[release/10.0] AppContext for HttpSys CBT hardening #64298
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR adds opt-in support for Channel Binding Token (CBT) hardening in HttpSys through an AppContext switch. By default, there is no impact to existing applications as this security hardening feature is disabled unless explicitly enabled.
- Adds
HTTP_CHANNEL_BIND_INFOnative struct support - Implements CBT hardening configuration via AppContext switch
Microsoft.AspNetCore.Server.HttpSys.EnableCBTHardening - Sets hardening level to
HttpAuthenticationHardeningMediumwhen enabled
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| src/Servers/HttpSys/src/NativeMethods.txt | Adds HTTP_CHANNEL_BIND_INFO to the native methods list for P/Invoke generation |
| src/Servers/HttpSys/src/NativeInterop/UrlGroup.cs | Implements CBT hardening configuration in UrlGroup constructor when AppContext switch is enabled |
| var channelBindingSettings = new HTTP_CHANNEL_BIND_INFO | ||
| { | ||
| Hardening = HTTP_AUTHENTICATION_HARDENING_LEVELS.HttpAuthenticationHardeningMedium, | ||
| ServiceNames = (HTTP_SERVICE_BINDING_BASE**)IntPtr.Zero, | ||
| NumberOfServiceNames = 0, | ||
| }; |
There was a problem hiding this comment.
The HTTP_CHANNEL_BIND_INFO struct is missing the Flags field initialization. All other similar HTTP_*_INFO structs in this codebase (e.g., HTTP_BINDING_INFO, HTTP_CONNECTION_LIMIT_INFO, HTTP_TIMEOUT_LIMIT_INFO, HTTP_SERVER_AUTHENTICATION_INFO) set Flags = HttpApi.HTTP_PROPERTY_FLAGS_PRESENT to indicate the property is being set. This field should be added for consistency and to ensure proper property setting behavior.
| ServiceNames = (HTTP_SERVICE_BINDING_BASE**)IntPtr.Zero, | ||
| NumberOfServiceNames = 0, | ||
| }; | ||
| SetProperty(HTTP_SERVER_PROPERTY.HttpServerChannelBindProperty, new(&channelBindingSettings), (uint)ChannelBindInfoSize); |
There was a problem hiding this comment.
The IntPtr construction uses target-typed new expression new(&channelBindingSettings) which is inconsistent with other SetProperty calls in this file that use explicit new IntPtr(&...) (lines 76, 87, 97, 130, 146). For consistency with the existing codebase, use new IntPtr(&channelBindingSettings) instead.
| SetProperty(HTTP_SERVER_PROPERTY.HttpServerChannelBindProperty, new(&channelBindingSettings), (uint)ChannelBindInfoSize); | |
| SetProperty(HTTP_SERVER_PROPERTY.HttpServerChannelBindProperty, new IntPtr(&channelBindingSettings), (uint)ChannelBindInfoSize); |
|
Approved over email |
AppContext for HttpSys CBT hardening
Description
Request from a partner team to allow setting hardened security for their HTTP.Sys applications.
Customer Impact
By default there is no impact, this change is opt-in. If the change is enabled then it sets hardened security for the endpoints exposed by the HTTP.Sys application.
Regression?
Risk
Purely opt-in change. We've also verified the change with the partner team.
Verification
Packaging changes reviewed?