApplication app)
        {
            app.MapGet("/github-v1/{username}", async (
                string username,
                [FromServices] IHttpClientFactory httpClientFactory,
                [FromServices] ResiliencePipelineProvider<string> resiliencePipelineProvider) =>
            {
                string url = $"https://api.github.com/users/{username}";

                using var client = httpClientFactory.CreateClient(HttpClientName);
                client.DefaultRequestHeaders.UserAgent.Add(new ProductInfoHeaderValue("MyApp", "1.0"));

                var response = await resiliencePipelineProvider.ExecuteWithPolicyAsync(
                    PollyExtensions.RetryResiliencePolicy,
                    ct => client.GetAsync(url, ct));

                response.EnsureSuccessStatusCode();
                var json = await response.Content.ReadAsStringAsync();
                var user = JsonSerializer.Deserialize<JsonElement>(json);

                return Results.Json(user);
            });

            app.MapGet("/test-retry-v1", async (
                [FromServices] IHttpClientFactory httpClientFactory,
                [FromServices] ResiliencePipelineProvider<string> resiliencePipelineProvider) =>
            {
                using var client = httpClientFactory.CreateClient(HttpClientName);

                var response = await resiliencePipelineProvider.ExecuteWithPolicyAsync(
                    PollyExtensions.RetryResiliencePolicy,
                    ct => client.GetAsync("https://example.com", ct));

                return Results.Json(response);
            });

        }

    }

}




Simpler use of Polly via IHttpClientFactory

The following Minimal API endpoints shows a simpler usage of Polly, where the use of Polly retry resilience strategy are implicit. It was defined in the method AddPollyHttpClient further up in this article.


    //use keyed httpclient and do not go via pipeline provider 

    app.MapGet("/github-v2/{username}", async (
       string username,
       [FromServices] IHttpClientFactory httpClientFactory) =>
    {
        string url = $"https://api.github.com/users/{username}";
        using var client = httpClientFactory.CreateClient(HttpClientName);

        var response = await client.GetAsync(url);
        response.EnsureSuccessStatusCode();

        var json = await response.Content.ReadAsStringAsync();
        var user = JsonSerializer.Deserialize<JsonElement>(json);
        return Results.Json(user);
    });

    app.MapGet("/test-retry-v2", async (
        [FromServices] IHttpClientFactory httpClientFactory) =>
    {
        using var client = httpClientFactory.CreateClient(HttpClientName);

        var response = await client.GetAsync("https://example.com");

        return Results.Json(response);
    });


As shown above, the Minimal API endpoints above uses IHttpClientFactory. The complexity of Polly is hidden and we can focus in the minimal API method to instantiate our HttpClient and make request and then retrieve the response content and return the result in the minimal API endpoint.

Further resources - Videos showing more information about Polly

Polly Resilience Strategy Video Resources
Title Description Length Link
Visual Studio Toolbox Live – Ensuring Resilience with Polly Martin Costello walks through Polly strategies like Retry, Circuit Breaker, Timeout, and how to use them in .NET apps. 59:29 Watch
Learn Live – Implement Resiliency in a Cloud-Native ASP.NET Core Microservice Deep dive into code-based and infrastructure-based resiliency using Polly and service meshes like Linkerd. 1:25:06 Watch
Implementing Resilience Strategies with Polly in ASP.NET Core Step-by-step guide to applying retry, circuit breaker, and timeout policies in ASP.NET Core using Polly. ~15 min Watch
Coding Short: Resilient .NET Apps with Polly Shawn Wildermuth gives a concise overview of Polly with practical examples of retry and circuit breaker usage. 14:07 Watch
Building Resilient Cloud Services with .NET 8 | .NET Conf 2023 Explores .NET 8 resiliency features and Polly integration in cloud-native applications. ~45 min Watch

Monday, 28 July 2025

Azure Keyvault and HMAC-SHA256 Pseudonymizer

In this article, using Azure Keyvault together with HMAC-SHA256.

Introduction to HMAC SHA-256

The HMAC-SHA256 is a SHA-256 cryptographic hashing function that combines SHA-256 with a secret key (that can be shared) to provide both data integrity (to ensure that data has not been altered) and data authenticity (that data originates from a sender that knows about the shared secret key of the HMAC-SHA256 hash). HMAC-SHA256 generates a Message Authentication Code (MAC)
that we can get both these benefits from, data authenticity and data integrity. Since it is 256 bits or 32 bytes, the hash can be represented as hexadecimal string of length 64. If it is represented as a base-64 string, it will be approximately 44 bytes long, given that a base-64 string will be padded in multiple of 4 characters.

