1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

// In .NET Core / .NET 5+
public void ConfigureServices(IServiceCollection services)
{
    // One instance per HTTP request (scope)
    services.AddScoped<IUserContext, HttpUserContext>();
    
    // One DbContext per request - essential for transaction coherence
    services.AddScoped<ApplicationDbContext>();
    
    // One IOrderService per request - shares DbContext with repository
    services.AddScoped<IOrderService, OrderService>();
    
    // Factory-based scoped registration
    services.AddScoped<IRequestLogger>(provider =>
    {
        var httpContext = provider.GetRequiredService<IHttpContextAccessor>();
        var requestId = httpContext.HttpContext?.TraceIdentifier ?? Guid.NewGuid().ToString();
        return new RequestLogger(requestId);
    });
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

// In Spring, scoped beans have several built-in scopes
@Configuration
public class AppConfig {
    
    // One instance per HTTP request
    @Bean
    @Scope(value = WebApplicationContext.SCOPE_REQUEST, 
           proxyMode = ScopedProxyMode.TARGET_CLASS)
    public UserContext userContext(HttpServletRequest request) {
        return new HttpUserContext(request);
    }
    
    // One instance per HTTP session
    @Bean
    @Scope(value = WebApplicationContext.SCOPE_SESSION,
           proxyMode = ScopedProxyMode.TARGET_CLASS)
    public ShoppingCart shoppingCart() {
        return new ShoppingCart();
    }
}
 
// Using component annotation
@Component
@Scope(value = "request", proxyMode = ScopedProxyMode.TARGET_CLASS)
public class RequestAuditContext {
    private final List<AuditEntry> entries = new ArrayList<>();
    private final Instant createdAt = Instant.now();
    
    public void recordAction(String action) {
        entries.add(new AuditEntry(action, Instant.now()));
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

// In NestJS, REQUEST scope provides per-request instances
import { Injectable, Scope, Inject } from '@nestjs/common';
import { REQUEST } from '@nestjs/core';
import { Request } from 'express';
 
@Injectable({ scope: Scope.REQUEST })
export class UserContext {
    private readonly userId: string;
    private readonly requestId: string;
    
    constructor(@Inject(REQUEST) private readonly request: Request) {
        this.userId = request.headers['x-user-id'] as string;
        this.requestId = request.headers['x-request-id'] as string;
        console.log(`UserContext created for request ${this.requestId}`);
    }
    
    getCurrentUserId(): string {
        return this.userId;
    }
}
 
// Controller using scoped service
@Controller('orders')
export class OrdersController {
    // Each request gets a fresh controller instance (request-scoped)
    // and fresh UserContext instance
    constructor(
        private readonly userContext: UserContext,
        private readonly orderService: OrderService,
    ) {}
    
    @Get()
    findMyOrders() {
        const userId = this.userContext.getCurrentUserId();
        return this.orderService.findByUser(userId);
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61

// Scenario 1: Automatic scope (Web Request)
// In ASP.NET Core, middleware creates scope for each request automatically
 
public class OrdersController : ControllerBase
{
    private readonly ApplicationDbContext _db; // Scoped
    private readonly IOrderService _orderService; // Scoped
    
    // Both are automatically scoped to this HTTP request
    // When request ends, both are disposed
    
    public OrdersController(ApplicationDbContext db, IOrderService orderService)
    {
        _db = db;
        _orderService = orderService;
        
        // Both instances are the SAME throughout this request
        // If OrderService internally uses the same ApplicationDbContext,
        // it receives the SAME instance - sharing the DbContext connection
    }
}
 
// Scenario 2: Manual scope (Background Service)
public class OrderProcessorBackgroundService : BackgroundService
{
    private readonly IServiceProvider _serviceProvider;
    
    public OrderProcessorBackgroundService(IServiceProvider serviceProvider)
    {
        _serviceProvider = serviceProvider;
        // Note: Cannot inject scoped services directly here!
        // Background services are singletons - scoped would be captured
    }
    
    protected override async Task ExecuteAsync(CancellationToken stoppingToken)
    {
        while (!stoppingToken.IsCancellationRequested)
        {
            var pendingOrders = await GetPendingOrders();
            
            foreach (var order in pendingOrders)
            {
                // Create explicit scope for each order processing
                using (var scope = _serviceProvider.CreateScope())
                {
                    // Resolve scoped services from this scope
                    var processor = scope.ServiceProvider
                        .GetRequiredService<IOrderProcessor>();
                    var db = scope.ServiceProvider
                        .GetRequiredService<ApplicationDbContext>();
                    
                    await processor.ProcessAsync(order);
                    await db.SaveChangesAsync();
                    
                } // Scope ends - DbContext disposed, connections returned
            }
            
            await Task.Delay(TimeSpan.FromSeconds(10), stoppingToken);
        }
    }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

