Reduce token service and unnecessary calls - send token to redirects (#2660)

* handle redirects with token

* scope to broker

* lint

src/Runner.Sdk/Util/VssUtil.cs

@@ -64,7 +64,7 @@ namespace GitHub.Runner.Sdk
 
             if (StringUtil.ConvertToBoolean(Environment.GetEnvironmentVariable("USE_BROKER_FLOW")))
             {
-                settings.AllowAutoRedirect = true;
+                settings.AllowAutoRedirectForBroker = true;
             }
 
             // Remove Invariant from the list of accepted languages.

src/Sdk/Common/Common/VssHttpMessageHandler.cs

@@ -213,7 +213,26 @@ namespace GitHub.Services.Common
 
                     // ConfigureAwait(false) enables the continuation to be run outside any captured
                     // SyncronizationContext (such as ASP.NET's) which keeps things from deadlocking...
-                    response = await m_messageInvoker.SendAsync(request, tokenSource.Token).ConfigureAwait(false);
+
+                    var tmpResponse = await m_messageInvoker.SendAsync(request, tokenSource.Token).ConfigureAwait(false);
+                    if (Settings.AllowAutoRedirectForBroker && tmpResponse.StatusCode == HttpStatusCode.Redirect)
+                    {
+                        //Dispose of the previous response
+                        tmpResponse?.Dispose();
+
+                        var location = tmpResponse.Headers.Location;
+                        request = new HttpRequestMessage(HttpMethod.Get, location);
+
+                        // Reapply the token to new redirected request
+                        ApplyToken(request, token, applyICredentialsToWebProxy: lastResponseDemandedProxyAuth);
+
+                        // Resend the request
+                        response = await m_messageInvoker.SendAsync(request, tokenSource.Token).ConfigureAwait(false);
+                    }
+                    else
+                    {
+                        response = tmpResponse;
+                    }
 
                     traceInfo?.TraceRequestSendTime();
 

src/Sdk/Common/Common/VssHttpRequestSettings.cs

@@ -110,6 +110,16 @@ namespace GitHub.Services.Common
             set;
         }
 
+        /// <summary>
+        /// Gets or sets a value indicating whether or not HttpClientHandler should follow redirect on outgoing broker requests
+        /// This is special since this also sends token in the request, where as default AllowAutoRedirect does not
+        /// </summary>
+        public Boolean AllowAutoRedirectForBroker
+        {
+            get;
+            set;
+        }
+
         /// <summary>
         /// Gets or sets a value indicating whether or not compression should be used on outgoing requests.
         /// The default value is true.