in this case i think it is not a problem because injected object is not referenced in a field so it can be garbage collected. am i right?
Castle Windsor is warning about Captive Dependencies. The main problem is not so much that instances aren’t garbage collected, but a class will reuse an instance that is not intended for reuse.
Simple example is when you inject a DbContext into a class that is configured as singleton. Although this will result in the DbContext being held alive until its singleton consumer goes out of scope (which typically is when the application ends). A DbContexthowever should not be reused over multiple requests. For one, because it simply isn't thread-safe. On top of that, it gets stale very soon, which causes it to return cached data, instead of re-querying the database.
For this reason we register DbContext typically as Scoped. This does mean however that all its consumers should live at most as long as the DbContext, to prevent it from breaking the application. This is what Castle is warning about.
In your case however you don't store the IReservationService into a private field of SsoSettingsProvider. This would still be a problem, because it would be reasonable to expect that the objects that IReservationService returns do not outlive the IReservationService (otherwise IReservationService would be registered as Singleton). Since from the perspective of SsoSettingsProvider, there is no way it could know whether or not it is safe to store LogonSettings, it is much better to not store it at all.
On top of that, as expressed here, injection constructors should not use their dependencies at all. This leads to slow and unreliable object composition.
So even though you might have analyzed your design and know for sure that this works in your particular case, I would suggest you doing one of the following things:
- Store IReservationServiceas private field inSsoSettingsProviderand callGetSSOSettingsonly when one ofSsoSettingsProvider's members is called and prevent storingLogonSettings. This forces you to make eitherSsoSettingsProviderscoped orIReservationServicesingleton. Whether or notIReservationServicecan be singleton is only something you can find out.
- In case SsoSettingsProvideris only interested inLogonSettings, andLogonSettingsis a constant value that won't change after the application started, you should injectLogonSettingsdirectly inSsoSettingsProvider's constructor. This simplifiesSsoSettingsProviderand pushes loading theLogonSettingsto the Composition Root.