Skip to content

Breaking change: HttpSys TLS channel binding token exposure (.NET 11) - #37325

Open
DeagleGross wants to merge 2 commits into
dotnet:mainfrom
DeagleGross:deaglegross-httpsys-cbt-breaking-change
Open

Breaking change: HttpSys TLS channel binding token exposure (.NET 11)#37325
DeagleGross wants to merge 2 commits into
dotnet:mainfrom
DeagleGross:deaglegross-httpsys-cbt-breaking-change

Conversation

@DeagleGross

@DeagleGross DeagleGross commented Jul 9, 2026

Copy link
Copy Markdown
Member

Adds a new breaking-change doc for ASP.NET Core 11 announcing that Microsoft.AspNetCore.Server.HttpSys now calls HttpSetUrlGroupProperty(HttpServerChannelBindProperty) on every startup by default. This enables per-request TLS channel binding tokens (RFC 5929 tls-server-end-point) and the new ITlsConnectionFeature.TryGetChannelBindingBytes API, unlocking Extended Protection for Authentication (EPA) scenarios.

Reference: dotnet/aspnetcore#67436.

Changes

  • New file aspnetcore/breaking-changes/11/httpsys-channel-binding-token-enabled.md following the section structure and tone of the existing .NET 11 breaking-change docs (e.g., kestrel-strict-protocol-compliance.md).
  • Adds a row for the new doc in aspnetcore/breaking-changes/11/overview.md, inserted in the correct alphabetical position and typed as a Behavioral change.

Highlights

  • New HttpSysOptions.HttpAuthenticationHardeningLevel (Legacy / Medium / Strict), default Medium.
  • At startup, HttpSys always configures HttpServerChannelBindProperty; for Medium/Strict it also sets HTTP_CHANNEL_BIND_SECURE_CHANNEL_TOKEN.
  • New ITlsConnectionFeature.TryGetChannelBindingBytes returns the endpoint CBT on authenticated HTTPS requests.
  • Opt-out via HttpAuthenticationHardeningLevel.Legacy to restore pre-.NET 11 behavior.

Internal previews

📄 File 🔗 Preview link
aspnetcore/breaking-changes/11/httpsys-channel-binding-token-enabled.md HttpSys enables TLS channel binding token exposure by default
aspnetcore/breaking-changes/11/overview.md Breaking changes in ASP.NET Core 11

…e (.NET 11)

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@DeagleGross
DeagleGross requested a review from BrennanConroy July 9, 2026 16:46
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@DeagleGross DeagleGross self-assigned this Jul 9, 2026
@wadepickett

Copy link
Copy Markdown
Contributor

@tdykstra, looping you in since you watch over the Breaking Changes docs for ASP.NET.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds a new ASP.NET Core 11 breaking-change article documenting HttpSys enabling TLS channel binding token (CBT) exposure by default, and links it from the ASP.NET Core 11 breaking-changes overview.

Changes:

  • Adds a new breaking-change doc describing HttpSys URL group channel binding configuration and the new ITlsConnectionFeature.TryGetChannelBindingBytes API.
  • Updates the ASP.NET Core 11 breaking-changes overview table to include the new entry.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File Description
aspnetcore/breaking-changes/11/overview.md Adds the new breaking-change entry to the ASP.NET Core 11 overview table.
aspnetcore/breaking-changes/11/httpsys-channel-binding-token-enabled.md New breaking-change article documenting the HttpSys CBT exposure behavior and recommended opt-out.
Comments suppressed due to low confidence (3)

aspnetcore/breaking-changes/11/httpsys-channel-binding-token-enabled.md:27

  • For consistency with other docs (for example, this folder uses "HTTP.sys"), capitalize the Windows component name here.
At startup, HttpSys unconditionally calls `HttpSetUrlGroupProperty` with `HttpServerChannelBindProperty`, applying the configured hardening level. For `Medium` and `Strict`, it also sets the `HTTP_CHANNEL_BIND_SECURE_CHANNEL_TOKEN` flag so that http.sys delivers a per-request `HTTP_REQUEST_CHANNEL_BIND_STATUS`.

aspnetcore/breaking-changes/11/httpsys-channel-binding-token-enabled.md:45

  • For consistency with other docs (for example, this folder uses "HTTP.sys"), capitalize the Windows component name here.
No action is required for most users. The new API is opt-in. Apps that don't call `TryGetChannelBindingBytes` still incur a small per-request cost: with `Medium` hardening (the default), http.sys captures the channel binding token for every HTTPS request and includes it in the request info handed to user mode, which adds a small amount of kernel work and roughly 40 extra bytes per request. The overhead is negligible for typical workloads but not zero. Apps that need to eliminate it entirely can opt out by setting `HttpAuthenticationHardeningLevel.Legacy` (see the code snippet below).

aspnetcore/breaking-changes/11/httpsys-channel-binding-token-enabled.md:58

  • For consistency with other docs (for example, this folder uses "HTTP.sys"), capitalize the Windows component name here.
When `Legacy` is configured, HttpSys doesn't set the CBT flag, http.sys doesn't populate `HTTP_REQUEST_CHANNEL_BIND_STATUS`, and `TryGetChannelBindingBytes` returns `false`.

`HttpServerChannelBindProperty` has been supported in http.sys since Windows 7 and Windows Server 2008 R2 (released October 22, 2009), which is below the OS floor for any supported ASP.NET Core version. No ASP.NET Core-supported OS is affected.

title: "Breaking change: HttpSys enables TLS channel binding token exposure by default"
ai-usage: ai-assisted
description: "Learn about the breaking change in ASP.NET Core 11 where HttpSys configures HttpServerChannelBindProperty on every startup, enabling per-request TLS channel binding tokens and the new ITlsConnectionFeature.TryGetChannelBindingBytes API."
ms.date: 07/09/2026
| [Blazor enhanced navigation no longer preloads resources](blazor-enhanced-nav-preloading-disabled.md) | Behavioral change |
| [ConcurrencyLimiter middleware removed](concurrencylimiter-removed.md) | Binary/source incompatible |
| [Hosting emits OpenTelemetry HTTP semantic-convention tags by default](http-activity-otel-semconv.md) | Behavioral change |
| [HttpSys enables TLS channel binding token exposure by default](httpsys-channel-binding-token-enabled.md) | Behavioral change |

HttpSys-backed servers didn't configure `HttpServerChannelBindProperty` on the URL group at startup, and the RFC 5929 TLS channel binding token wasn't exposed to the app.

Applications could opt in by enabling the `Microsoft.AspNetCore.Server.HttpSys.EnableCBTHardening` `AppContext` switch. That switch set the hardening level to `Medium`, but it didn't set the `HTTP_CHANNEL_BIND_SECURE_CHANNEL_TOKEN` flag, so http.sys didn't deliver a per-request CBT.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants