HttpClientHandler.DangerousAcceptAnyServerCertificateValidator Property

Definition

Namespace:

System.Net.Http

Assembly:

System.Net.Http.dll

Source:

HttpClientHandler.cs

Gets a cached delegate that always returns true.

public:
 static property Func<System::Net::Http::HttpRequestMessage ^, System::Security::Cryptography::X509Certificates::X509Certificate2 ^, System::Security::Cryptography::X509Certificates::X509Chain ^, System::Net::Security::SslPolicyErrors, bool> ^ DangerousAcceptAnyServerCertificateValidator { Func<System::Net::Http::HttpRequestMessage ^, System::Security::Cryptography::X509Certificates::X509Certificate2 ^, System::Security::Cryptography::X509Certificates::X509Chain ^, System::Net::Security::SslPolicyErrors, bool> ^ get(); };

[System.Runtime.Versioning.UnsupportedOSPlatform("browser")]
public static Func<System.Net.Http.HttpRequestMessage,System.Security.Cryptography.X509Certificates.X509Certificate2?,System.Security.Cryptography.X509Certificates.X509Chain?,System.Net.Security.SslPolicyErrors,bool> DangerousAcceptAnyServerCertificateValidator { get; }

[<System.Runtime.Versioning.UnsupportedOSPlatform("browser")>]
static member DangerousAcceptAnyServerCertificateValidator : Func<System.Net.Http.HttpRequestMessage, System.Security.Cryptography.X509Certificates.X509Certificate2, System.Security.Cryptography.X509Certificates.X509Chain, System.Net.Security.SslPolicyErrors, bool>

Public Shared ReadOnly Property DangerousAcceptAnyServerCertificateValidator As Func(Of HttpRequestMessage, X509Certificate2, X509Chain, SslPolicyErrors, Boolean)

Property Value

Func<HttpRequestMessage,X509Certificate2,X509Chain,SslPolicyErrors,Boolean>

A cached delegate that always returns true.

Attributes

UnsupportedOSPlatformAttribute

Remarks

Particularly in test scenarios, a common pattern use HttpClient to connect to a server with a certificate that shouldn't be validated, such as a self-signed certificate. You commonly do this with HttpClientHandler by setting the ServerCertificateCustomValidationCallback property to a delegate that always returns True; this indicates that the certificate has passed validation. However, not all implementations support this callback, and some throw PlatformNotSupportedException.

The DangerousAcceptAnyServerCertificateValidator property addresses this limitation. The delegate returned by the DangerousAcceptAnyServerCertificateValidator property can be assigned to the ServerCertificateCustomValidationCallback property, as the following example does:

handler.ServerCertificateCustomValidationCallback = HttpClientHandler.DangerousAcceptAnyServerCertificateValidator;

This gives HttpClientHandler implementations a known object reference identity that expresses the developer's intention. If the object stored in the ServerCertificateCustomValidationCallback property is reference equals to DangerousAcceptAnyServerCertificateValidator, the runtime is able to entirely disable validation on a platform that would otherwise throw a PlatformNotSupportedException.

As a side benefit, developers can use this property to make it easier for tools to flag the danger of disabling certificate validation, which makes it easier for developers to avoid shipping insecure applications.