Skip to content

Minor update in HttpClientHandler.xml #8672

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gewarren merged 1 commit into from
Nov 30, 2022
Merged

Minor update in HttpClientHandler.xml #8672

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Minor update in HttpClientHandler.xml 
As far as I understand the `DangerousAcceptAnyServerCertificateValidator` mechanism (thanks to the little code snippet), the framework checks whether `ServerCertificateCustomValidationCallback` is set to that value.
It does not make sense to check the value of `DangerousAcceptAnyServerCertificateValidator`, since it's a read-only property anyway.
  • Loading branch information
Benoit Lecardonnel authored Nov 29, 2022
commit 53ad8da5b0bcb90f2885b6390eb45c0459322d69
2 changes: 1 addition & 1 deletion xml/System.Net.Http/HttpClientHandler.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -491,7 +491,7 @@ On .NET Core, the key usage attribute on the X509 certificate, if present, is re
handler.ServerCertificateCustomValidationCallback = HttpClientHandler.DangerousAcceptAnyServerCertificateValidator;
```

This gives <xref:System.Net.Http.HttpClientHandler> implementations a known object reference identity that expresses the developer's intention. If the object stored in the <xref:System.Net.Http.HttpClientHandler.DangerousAcceptAnyServerCertificateValidator%2A> property is reference equals to <xref:System.Net.Http.HttpClientHandler.DangerousAcceptAnyServerCertificateValidator%2A>, the runtime is able to entirely disable validation on a platform that would otherwise throw a <xref:System.PlatformNotSupportedException>.
This gives <xref:System.Net.Http.HttpClientHandler> implementations a known object reference identity that expresses the developer's intention. If the object stored in the <xref:System.Net.Http.HttpClientHandler.ServerCertificateCustomValidationCallback%2A> property is reference equals to <xref:System.Net.Http.HttpClientHandler.DangerousAcceptAnyServerCertificateValidator%2A>, the runtime is able to entirely disable validation on a platform that would otherwise throw a <xref:System.PlatformNotSupportedException>.

As a side benefit, developers can use this property to make it easier for tools to flag the danger of disabling certificate validation, which makes it easier for developers to avoid shipping insecure applications.

Expand Down