Added missing lock (#1813)

AzureAD · Jul 20, 2022 · 2f476f8 · 2f476f8
1 parent 7ed37da
commit 2f476f8
Showing 1 changed file with 8 additions and 5 deletions.
diff --git a/src/Microsoft.Identity.Web/Resource/ScopesRequiredHttpContextExtensions.cs b/src/Microsoft.Identity.Web/Resource/ScopesRequiredHttpContextExtensions.cs
@@ -78,11 +78,14 @@ public static void VerifyUserHasAnyAcceptedScope(this HttpContext context, param
                 if (scopeClaim == null || !scopeClaim.Value.Split(' ').Intersect(acceptedScopes).Any())
                 {
                     string message = string.Format(CultureInfo.InvariantCulture, IDWebErrorMessage.MissingScopes, string.Join(",", acceptedScopes));
-
-                    context.Response.StatusCode = (int)HttpStatusCode.Forbidden;
-                    context.Response.WriteAsync(message);
-                    context.Response.CompleteAsync();
-
+
+                    lock (context)
+                    {
+                        context.Response.StatusCode = (int)HttpStatusCode.Forbidden;
+                        context.Response.WriteAsync(message);
+                        context.Response.CompleteAsync();
+                    }
+
                     throw new UnauthorizedAccessException(message);
                 }
             }