Storing the shared secret key in Azure Keyvault

Azure Keyvault will be used to store the shared secret key. The secret key could be stored anywhere, but using a KeyVault in Azure makes it easier to keep it safe and apply rolling policies for the secret key. First off, to create an Azure Keyvault secret, make sure you have an Azure Keyvault created. Search for a resource called Key vaults with a key icon. Choose Create, enter a Key vault name and Region and resource group, Pay per use and Standard pricing tier. (Premium includes HSM backed keys, which will use dedicated physical devices - HSM = Hardware Security Module - for enhanced FIPS 140-2 Level 3 certified security). Once the keyvault is created, choose Object and Secrets. Click Generate/Import. Just enter a name for the secret and the secret value. It is suggested that they secret value you enter should be genereated from a cryptographically secure random generator and a length of at least 16 bytes and 32 bytes.


Generating a strong shared secret key for HMAC SHA-256

The following code can be used to generate a strong 256 (32-byte) key, and pasted into the Secret value
HmacSha256KeyGenerator.cs


using System.Security.Cryptography;

namespace MinimalApiSecurityExperimentsDotNet.Extensions
{

    public static class HmacSha256KeyGenerator
    {

        public static string GenerateStrongKey()
        {
            // Generate a 256-bit (32-byte) key
            byte[] key = new byte[32];
            using (var rng = RandomNumberGenerator.Create())
            {
                rng.GetBytes(key);
            }

            // Convert to Base64 for storage or display
            string base64Key = Convert.ToBase64String(key);
            return base64Key;
            //Console.WriteLine("Generated HMAC-SHA-256 Key (Base64):");
            //Console.WriteLine(base64Key);
        }

    }

}



MinimalApiSecurityDemo.csproj
The following Nuget packages can be added to work with Azure Keyvault secrets.


  <PackageReference Include="Azure.Identity" Version="1.14.2" />
  <PackageReference Include="Azure.Security.KeyVault.Keys" Version="4.8.0" />
  <PackageReference Include="Azure.Security.KeyVault.Secrets" Version="4.8.0" />


Note that you do not need the Keys nuget package here if you only want to retrieve secrets. Azure KeyVault got three different object types - Keys, secrets and certificates. Only secrets will be looked at in this article.
KeyVaultSecretRetriever.cs
Let's look at key vault retrieval.


using Azure.Identity;
using Azure.Security.KeyVault.Secrets;

namespace MinimalApiSecurityExperimentsDotNet
{
    
    public class KeyVaultSecretRetriever
    {
        private readonly IConfiguration _configuration;
        public KeyVaultSecretRetriever(IConfiguration configuration)
        {
            _configuration = configuration;
        }

        public async Task<KeyVaultSecret>? GetSecretAsync(string secretName)
        {
            try
            {
                string keyVaultUri = _configuration["AzureKeyVault:VaultUri"] ?? throw new ArgumentNullException(nameof(keyVaultUri));
                var client = new SecretClient(new Uri(keyVaultUri), new DefaultAzureCredential());
                KeyVaultSecret secret = await client.GetSecretAsync(secretName);
                return secret;
            }
            catch (Exception ex)
            {
                Console.WriteLine($"Error retrieving the secret {secretName}: {ex.Message}");
                return null;
            }
        }     

    }

}


The SecretClient in the code above is the client used to retrieve the secret from Azure KeyVault. The client is from the Azure.Security.KeyVault.Secrets Nuget package. The DefaultAzureCredential used here means you will have to login in advance before retrieving the secret. There are different credential types you can use instead, but this default credential type is the easiest to use for testing out. If you run the code above from the console, you can for example install the Azure Powershell module and run az login. The following appsettings file can be used for the code above.
appsettings.json


{
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },
  "AllowedHosts": "*",

  "AzureKeyVault": {
    "VaultUri": "https://yourkeyvaultsomewhereinazure.vault.azure.net/",
    "HmacSha256SecretName":  "YourExampleHmacStrongKey"
  }

