In Asp.Net (not Core) we have InstancePerRequest which uses tagged matching child scopes.
In Asp.Net Core they deprecated InstancePerRequest in favour of InstancePerLifetimeScope which as I understand leverages the scoped lifetimes supported by the Dependency Injection framework built-in into Asp.Net Core.
However, the two do not provide equivalent behavior. With InstancePerRequest we automatically avoid captive dependency where a Singleton depends on a PerRequest object - this throws an exception in Asp.Net. Also, when trying to resolve a PerRequest object in an out-of-request context, like background timer - we get an exception. Which is all good and correct and helpful.
But it is all gone with InstancePerLifetimeScope. Now I understand I can continue using InstancePerRequest in Asp.Net Core, but it is not recommended by Autofac and I understand the rationale - Asp.Net Core comes with DI framework which supports scoped dependencies out of the box and Autofac just plugs in as the actual IoC provider. Nice and neat, except now we have captive dependencies and background timer can resolve per request objects.
We have a huge enterprise application which we want to migrate to Asp.Net Core. We have many developers and having InstancePerRequest behave as it is now protects us against bad things (like have a user session object captured by a singleton, by mistake, of course, but nonetheless - disaster if allowed)
Has anyone faced this dilemma (InstancePerRequest - obsolete yet safe vs InstancePerLifetimeScope - idiomatic yet unsafe) and how it can be resolved?