Runtime: servicepointmanager is not working as expected with httpclient

[VenkateshSrini]

Hi,
I have a library in which makes a call to external web service. The SSL validation for this needs to be skipped. Since .NET core 2.0 implements ServicePointManager, we have given the code as
c# ServicePointManager.ServerCertificateValidationCallBack= (s,c,ch,ssl) => true; using (var client = AmazonClient(...)) { }
As per this even though the SDK does not give us an explicit way of switching of the SSL validation since ServicePointManager is single ton ideally this should have worked. But this did not happen. I still get ssl related error.

So does the above code not work with HttpClient? Is it by design?

[EDIT] Fix code formatting by @karelz

[karelz]

Do you use .NET Core or .NET Framework?
In .NET Core, ServicePointManager affects only HttpWebRequest. It does not affect HttpClient. You should be able to use HttpClientHandler.ServerCertificateValidationCallback to achieve the same.
In .NET Framework, the built-in HttpClient is built on top of HttpWebRequest, therefore ServicePointManager settings will apply to it.

[davidsh]

In .NET Core, ServicePointManager affects only HttpWebRequest. It does not affect HttpClient

To be clear here, ServicePointManager is a no-op in .NET Core for either HttpWebRequest or HttpClient classes.

On .NET Core and .NET Framework, both HttpWebRequest and HttpClient have method or properties available for handling the equivalent ServerCertificateValidation callbacks.

[stephentoub]

ServicePointManager is a no-op in .NET Core for either HttpWebRequest

It is actually used in a limited capacity by HttpWebRequest in .NET Core:
https://github.com/dotnet/corefx/blob/8bf18073962f0ebb0e8333c5f6a419d9f14b435b/src/System.Net.Requests/src/System/Net/HttpWebRequest.cs#L1152-L1157

[VenkateshSrini]

Thanks for the insight

[Neutrino-Sunset]

I have an AspNetCore 2.0 application in which someone has set ServicePointManager.DefaultConnectionLimit=1000

If I right click on ServicePointManager and select 'Go to definition' and let it decompile the source I see a listing with all entries being a no op.

If however I view the source on Githuib here
https://github.com/dotnet/corefx/commits/master/src/System.Net.ServicePoint/src/System/Net/ServicePointManager.cs

...then I see one definition for ServicePointManager in System.Net.Requests.cs that appears to be functional, and another definition for ServicePointManger in System.Net.ServicePoint.cs apparently both in namespace System.Net.

The MSDN documentation shows the same description for all versions Dotnet Framework and Dotnet Core.
https://docs.microsoft.com/en-us/dotnet/api/system.net.servicepointmanager?view=netcore-2.1

Can anyone shed any light on this please? We have this set in one ASP.Net Core web service running on netcoreapp2.0 and another ASP.Net Core web service running on Dotnet 4.6.2 Is setting this having any effect in either case? Because even after decompiling the dependency and looking at the source I'm left none the wiser.

[Neutrino-Sunset]

Actually if I decompile the ServicePointManager reference used by our web service running on netcoreapp2.0 its implementation is all no-op, but if I decompile the reference used by the web service running on 4.6.2 then that one has a functional implementation.

I had thought that an ASP.Net Core project running on Dotnet Framework 4.6.2 would use the Net Core libraries instead of the Dotnet Framework FCL so this surprises me, so either I'm wrong about that or our project is malconfigured.

[davidsh]

I had thought that an ASP.Net Core project running on Dotnet Framework 4.6.2 would use the Net Core libraries instead of the Dotnet Framework FCL so this surprises me, so either I'm wrong about that or our project is malconfigured.

ASP.NET Core running on .NET Framework will NOT use .NET Core libraries. It will use .NET Framework libraries. So, the HTTP stack, for example, (System.Net.*) comes from .NET Framework. That is why the ServicePointManager based HTTP stack is fully functional. It is because you are running on top of .NET Framework.

[Neutrino-Sunset]

Thanks for clearing that up for me. It's still damn confusing that the official documentation is completely incorrect though.

[mepurush]

Hi,

I'm using .net framework and httpclienthandler.servercertificatevalidatecallback is not available here.

And ServicePointManager.ServerCertificateValidationCallback is never called.

[karelz]

@mepurush you might want to debug/troubleshoot ServicePointManager.ServerCertificateValidationCallback - create a small HelloWorld-style repro, check out samples on the internet (docs, StackOverflow).
Please note we do not track .NET Framework questions nor bugs in this repo. This repo is dedicated to .NET Core.