}


Pseudonymizer class

The following pseudonymizer class uses HMAC-SHA256 to generate a pseudonym for a given message. This can be used for generating a value for sensitive data with a key. The key can be shared between sender and receiver to avoid exposing sensitive values in clear text.
Pseudonymizer.cs


using System.Text;

namespace MinimalApiSecurityExperimentsDotNet
{

    public class Pseudonymizer
    {
        private readonly byte[]? _key;

        public Pseudonymizer(string key)
        {
            if (!string.IsNullOrWhiteSpace(key))
            {
                _key = Encoding.UTF8.GetBytes(key);
            }
        }

        /// <summary>
        /// Outputs a pseudonymized version of the input string using HMAC SHA256.       
        /// </summary>
        /// <param name="message"></param>
        /// <param name="outputToHexString">Output to hex string if true. If false, base-64 string is returned</param>
        /// <returns></returns>
        public string? Pseudonymize(string? message, bool outputToHexString = true)
        {
            if (string.IsNullOrWhiteSpace(message) || _key == null)
            {
                return message;
            }
            using var hmac = new System.Security.Cryptography.HMACSHA256(_key);
            var hash = hmac.ComputeHash(Encoding.UTF8.GetBytes(message));
            return outputToHexString ? Convert.ToHexString(hash) : Convert.ToBase64String(hash);
        }

        public bool Verify(string input, string pseudonym)
        {
            if (string.IsNullOrEmpty(input) || string.IsNullOrEmpty(pseudonym))
            {
                return false;
            }
            var computedPseudonym = Pseudonymize(input);
            return computedPseudonym == pseudonym;
        }

    }

}


The code above shows that we can both psedonymize and verify the pseudonym. Next up, a provider for creating an instance of this Pseudonymizer for use in ASP.net Core, for example.
PseudonymizerProvider.cs


namespace MinimalApiSecurityExperimentsDotNet.Extensions
{

    public class PseudonymizerProvider
    {

        private Pseudonymizer? _pseudonymizer;

        public void Set(Pseudonymizer pseudonymizer)
        {
            _pseudonymizer = pseudonymizer;
        }

        public Pseudonymizer Get()
        {
            return _pseudonymizer ?? throw new InvalidOperationException("Pseudonymizer not initalized");
        }

    }

}


The following Hosted service sets up the pseudonymizer service. It will start up when the Asp.net core application is starting, however after the DI container has been built.

PseudonymizerHostedService .cs



using Azure.Security.KeyVault.Secrets;

namespace MinimalApiSecurityExperimentsDotNet.Extensions
{

    public class PseudonymizerHostedService : IHostedService
    {

        private readonly IServiceProvider _provider;

        public PseudonymizerHostedService(IServiceProvider provider)
        {
            _provider = provider;
        }

        public async Task StartAsync(CancellationToken cancellationToken)
        {
            using var scope = _provider.CreateScope();
            var config = scope.ServiceProvider.GetRequiredService<IConfiguration>();
            var keyVaultRetriever = new KeyVaultSecretRetriever(config);
            var hmacSha256SecretName = config["AzureKeyVault:HmacSha256SecretName"];
            if (hmacSha256SecretName == null)
            {
                throw new InvalidOperationException($"Config '{hmacSha256SecretName}' not is missing.");
            }
            KeyVaultSecret? secret = await keyVaultRetriever.GetSecretAsync(hmacSha256SecretName);

            if (secret == null)
            {
                throw new InvalidOperationException($"Secret '{hmacSha256SecretName}' not found in Key Vault.");
            }

            var pseudonymizer = new Pseudonymizer(secret.Value);

            // Register the pseudonymizer in the pseudonymizerProvider
            var pseudonymizerProvider = scope.ServiceProvider.GetRequiredService<PseudonymizerProvider>();
            pseudonymizerProvider.Set(pseudonymizer);
        }

        public Task StopAsync(CancellationToken cancellationToken) => Task.CompletedTask;

    }

}


In the Program.cs of a sample Asp.net Web API with minimal API, the provider and the hosted service is registered before building the webapplication with .Build().

