Recommended Free Tools
A timeout does not prove that an operation failed. The server may have committed a new order or database record before the response was lost, so a client that retries blindly can apply the same effect twice. To prevent duplicate records, make retries match the operation’s semantics and have the server recognize repeated logical requests using a stable identifier, such as an idempotency key.
Why a timeout can create a duplicate
A retry is another attempt after a transient failure or timeout. But a timed-out client often cannot tell whether the server never received the request, failed before committing it, or completed the operation and lost the response on its way back. Microsoft cautions that retrying a POST that inserts a database record can create duplicate data. Microsoft’s HTTP resilience guidance describes this risk.
As an Amazon Associate I earn from qualifying purchases.
For example, an API client sends a request to create an order. The server saves the order, but the response times out. If the client sends the same creation request again and the server treats it as a new operation, the customer may end up with two orders. The client’s uncertainty is the problem: the timeout alone does not reveal what happened on the server.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Is repeating this HTTP operation safe?
HTTP idempotency concerns the intended effect on resource state: repeating an identical request should have the same intended effect as processing it once. It does not require identical response bytes, and it is not the same as safety. A method can change state and still be idempotent. Microsoft’s HTTP method overview classifies methods as follows:
#1 Best Overall
| Methods | HTTP semantics | What that means for retries |
|---|---|---|
| GET, HEAD, OPTIONS, TRACE | Idempotent | Repeated requests are defined to have the same intended effect on state. |
| PUT, DELETE | Idempotent | Repeated requests are defined to have the same intended effect on state, though they can modify or remove state. |
| POST, PATCH, CONNECT | Non-idempotent by default | Repeating a request can apply an effect again. |
The method is a useful signal, not proof of what a particular endpoint does. An application might implement a POST operation to be duplicate-aware, or make an endpoint behave differently from what its method’s usual semantics suggest. Evaluate the operation itself before enabling retries.
What the standard .NET HTTP retry handler does
Microsoft’s current guidance uses Microsoft.Extensions.Http.Resilience for resilient HttpClient pipelines. The standard handler retries all HTTP methods by default, which can be risky for operations that create records or otherwise apply non-idempotent effects. The documentation provides DisableFor(HttpMethod.Post, HttpMethod.Delete) to exclude those methods, and DisableForUnsafeHttpMethods() to exclude POST, PATCH, PUT, DELETE, and CONNECT. Choose based on the behavior of your endpoints and whether repeated requests are protected against duplicates.
Rank #2
The documented standard pipeline orders its strategies as rate limiter, total timeout, retry, circuit breaker, and per-attempt timeout. Its defaults are package defaults to inspect and configure deliberately, not a universal policy for every workload:
| Setting | Documented standard-handler default |
|---|---|
| Concurrency limiter | 1,000 permits; no queue |
| Total timeout | 30 seconds |
| Retries | Up to three attempts, using exponential backoff with jitter and a two-second delay |
| Circuit breaker | 10% failure ratio; minimum throughput of 100; 30-second sampling duration; five-second break duration |
| Per-attempt timeout | 10 seconds |
The standard handler’s retry and circuit-breaker strategies handle HTTP 500 and above, 408, 429, HttpRequestException, and TimeoutRejectedException, according to Microsoft’s documentation. Whether another attempt is appropriate still depends on whether the operation can safely be repeated.
For current package direction, Microsoft identifies Microsoft.Extensions.Http.Resilience for HTTP clients and Microsoft.Extensions.Resilience for broader application mechanisms; both are built on Polly. Microsoft says Microsoft.Extensions.Http.Polly is deprecated. See the .NET resilience overview for the package context.
How an idempotency key prevents duplicate effects
An idempotency key is a stable identifier for one logical operation. A client reuses that identifier when retrying the same operation; the server records or otherwise tracks processed identifiers so it can recognize a repeat instead of applying the effect as a new operation. The key turns two delivery attempts into one identifiable logical request.
This is an application-level design pattern, not a universal HTTP header contract established by the cited Microsoft guidance. Microsoft’s Azure Architecture Center says to first determine whether an operation is naturally idempotent and, if not, apply artificial idempotency by tracking processed message IDs and handling duplicates proactively or reactively. See its guidance on idempotent consumers. The same duplicate-tracking idea can be applied to API requests, with the API defining the contract.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsBefore implementing request deduplication, document these decisions:
Best Value
- Applying all key ASP.NET Core components, including MVC for HTML generation, .NET Core, EF Core, ASP.NET Identity, dependency injection, and more
- Integrating ASP.NET Core with leading client-side frameworks, including Bootstrap
- ASP.NET Core code for implementing business logic and data transformations
- Handling configuration, routing, controllers, views, and common tasks (including posting forms and presenting data)
- Performing complementary tasks: error handling, logging, application design, authentication, localization, and more
- Identity: What uniquely identifies one logical operation, and how does the client retain and reuse that identifier for retries?
- Scope: Is the identifier unique per account, endpoint, or another defined boundary?
- Payload reuse: What happens if a client reuses an identifier with a different request body?
- Concurrency: How are simultaneous requests carrying the same identifier serialized or reconciled?
- Retention: How long does the server retain processed identifiers, and what behavior applies after expiry?
- Duplicate response: Does a repeated request receive the original result, a status indicating prior processing, or another documented response?
These choices are not specified as universal rules by Microsoft’s duplicate-tracking guidance. For a third-party payment or API service, follow that provider’s contract rather than assuming a header name, key lifetime, or replay behavior.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Choose retry policy and duplicate handling together
A retry policy decides whether the client makes another attempt after a failure. Duplicate tracking lets the server identify whether that attempt represents an operation it has already processed. They address different failure modes, so neither is a substitute for the other.
| Approach | Best fit | Trade-off |
|---|---|---|
| Rely on natural idempotency | The operation’s repeated effect is already equivalent to one execution. | Simple to retry, but confirm the endpoint really preserves the intended state. |
| Track request or message identifiers | A repeated non-idempotent operation must not apply its effect twice. | Protects the logical operation, but requires a clearly defined server-side duplicate contract. |
| Retry across all methods | Only where every operation is safe to repeat or duplicate-aware. | Convenient, but can replay unsafe operations. |
| Disable retries for unsafe methods | Operations that lack duplicate protection and should not be replayed automatically. | Reduces accidental replay, but does not itself recover a request whose outcome is unknown. |
For ASP.NET Core clients, configure the resilience pipeline deliberately rather than inheriting all-method retries without review. For operations that must recover from ambiguous failures, pair an appropriate retry policy with server-side duplicate recognition. The practical rule is to retry only when another attempt is safe, or make the operation duplicate-aware first.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
