Deprecate HttpClient property

Deprecate the HttpClient property and use the built-in Backchannel property instead.

src/AspNet.Security.OpenId.Steam/SteamAuthenticationHandler.cs

@@ -84,7 +84,7 @@ protected override async Task<AuthenticationTicket> CreateTicketAsync(
             request.Headers.Accept.Add(new MediaTypeWithQualityHeaderValue(OpenIdAuthenticationConstants.Media.Json));
 
             // Return the authentication ticket as-is if the userinfo request failed.
-            var response = await Options.HttpClient.SendAsync(request, HttpCompletionOption.ResponseHeadersRead, Context.RequestAborted);
+            var response = await Options.Backchannel.SendAsync(request, HttpCompletionOption.ResponseHeadersRead, Context.RequestAborted);
             if (!response.IsSuccessStatusCode)
             {
                 Logger.LogWarning("The userinfo request failed because an invalid response was received: the identity provider " +

src/AspNet.Security.OpenId/OpenIdAuthenticationHandler.cs

@@ -380,7 +380,7 @@ private async Task<bool> VerifyAssertionAsync([NotNull] OpenIdAuthenticationMess
                 Content = new FormUrlEncodedContent(payload)
             };
 
-            var response = await Options.HttpClient.SendAsync(request, HttpCompletionOption.ResponseHeadersRead, Context.RequestAborted);
+            var response = await Options.Backchannel.SendAsync(request, HttpCompletionOption.ResponseHeadersRead, Context.RequestAborted);
             if (!response.IsSuccessStatusCode)
             {
                 Logger.LogWarning("The authentication failed because an invalid check_authentication response was received: " +

src/AspNet.Security.OpenId/OpenIdAuthenticationInitializer.cs

@@ -77,15 +77,12 @@ public void PostConfigure([NotNull] string name, [NotNull] TOptions options)
                 options.HtmlParser = new HtmlParser();
             }
 
-            if (options.HttpClient == null)
+            if (options.Backchannel == null)
             {
-                options.HttpClient = new HttpClient
-                {
-                    Timeout = TimeSpan.FromSeconds(30),
-                    MaxResponseContentBufferSize = 1024 * 1024 * 10
-                };
-
-                options.HttpClient.DefaultRequestHeaders.UserAgent.ParseAdd("ASP.NET Core OpenID 2.0 middleware");
+                options.Backchannel = new HttpClient(options.BackchannelHttpHandler ?? new HttpClientHandler());
+                options.Backchannel.DefaultRequestHeaders.UserAgent.ParseAdd("ASP.NET Core OpenID 2.0 middleware");
+                options.Backchannel.Timeout = options.BackchannelTimeout;
+                options.Backchannel.MaxResponseContentBufferSize = 1024 * 1024 * 10; // 10 MB
             }
 
             if (options.ConfigurationManager == null)
@@ -140,13 +137,13 @@ public void PostConfigure([NotNull] string name, [NotNull] TOptions options)
 
                     options.ConfigurationManager = new ConfigurationManager<OpenIdAuthenticationConfiguration>(
                         options.MetadataAddress?.AbsoluteUri ?? options.Authority.AbsoluteUri,
-                        new OpenIdAuthenticationConfiguration.Retriever(options.HttpClient, options.HtmlParser)
+                        new OpenIdAuthenticationConfiguration.Retriever(options.Backchannel, options.HtmlParser)
                         {
                             MaximumRedirections = options.MaximumRedirections
                         },
-                        new HttpDocumentRetriever(options.HttpClient) { RequireHttps = options.RequireHttpsMetadata });
+                        new HttpDocumentRetriever(options.Backchannel) { RequireHttps = options.RequireHttpsMetadata });
                 }
             }
         }
     }
-}
+}

src/AspNet.Security.OpenId/OpenIdAuthenticationOptions.cs

@@ -95,7 +95,12 @@ public OpenIdAuthenticationOptions()
         /// <summary>
         /// Gets or sets the HTTP client used to communicate with the OpenID provider.
         /// </summary>
-        public HttpClient HttpClient { get; set; }
+        [Obsolete("Use the Backchannel property instead.")]
+        public HttpClient HttpClient
+        {
+            get => Backchannel;
+            set => Backchannel = value;
+        }
 
         /// <summary>
         /// Gets or sets the HTML parser used to parse discovery documents.

test/AspNet.Security.OpenId.Providers.Tests/OpenIdTests`1.cs

@@ -85,7 +85,6 @@ protected OpenIdTests()
         protected virtual void ConfigureDefaults(AuthenticationBuilder builder, TOptions options)
         {
             options.Backchannel = CreateBackchannel(builder);
-            options.HttpClient = options.Backchannel;
         }
 
         /// <summary>