Program.cs



using MinimalApiSecurityExperimentsDotNet.Extensions;

namespace MinimalApiSecurityExperimentsDotNet
{
    public class Program
    {
        public static void Main(string[] args)
        {
            var builder = WebApplication.CreateBuilder(args);

            // Add services to the container.

            builder.Services.AddControllers();

            // Add Swagger services
            builder.Services.AddSwaggerGen();
            builder.Services.AddEndpointsApiExplorer();

            // Adding keyvault access via registering PseudonymizerHostedService 
            builder.Services.AddSingleton<PseudonymizerProvider>();
            builder.Services.AddHostedService<PseudonymizerHostedService>();

            var app = builder.Build();

            // Configure the HTTP request pipeline.

            app.UseHttpsRedirection();

            app.UseAuthorization();

            app.MapControllers();

            // Enable Swagger middleware 
            if (app.Environment.IsDevelopment())
            {
                app.UseSwagger();
                app.UseSwaggerUI();
            }
          
            app.MapGet("/generatestrongkey", () =>
            {
                return HmacSha256KeyGenerator.GenerateStrongKey();

            });

            app.MapGet("/pseudonymize", (string? key, string? value) =>
            {
                var pseudonym = new Pseudonymizer(key).Pseudonymize(value, outputToHexString: true);
                return Results.Json(pseudonym);
            });

            app.MapGet("/pseudonymize/verify", (string? key, string? value, string? pseudonym) =>
            {
                var pseudonymizer = new Pseudonymizer(key);
                var isValid = pseudonymizer.Verify(value, pseudonym);
                return Results.Json(isValid);
            });

            //Example using the injected singleton PseudonymizerProvider

            app.MapGet("/pseudo", (string? input, PseudonymizerProvider pseudonymizerProvider) =>
            {
                var pseudonymizer = pseudonymizerProvider.Get();
                var result = pseudonymizer.Pseudonymize(input); //pseudonymize the input using the inject Pseudonymizer instance. This will use HMAC SHA256 under the hood.
                return Results.Ok(new { message = input, pseudonym = result });
            });

            app.MapGet("/getkeyvaultsecret", async (string secretName) =>
            {
                var keyvaultRetriever = new KeyVaultSecretRetriever(builder.Configuration);
                var secret = await keyvaultRetriever.GetSecretAsync(secretName);
                return Results.Json(secret);
            });          

            app.Run(); 
        }
    }


}


The benefits of registering the pseudonymizer's hosted service and provider in the container is shown in the code above. We can easily pseudonymize and use Azure Key vault stored secret for the HMAC-SHA256 hash / pseudonoym.


 //Example using the injected singleton PseudonymizerProvider

app.MapGet("/pseudo", (string? input, PseudonymizerProvider pseudonymizerProvider) =>
{
    var pseudonymizer = pseudonymizerProvider.Get();
    var result = pseudonymizer.Pseudonymize(input); //pseudonymize the input using the inject Pseudonymizer instance. This will use HMAC SHA256 under the hood.
    return Results.Ok(new { message = input, pseudonym = result });
});


Summary

The pseudonymizer is initialized and registered as a singleton, it got a dependency against Azure Keyvault service at startup, but further on pseudonymizing can now use the singleton instance of the pseudonymizer that is registered by the hosted service at application startup. The pseudonymizer can for example pseudonymize sensitive values and hide their content. A receiver can be shown this pseudonymized value in the response. There pseudonymized value could also be described as for example one of these three descriptions:
  • Key identifier / alias
  • Obfuscated key named
  • Derived key label
If the receiver got the shared secret key, since it is a one-way cryptographic algorithm, obtaining the original value is still only possible via a brute-force dictionary attack. However, it can be used for example as a pseudo-id that is shared and also identify for example a shared identifier, for example a patient identifier for multiple registered documents in a database for example. The pseudo id can be even stored in the database as a way of obfuscating sensitive values such a SSN / PID (Patient Id, SSN = Social Security Number).

Note about Keyvault access

Just because you know the url to an Azure keyvault and possible the secret's name, does of course not mean you got access to the secret. Inside the Azure Keyvault, clik on Access Control (IAM) to get started. To just test things out, follow the guide by clicking the button Add role assignment. Follow the wizard to gain access to your key vault. Search for role Key Vault Administrator. Click Next. Choose Select members to choose for example your own user. Click Next Click Review and assign. Finally you have added access to your Key vault. This must be done even for the Key vault you have created yourself. Of course, if you use Azure AD, you can choose different members here and authorize fine-grained access.