// Scopes survive async boundaries - same instance, possibly different threads
public class OrderController : ControllerBase
{
    private readonly ApplicationDbContext _db;
    private readonly IEmailSender _emailSender;
    
    public OrderController(ApplicationDbContext db, IEmailSender emailSender)
    {
        _db = db;
        _emailSender = emailSender;
        Console.WriteLine($"Thread at construction: {Environment.CurrentManagedThreadId}");
    }
    
    [HttpPost]
    public async Task<IActionResult> CreateOrder(OrderRequest request)
    {
        Console.WriteLine($"Thread before await: {Environment.CurrentManagedThreadId}");
        
        var order = new Order(request);
        _db.Orders.Add(order);
        await _db.SaveChangesAsync(); // May resume on different thread
        
        Console.WriteLine($"Thread after first await: {Environment.CurrentManagedThreadId}");
        
        await _emailSender.SendOrderConfirmationAsync(order); // May change again
        
        Console.WriteLine($"Thread after second await: {Environment.CurrentManagedThreadId}");
        
        // Despite potentially executing on 3-4 different threads,
        // _db is the SAME instance throughout - the scope didn't change
        
        return Ok(order.Id);
    }
}
 
/* Possible output:
Thread at construction: 4
Thread before await: 4
Thread after first await: 7     <-- Different thread!
Thread after second await: 12   <-- Different thread again!
 
But _db is the same instance throughout - scope transcends threads */

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59

// Correct: DbContext shared within request scope
services.AddScoped<ApplicationDbContext>();
services.AddScoped<IOrderRepository, OrderRepository>();
services.AddScoped<ICustomerRepository, CustomerRepository>();
services.AddScoped<IOrderService, OrderService>();
 
public class OrderService : IOrderService
{
    private readonly ApplicationDbContext _db;
    private readonly IOrderRepository _orderRepo;
    private readonly ICustomerRepository _customerRepo;
    
    public OrderService(
        ApplicationDbContext db,
        IOrderRepository orderRepo,
        ICustomerRepository customerRepo)
    {
        _db = db;
        _orderRepo = orderRepo;
        _customerRepo = customerRepo;
        
        // All three receive the SAME DbContext instance
        // because all are scoped to the same request
    }
    
    public async Task<Order> CreateOrderAsync(OrderRequest request)
    {
        // 1. Load customer (through repository, using shared DbContext)
        var customer = await _customerRepo.GetByIdAsync(request.CustomerId);
        
        // 2. Create order entity
        var order = new Order
        {
            Customer = customer, // Entity already tracked by DbContext
            Items = request.Items.Select(i => new OrderItem(i)).ToList()
        };
        
        // 3. Persist order (through repository, using shared DbContext)
        await _orderRepo.AddAsync(order);
        
        // 4. Update customer statistics
        customer.TotalOrders++;
        customer.LastOrderDate = DateTime.UtcNow;
        // No explicit save - customer is tracked by same DbContext
        
        // 5. Single SaveChanges commits everything atomically
        await _db.SaveChangesAsync();
        // Both order CREATE and customer UPDATE in one transaction
        
        return order;
    }
    
    // If DbContext were transient:
    // - customerRepo.GetByIdAsync uses DbContext #1
    // - orderRepo.AddAsync uses DbContext #2  
    // - customer update would be on DbContext #1 (orphaned)
    // - SaveChangesAsync on _db (#3) saves nothing useful!
    // = Data corruption
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

HTTP Request Arrives
│
├── Request Scope Created
│   │
│   ├── Resolve OrderController
│   │   ├── Resolve ApplicationDbContext → Creates DbContext #1
│   │   ├── Resolve IOrderService
│   │   │   ├── Resolve ApplicationDbContext → Returns DbContext #1 (SAME!)
│   │   │   ├── Resolve IOrderRepository
│   │   │   │   └── Resolve ApplicationDbContext → Returns DbContext #1 (SAME!)
│   │   │   └── Resolve ICustomerRepository
│   │   │       └── Resolve ApplicationDbContext → Returns DbContext #1 (SAME!)
│   │   └── OrderService ready
│   │
│   ├── Execute Controller Action
│   │   └── All operations use DbContext #1
│   │       ├── Queries tracked
│   │       ├── Inserts tracked
│   │       ├── Updates tracked
│   │       └── SaveChangesAsync → Single atomic transaction
│   │
│   └── Request Scope Ends
│       └── DbContext #1.Dispose() called → Connection returned to pool
│
└── HTTP Response Sent
 
Next Request → DbContext #2 created (fresh scope, fresh instance)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80

