Breaking change: HttpSys TLS channel binding token exposure (.NET 11) - #37325
Open
DeagleGross wants to merge 2 commits into
Open
Breaking change: HttpSys TLS channel binding token exposure (.NET 11)#37325DeagleGross wants to merge 2 commits into
DeagleGross wants to merge 2 commits into
Conversation
…e (.NET 11) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
|
@tdykstra, looping you in since you watch over the Breaking Changes docs for ASP.NET. |
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a new ASP.NET Core 11 breaking-change article documenting HttpSys enabling TLS channel binding token (CBT) exposure by default, and links it from the ASP.NET Core 11 breaking-changes overview.
Changes:
- Adds a new breaking-change doc describing HttpSys URL group channel binding configuration and the new
ITlsConnectionFeature.TryGetChannelBindingBytesAPI. - Updates the ASP.NET Core 11 breaking-changes overview table to include the new entry.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| aspnetcore/breaking-changes/11/overview.md | Adds the new breaking-change entry to the ASP.NET Core 11 overview table. |
| aspnetcore/breaking-changes/11/httpsys-channel-binding-token-enabled.md | New breaking-change article documenting the HttpSys CBT exposure behavior and recommended opt-out. |
Comments suppressed due to low confidence (3)
aspnetcore/breaking-changes/11/httpsys-channel-binding-token-enabled.md:27
- For consistency with other docs (for example, this folder uses "HTTP.sys"), capitalize the Windows component name here.
At startup, HttpSys unconditionally calls `HttpSetUrlGroupProperty` with `HttpServerChannelBindProperty`, applying the configured hardening level. For `Medium` and `Strict`, it also sets the `HTTP_CHANNEL_BIND_SECURE_CHANNEL_TOKEN` flag so that http.sys delivers a per-request `HTTP_REQUEST_CHANNEL_BIND_STATUS`.
aspnetcore/breaking-changes/11/httpsys-channel-binding-token-enabled.md:45
- For consistency with other docs (for example, this folder uses "HTTP.sys"), capitalize the Windows component name here.
No action is required for most users. The new API is opt-in. Apps that don't call `TryGetChannelBindingBytes` still incur a small per-request cost: with `Medium` hardening (the default), http.sys captures the channel binding token for every HTTPS request and includes it in the request info handed to user mode, which adds a small amount of kernel work and roughly 40 extra bytes per request. The overhead is negligible for typical workloads but not zero. Apps that need to eliminate it entirely can opt out by setting `HttpAuthenticationHardeningLevel.Legacy` (see the code snippet below).
aspnetcore/breaking-changes/11/httpsys-channel-binding-token-enabled.md:58
- For consistency with other docs (for example, this folder uses "HTTP.sys"), capitalize the Windows component name here.
When `Legacy` is configured, HttpSys doesn't set the CBT flag, http.sys doesn't populate `HTTP_REQUEST_CHANNEL_BIND_STATUS`, and `TryGetChannelBindingBytes` returns `false`.
`HttpServerChannelBindProperty` has been supported in http.sys since Windows 7 and Windows Server 2008 R2 (released October 22, 2009), which is below the OS floor for any supported ASP.NET Core version. No ASP.NET Core-supported OS is affected.
| title: "Breaking change: HttpSys enables TLS channel binding token exposure by default" | ||
| ai-usage: ai-assisted | ||
| description: "Learn about the breaking change in ASP.NET Core 11 where HttpSys configures HttpServerChannelBindProperty on every startup, enabling per-request TLS channel binding tokens and the new ITlsConnectionFeature.TryGetChannelBindingBytes API." | ||
| ms.date: 07/09/2026 |
| | [Blazor enhanced navigation no longer preloads resources](blazor-enhanced-nav-preloading-disabled.md) | Behavioral change | | ||
| | [ConcurrencyLimiter middleware removed](concurrencylimiter-removed.md) | Binary/source incompatible | | ||
| | [Hosting emits OpenTelemetry HTTP semantic-convention tags by default](http-activity-otel-semconv.md) | Behavioral change | | ||
| | [HttpSys enables TLS channel binding token exposure by default](httpsys-channel-binding-token-enabled.md) | Behavioral change | |
|
|
||
| HttpSys-backed servers didn't configure `HttpServerChannelBindProperty` on the URL group at startup, and the RFC 5929 TLS channel binding token wasn't exposed to the app. | ||
|
|
||
| Applications could opt in by enabling the `Microsoft.AspNetCore.Server.HttpSys.EnableCBTHardening` `AppContext` switch. That switch set the hardening level to `Medium`, but it didn't set the `HTTP_CHANNEL_BIND_SECURE_CHANNEL_TOKEN` flag, so http.sys didn't deliver a per-request CBT. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a new breaking-change doc for ASP.NET Core 11 announcing that
Microsoft.AspNetCore.Server.HttpSysnow callsHttpSetUrlGroupProperty(HttpServerChannelBindProperty)on every startup by default. This enables per-request TLS channel binding tokens (RFC 5929tls-server-end-point) and the newITlsConnectionFeature.TryGetChannelBindingBytesAPI, unlocking Extended Protection for Authentication (EPA) scenarios.Reference: dotnet/aspnetcore#67436.
Changes
aspnetcore/breaking-changes/11/httpsys-channel-binding-token-enabled.mdfollowing the section structure and tone of the existing .NET 11 breaking-change docs (e.g.,kestrel-strict-protocol-compliance.md).aspnetcore/breaking-changes/11/overview.md, inserted in the correct alphabetical position and typed as a Behavioral change.Highlights
HttpSysOptions.HttpAuthenticationHardeningLevel(Legacy/Medium/Strict), defaultMedium.HttpServerChannelBindProperty; forMedium/Strictit also setsHTTP_CHANNEL_BIND_SECURE_CHANNEL_TOKEN.ITlsConnectionFeature.TryGetChannelBindingBytesreturns the endpoint CBT on authenticated HTTPS requests.HttpAuthenticationHardeningLevel.Legacyto restore pre-.NET 11 behavior.Internal previews