Repository navigation
.Net: Bind validated HTTP addresses to connections - #14719
Merged
Roger Barreto (rogerbarreto) merged 2 commits intoNov 4, 2026
Merged
Roger Barreto (rogerbarreto) merged 2 commits into
Roger Barreto (rogerbarreto) merged 2 commits into
Conversation
Roger Barreto (rogerbarreto)
temporarily deployed
to
github-app-auth
November 3, 2026 23:29 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
semantic-kernel-automation
Bot
added
the
.NET
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The validated HTTP handler leaves proxy routing enabled, allowing a configured proxy to bypass address validation and reach private addresses even when AllowPrivateNetworkAccess is false.
1 open issue
What changed in this PR
This PR connects HttpPlugin address validation to the built-in HTTP transport, reusing connection-handling logic previously owned by the OpenAPI provider.
Changes:
- Moves validated-address connection handling and separate validated/unchecked pools into the shared HTTP client provider.
- Passes validated addresses from
HttpPluginto the transport and rejects hostname requests when address binding cannot be guaranteed. - Adds tests for address propagation, custom-client rejection, and connections that preserve the original HTTP hostname.
| File | Description |
|---|---|
dotnet/src/Plugins/Plugins.UnitTests/Core/HttpPluginTests.cs |
Adds address-binding and custom-client regression tests. |
dotnet/src/Plugins/Plugins.Core/HttpPlugin.cs |
Supplies validated addresses and enforces transport support. |
dotnet/src/InternalUtilities/src/Http/HttpClientProvider.cs |
Centralizes address-bound connections and separate connection pools. |
dotnet/src/Functions/Functions.OpenApi/OpenApiHttpClientProvider.cs |
Delegates transport creation to the shared provider. |
Review effort: Balanced
Roger Barreto (rogerbarreto)
temporarily deployed
to
github-app-auth
November 4, 2026 00:26 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
westey (westey-m)
approved these changes
Nov 4, 2026
This branch was previously deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation and Context
HttpPluginvalidated resolved addresses before sending a request, but the built-in HTTP transport did not retain that address set when opening the connection. This change keeps the validation decision and the resulting connection consistent.Description
HttpPluginto the built-in transport while preserving the original HTTP and TLS hostname.Validation:
dotnet build dotnet\src\Plugins\Plugins.Core\Plugins.Core.csproj -c Debug --tl:off --warnaserror --no-restore— passed fornet10.0,net8.0, andnetstandard2.0with no warnings.dotnet build dotnet\src\Functions\Functions.OpenApi\Functions.OpenApi.csproj -c Debug --tl:off --warnaserror --no-restore— passed fornet10.0,net8.0, andnetstandard2.0with no warnings.dotnet build dotnet\src\Plugins\Plugins.UnitTests\Plugins.UnitTests.csproj -f net10.0 -c Debug --tl:off --warnaserror --no-restore— passed with no warnings.dotnet build dotnet\src\Functions\Functions.UnitTests\Functions.UnitTests.csproj -f net10.0 -c Debug --tl:off --warnaserror --no-restore— passed with no warnings.dotnet test dotnet\src\Plugins\Plugins.UnitTests\Plugins.UnitTests.csproj -f net10.0 -c Debug --no-restore -v Normal --logger trx— passed: 583 passed, 15 environment-specific skips, 0 failed.dotnet test dotnet\src\Functions\Functions.UnitTests\Functions.UnitTests.csproj -f net10.0 -c Debug --no-restore --filter FullyQualifiedName~OpenApiHttpClientProviderTests -v Normal --logger trx— passed: 11 passed, 0 failed.dotnet format --verify-no-changesfor the affected projects — passed.Contribution Checklist