// Service that reports its identity
public class ScopedCounter : IScopedCounter
{
    private static int _globalInstanceCount = 0;
    private int _callCount = 0;
    public int InstanceId { get; }
 
    public ScopedCounter()
    {
        InstanceId = Interlocked.Increment(ref _globalInstanceCount);
        Console.WriteLine($"ScopedCounter #{InstanceId} created");
    }
    
    public int Increment() => ++_callCount;
}
 
services.AddScoped<IScopedCounter, ScopedCounter>();
 
// Controller demonstrating scoped sharing
public class TestController : ControllerBase
{
    private readonly IScopedCounter _counter1;
    private readonly IScopedCounter _counter2;
    private readonly INestedService _nested;
    
    public TestController(
        IScopedCounter counter1,
        IScopedCounter counter2,
        INestedService nested)
    {
        _counter1 = counter1;
        _counter2 = counter2;
        _nested = nested;
    }
    
    [HttpGet("test-scoped")]
    public IActionResult TestScoped()
    {
        // counter1 and counter2 are THE SAME INSTANCE
        Console.WriteLine($"counter1 ID: {_counter1.InstanceId}");
        Console.WriteLine($"counter2 ID: {_counter2.InstanceId}");
        Console.WriteLine($"Same instance: {ReferenceEquals(_counter1, _counter2)}");
        
        _counter1.Increment();
        _counter1.Increment();
        
        // counter2 sees the increments because it's the same instance!
        var count = _counter2.Increment(); // Returns 3
        
        // NestedService also received same instance
        var nestedCount = _nested.GetCounterValue(); // Also sees 3
        
        return Ok(new { InstanceId = _counter1.InstanceId, Count = count });
    }
}
 
public class NestedService : INestedService
{
    private readonly IScopedCounter _counter;
    
    public NestedService(IScopedCounter counter)
    {
        _counter = counter; // Same instance as controller received
    }
    
    public int GetCounterValue() => _counter.Increment();
}
 
/* Output for first request:
ScopedCounter #1 created
counter1 ID: 1
counter2 ID: 1
Same instance: True
 
Output for second request:
ScopedCounter #2 created  <-- New instance for new scope!
counter1 ID: 2
counter2 ID: 2
Same instance: True
*/

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94

// Pattern 1: Console app processing batches
public class BatchProcessor
{
    private readonly IServiceProvider _rootProvider;
    
    public BatchProcessor(IServiceProvider rootProvider)
    {
        _rootProvider = rootProvider;
    }
    
    public async Task ProcessBatchAsync(IEnumerable<WorkItem> items)
    {
        foreach (var item in items)
        {
            // Each work item gets its own scope
            await using (var scope = _rootProvider.CreateAsyncScope())
            {
                var handler = scope.ServiceProvider
                    .GetRequiredService<IWorkItemHandler>();
                var db = scope.ServiceProvider
                    .GetRequiredService<ApplicationDbContext>();
                
                try
                {
                    await handler.HandleAsync(item);
                    await db.SaveChangesAsync();
                }
                catch (Exception ex)
                {
                    // Rollback is automatic - scope disposal discards DbContext
                    _logger.LogError(ex, "Failed to process {ItemId}", item.Id);
                }
            } // Scope disposes - DbContext disposed, changes discarded if not saved
        }
    }
}
 
// Pattern 2: Message queue consumer
public class MessageConsumerService : BackgroundService
{
    private readonly IServiceProvider _services;
    private readonly IMessageQueue _queue;
    
    protected override async Task ExecuteAsync(CancellationToken ct)
    {
        await foreach (var message in _queue.ConsumeAsync(ct))
        {
            // Each message = one scope = one "unit of work"
            await using var scope = _services.CreateAsyncScope();
            
            var messageType = message.GetType();
            var handlerType = typeof(IMessageHandler<>).MakeGenericType(messageType);
            var handler = scope.ServiceProvider.GetRequiredService(handlerType);
            
            await ((dynamic)handler).HandleAsync((dynamic)message, ct);
        }
    }
}
 
// Pattern 3: Parallel processing with scope isolation
public async Task ProcessParallelAsync(IEnumerable<Order> orders)
{
    await Parallel.ForEachAsync(orders, async (order, ct) =>
    {
        // Each parallel execution gets isolated scope
        await using var scope = _services.CreateAsyncScope();
        
        var processor = scope.ServiceProvider
            .GetRequiredService<IOrderProcessor>();
        
        // Safe: each parallel branch has own DbContext
        await processor.ProcessAsync(order, ct);
    });
}
 
// Pattern 4: Desktop app with explicit transactions
public class OrderFormViewModel
{
    private readonly IServiceProvider _services;
    
    public async Task SubmitOrderAsync()
    {
        // UI operation = one scope
        await using var scope = _services.CreateAsyncScope();
        
        var orderService = scope.ServiceProvider.GetRequiredService<IOrderService>();
        var result = await orderService.CreateOrderAsync(this.OrderData);
        
        if (result.IsSuccess)
        {
            MessageBox.Show("Order submitted!");
        }
    } // Scope ends - resources released even if UI stays open
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

