fix(storage): send upload headers per request

packages/Storage/Storage.Tests/Files/ResumableUploadContractTests.cs

@@ -2,6 +2,7 @@
 using System.Globalization;
 using System.IO;
 using System.Linq;
+using System.Net.Http;
 using System.Threading.Tasks;
 using FluentAssertions;
 using FluentAssertions.Execution;
@@ -90,6 +91,24 @@ public async Task UploadOrResume_ShouldCloseTheLocalFile()
             File.Delete(path);
         }
 
+        [TestMethod]
+        public async Task UploadOrResume_ShouldNotPutHeadersOnTheSharedHttpClient()
+        {
+            using var injectedClient = new HttpClient();
+            injectedClient.DefaultRequestHeaders.Add("X-Injected", "true");
+            var storage = new Client($"{this.server.Url}/storage/v1", new ClientOptions { HttpUploadClient = injectedClient },
+                new Dictionary<string, string> { { "Authorization", "Bearer test-key" } });
+            await storage.From(Bucket).UploadOrResume(Payload, FileName, new FileOptions());
+            using (new AssertionScope())
+            {
+                injectedClient.DefaultRequestHeaders.Select(header => header.Key).Should().Equal(new[] { "X-Injected" },
+                    "an upload must not leave its headers on a client other uploads share (issue #469)");
+                this.server.LogEntries.Select(entry => entry.RequestMessage!.Headers!.Keys).Should().OnlyContain(
+                    keys => keys.Contains("Authorization") && keys.Contains("X-Injected"),
+                    "every TUS request must carry both the upload's headers and the caller's own (issue #469)");
+            }
+        }
+
         private void StubTusEndpoints()
         {
             var length = Payload.Length.ToString(CultureInfo.InvariantCulture);

packages/Storage/Storage.Tests/Files/StorageFileApiContractTests.cs

@@ -2,6 +2,7 @@
 using System.IO;
 using System.Linq;
 using System.Collections.Generic;
+using System.Net.Http;
 using System.Text;
 using System.Threading.Tasks;
 using FluentAssertions;
@@ -278,6 +279,23 @@ public async Task Upload_ShouldReportProgress_GivenAProgressHandler()
         onProgress.Received().Invoke(Arg.Any<object>(), Arg.Any<float>());
     }
 
+    [TestMethod]
+    public async Task Upload_ShouldNotPutHeadersOnTheSharedHttpClient()
+    {
+        using var injectedClient = new HttpClient();
+        injectedClient.DefaultRequestHeaders.Add("X-Injected", "true");
+        var storage = new Client($"{this.server.Url}/storage/v1", new ClientOptions { HttpUploadClient = injectedClient },
+            new Dictionary<string, string> { { "Authorization", "Bearer test-key" } });
+        this.Respond($"/storage/v1/object/{Bucket}/a.bin", "POST", 200, "{\"Key\":\"x\"}");
+        await storage.From(Bucket).Upload(new byte[] { 0x1 }, "a.bin");
+        using (new AssertionScope())
+        {
+            injectedClient.DefaultRequestHeaders.Select(header => header.Key).Should().Equal(new[] { "X-Injected" },
+                "an upload must not leave its headers on a client other uploads share (issue #469)");
+            this.SingleRequest().Headers.Should().ContainKey("X-Injected", "the caller's own default headers must still be sent (issue #469)");
+        }
+    }
+
     [TestMethod]
     public async Task Download_ShouldGetBytesFromTheObjectPath()
     {

packages/Storage/Storage/Extensions/HttpClientProgress.cs

@@ -195,17 +195,16 @@ public static async Task<HttpResponseMessage> UploadAsync(
     )
     {
         var content = new ProgressableStreamContent(stream, 4096, progress);
+        var request = new HttpRequestMessage(HttpMethod.Post, uri) { Content = content };
 
         if (headers != null)
         {
-            client.DefaultRequestHeaders.Clear();
-
             foreach (var header in headers)
             {
                 if (header.Key.Contains("content"))
                     content.Headers.Add(header.Key, header.Value);
                 else
-                    client.DefaultRequestHeaders.Add(header.Key, header.Value);
+                    request.Headers.Add(header.Key, header.Value);
             }
         }
 
@@ -217,7 +216,7 @@ public static async Task<HttpResponseMessage> UploadAsync(
 
         try
         {
-            var response = await client.PostAsync(uri, content, cancellationToken);
+            var response = await client.SendAsync(request, cancellationToken).ConfigureAwait(false);
             statusCode = (int) response.StatusCode;
             activity.SetHttpResponseTags(statusCode.Value);
 
@@ -315,12 +314,14 @@ private static async Task<HttpResponseMessage> ResumableUploadAsync(
             fileStream.Seek(0, SeekOrigin.Begin);
         }
 
+        // Copied and validated up front, not in AddHeaders: BirdMessenger swallows exceptions from that
+        // callback, and the caller's dictionary can change during a long upload.
+        var uploadHeaders = new HttpRequestMessage().Headers;
         if (headers != null)
         {
-            client.DefaultRequestHeaders.Clear();
             foreach (var header in headers)
             {
-                client.DefaultRequestHeaders.Add(header.Key, header.Value);
+                uploadHeaders.Add(header.Key, header.Value);
             }
         }
 
@@ -347,6 +348,7 @@ private static async Task<HttpResponseMessage> ResumableUploadAsync(
                     Endpoint = uri,
                     Metadata = metadata,
                     UploadLength = fileStream.Length,
+                    OnPreSendRequestAsync = AddHeaders,
                 };
 
                 try
@@ -384,6 +386,7 @@ private static async Task<HttpResponseMessage> ResumableUploadAsync(
                     return Task.CompletedTask;
                 },
                 OnFailedAsync = _ => Task.CompletedTask,
+                OnPreSendRequestAsync = AddHeaders,
             };
 
             var responsePatch = await client.TusPatchAsync(patchOption, cancellationToken);
@@ -406,6 +409,14 @@ private static async Task<HttpResponseMessage> ResumableUploadAsync(
         {
             StorageInstrumentation.RecordTransfer(StorageInstrumentation.DirectionUpload, HttpMethod.Post, uri, bytes, statusCode, errorType, startTimestamp);
         }
+
+        Task AddHeaders(PreSendRequestEvent preSend)
+        {
+            foreach (var header in uploadHeaders)
+                preSend.HttpRequestMsg.Headers.Add(header.Key, header.Value);
+
+            return Task.CompletedTask;
+        }
     }
 
     private static Task ReportProgressAsync(