Add TLS channel binding token access to ITlsConnectionFeature - #67436
Merged
DeagleGross merged 14 commits intoJul 9, 2026
Conversation
DeagleGross
added
the
area-networking
DeagleGross
changed the title
ITlsConnectionFeature
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds a new ITlsConnectionFeature.TryGetChannelBindingBytes(ChannelBindingKind, out ReadOnlyMemory<byte>) API to expose RFC 5929 TLS channel binding token (CBT) bytes to apps, with server-specific implementations for Kestrel, HttpSys, and IIS. It also deprecates the abandoned ITlsTokenBindingFeature (RFC 8471) and includes sample/test updates to exercise the new CBT access.
Changes:
- Add
TryGetChannelBindingBytestoITlsConnectionFeaturewith a default implementation that returnsfalse. - Implement CBT retrieval in Kestrel (via
SslStream.TransportContext.GetChannelBinding) and in HttpSys/IIS (viaHTTP_REQUEST_CHANNEL_BIND_STATUS). - Introduce/configure HttpSys hardening option (
HttpAuthenticationHardeningLevel) and update samples/tests + PublicAPI baselines.
Show a summary per file
| File | Description |
|---|---|
| src/Shared/Obsoletions.cs | Adds deprecation URL/diagnostic/message constants for ITlsTokenBindingFeature. |
| src/Shared/HttpSys/RequestProcessing/NativeRequestContext.cs | Adds safe-ish extraction/copying of CBT bytes from http.sys request info after buffer unpinning. |
| src/Shared/HttpSys/NativeInterop/HTTP_REQUEST_CHANNEL_BIND_STATUS.cs | Adds interop struct for channel bind status returned by http.sys. |
| src/Servers/Kestrel/test/InMemory.FunctionalTests/HttpsConnectionMiddlewareTests.cs | Adds Windows-only test validating endpoint CBT shape/content. |
| src/Servers/Kestrel/Core/src/Middleware/HttpsConnectionMiddleware.cs | Passes logger into TLS feature and adds debug log for CBT read failures. |
| src/Servers/Kestrel/Core/src/Internal/TlsConnectionFeature.cs | Implements TryGetChannelBindingBytes for Kestrel via SslStream.TransportContext. |
| src/Servers/IIS/IIS/src/Core/IISHttpContext.FeatureCollection.cs | Implements TryGetChannelBindingBytes (Endpoint-only) and caches per-request bytes. |
| src/Servers/IIS/IIS/samples/NativeIISSample/Startup.cs | Adds sample output showing CBT retrieval / IIS config guidance. |
| src/Servers/HttpSys/src/SourceBuildStubs.cs | Adds source-build stubs for HttpAuthenticationHardeningLevel and options property. |
| src/Servers/HttpSys/src/RequestProcessing/RequestContext.FeatureCollection.cs | Implements TryGetChannelBindingBytes (Endpoint-only) gated by new hardening option. |
| src/Servers/HttpSys/src/PublicAPI.Unshipped.txt | Records new public API surface for HttpSys hardening enum/option. |
| src/Servers/HttpSys/src/NativeInterop/UrlGroup.cs | Sets HttpServerChannelBindProperty to enable per-request CBT delivery via URL group property. |
| src/Servers/HttpSys/src/HttpSysOptions.cs | Adds HttpAuthenticationHardeningLevel option (default Medium) and applies URL group settings. |
| src/Servers/HttpSys/src/HttpAuthenticationHardeningLevel.cs | Adds public enum mirroring Win32 hardening levels + CBT exposure behavior. |
| src/Servers/HttpSys/samples/TlsFeaturesObserve/TlsFeaturesObserve.csproj | Updates sample references (includes a new CORS reference). |
| src/Servers/HttpSys/samples/TlsFeaturesObserve/Program.cs | Adds middleware that reads/parses CBT bytes and prints them. |
| src/Http/Http.Features/src/PublicAPI.Unshipped.txt | Records new ITlsConnectionFeature.TryGetChannelBindingBytes API. |
| src/Http/Http.Features/src/Microsoft.AspNetCore.Http.Features.csproj | Links shared Obsoletions.cs for use by obsoletion attributes. |
| src/Http/Http.Features/src/ITlsTokenBindingFeature.cs | Marks ITlsTokenBindingFeature as obsolete with new diagnostic metadata. |
| src/Http/Http.Features/src/ITlsConnectionFeature.cs | Adds new TryGetChannelBindingBytes method with default interface implementation. |
Copilot's findings
- Files reviewed: 20/20 changed files
- Comments generated: 7
BrennanConroy
approved these changes
Jul 9, 2026
halter73
reviewed
Jul 10, 2026
DeagleGross
added a commit
to DeagleGross/aspnetcore
that referenced
this pull request
Jul 10, 2026
When HttpAuthenticationHardeningLevel.Strict is configured, the caller is asking for a hard security guarantee (reject authenticated requests that lack a valid channel binding token). Silently degrading to the OS default hardening on a SetProperty failure is misleading, so throw and fail startup instead. Legacy/Medium continue to log-and-continue via SetUrlPropertyError. Follow-up to dotnet#67436 addressing dotnet#67436 (comment). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
DeagleGross
added a commit
that referenced
this pull request
Jul 13, 2026
When HttpAuthenticationHardeningLevel.Strict is configured, the caller is asking for a hard security guarantee (reject authenticated requests that lack a valid channel binding token). Silently degrading to the OS default hardening on a SetProperty failure is misleading, so throw and fail startup instead. Legacy/Medium continue to log-and-continue via SetUrlPropertyError. Follow-up to #67436 addressing #67436 (comment). Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements approved API in the #66701. Adds new
bool TryGetChannelBindingBytes(ChannelBindingKind kind, out ReadOnlyMemory<byte> channelBindingToken)method toITlsConnectionFeature. Default implementation returnsfalse.Supported in Kestrel, HttpSys and IIS, where
HttpSysusesHttpAuthenticationHardeningLevelas option to enable/disable it (defaults toMediumwhich means enabled). Kestrel leveragesSslStreamto callSslStream.TransportContext.GetChannelBinding(kind). Added code to sample app to try this out.Closes #66701