// ❌ CRITICAL BUG: Singleton captures scoped dependency
services.AddScoped<ApplicationDbContext>();
services.AddSingleton<ICacheService, CacheService>(); // PROBLEM
 
public class CacheService : ICacheService
{
    private readonly ApplicationDbContext _db; // ⚠️ CAPTURED!
    
    public CacheService(ApplicationDbContext db)
    {
        _db = db;
        // This DbContext was created when CacheService was first resolved
        // It will live for the ENTIRE application lifetime
        // Not just one request!
    }
    
    public async Task<User> GetUserAsync(int id)
    {
        // First request: DbContext is fresh, this works
        // Second request: DbContext is stale, tracking entities from request #1
        // 100th request: DbContext has 100 requests worth of tracked entities
        // Eventually: Memory exhaustion, stale data, connection timeout
        return await _db.Users.FindAsync(id);
    }
}
 
/* What happens at runtime:
1. First HTTP request arrives
2. CacheService (singleton) needs to be created
3. CacheService requests ApplicationDbContext (scoped)
4. Container creates DbContext #1 for this scope
5. CacheService stores reference to DbContext #1
6. Request completes - scope SHOULD dispose DbContext #1
7. But CacheService (singleton) still holds reference!
8. DbContext #1 lives forever, accumulating tracked entities
9. Second request arrives - new scope, new DbContext #2
10. But CacheService still uses DbContext #1!
11. = Stale data, cross-request contamination, eventual crash */

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61

// Solution 1: Make the consumer scoped too (if possible)
services.AddScoped<ICacheService, CacheService>();
// Now CacheService and DbContext have same lifetime - no capture
 
// Solution 2: Inject IServiceProvider and resolve per-operation
services.AddSingleton<ICacheService, SafeCacheService>();
 
public class SafeCacheService : ICacheService
{
    private readonly IServiceProvider _services;
    
    public SafeCacheService(IServiceProvider services)
    {
        _services = services;
    }
    
    public async Task<User> GetUserAsync(int id)
    {
        // Create scope for each operation
        await using var scope = _services.CreateAsyncScope();
        var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
        return await db.Users.FindAsync(id);
    } // Scope ends, DbContext disposed - no capture
}
 
// Solution 3: Use IServiceScopeFactory (preferred for singletons)
services.AddSingleton<ICacheService, BetterCacheService>();
 
public class BetterCacheService : ICacheService
{
    private readonly IServiceScopeFactory _scopeFactory;
    
    public BetterCacheService(IServiceScopeFactory scopeFactory)
    {
        _scopeFactory = scopeFactory;
    }
    
    public async Task<User> GetUserAsync(int id)
    {
        await using var scope = _scopeFactory.CreateAsyncScope();
        var db = scope.ServiceProvider.GetRequiredService<ApplicationDbContext>();
        return await db.Users.FindAsync(id);
    }
}
 
// Solution 4: Inject factory delegate
services.AddSingleton<ICacheService, FactoryCacheService>();
services.AddScoped<ApplicationDbContext>();
services.AddSingleton<Func<ApplicationDbContext>>(sp =>
{
    return () => sp.CreateScope().ServiceProvider
        .GetRequiredService<ApplicationDbContext>();
});
 
// ✅ Modern .NET validation: Enable scope validation
// In Program.cs, this catches captive dependencies at startup!
builder.Host.UseDefaultServiceProvider(options =>
{
    options.ValidateScopes = true;  // Throws if scoped resolved from root
    options.ValidateOnBuild = true; // Validates DI graph at startup
});

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

// Pattern: Ambient request context
services.AddScoped<IRequestContext, HttpRequestContext>();
 
public class HttpRequestContext : IRequestContext
{
    public string RequestId { get; }
    public string UserId { get; }
    public DateTime StartedAt { get; }
    
    public HttpRequestContext(IHttpContextAccessor accessor)
    {
        var httpContext = accessor.HttpContext!;
        RequestId = httpContext.TraceIdentifier;
        UserId = httpContext.User.FindFirst(ClaimTypes.NameIdentifier)?.Value;
        StartedAt = DateTime.UtcNow;
    }
}
 
// Now any service can inject IRequestContext and get per-request values
public class AuditService : IAuditService
{
    private readonly IRequestContext _context;
    private readonly ApplicationDbContext _db;
    
    public async Task LogActionAsync(string action)
    {
        _db.AuditLogs.Add(new AuditLog
        {
            RequestId = _context.RequestId,
            UserId = _context.UserId,
            Action = action,
            Timestamp = DateTime.UtcNow
        });
        // SaveChanges handled by Unit of Work pattern at request end
    }
}