[release/9.0] AppContext for HttpSys CBT hardening

[BrennanConroy]

AppContext for HttpSys CBT hardening

Description

Request from a partner team to allow setting hardened security for their HTTP.Sys applications.

Customer Impact

By default there is no impact, this change is opt-in. If the change is enabled then it sets hardened security for the endpoints exposed by the HTTP.Sys application.

Regression?

• Yes
• No

Risk

• High
• Medium
• Low

Purely opt-in change. We've also verified the change with the partner team.

Verification

• Manual (required)
• Automated

Packaging changes reviewed?

• Yes
• No
• N/A

[Copilot]

Pull Request Overview

This PR adds an opt-in AppContext switch (Microsoft.AspNetCore.Server.HttpSys.EnableCBTHardening) that enables hardened Channel Binding Token (CBT) security for HTTP.Sys applications. This change was requested by a partner team to support enhanced security configurations.

Key changes:

• Added support for HTTP_CHANNEL_BIND_INFO native structure
• Implemented CBT hardening configuration in UrlGroup constructor with medium hardening level
• Made the feature opt-in via AppContext switch to ensure no impact to existing applications

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/Servers/HttpSys/src/NativeMethods.txt	Added HTTP_CHANNEL_BIND_INFO to the list of native types for P/Invoke generation
src/Servers/HttpSys/src/NativeInterop/UrlGroup.cs	Implemented CBT hardening logic in UrlGroup constructor, checking AppContext switch and calling SetProperty with channel binding settings

[Copilot]

The SetProperty call in the constructor should handle potential errors. If this call fails, the UrlGroup is still constructed but without CBT hardening, which could lead to a silent security configuration failure. Consider adding error handling or logging similar to other property setters in this class, or document that failures are intentionally ignored during construction.

Suggested change

	SetProperty(HTTP_SERVER_PROPERTY.HttpServerChannelBindProperty, new(&channelBindingSettings), (uint)ChannelBindInfoSize);
	try
	{
	SetProperty(HTTP_SERVER_PROPERTY.HttpServerChannelBindProperty, new(&channelBindingSettings), (uint)ChannelBindInfoSize);
	}
	catch (Exception ex)
	{
	_logger.LogError(ex, "Failed to set CBT hardening on UrlGroup during construction. Security configuration may be incomplete.");
	// Optionally, rethrow or handle as needed for your application's security requirements.
	}

[wtgodbe]

Approved over email

[dotnet-policy-service]

Hi @@BrennanConroy. This PR was just approved to be included in the upcoming servicing release. Somebody from the @dotnet/aspnet-build team will get it merged when the branches are open. Until then, please make sure all the CI checks pass and the PR is reviewed.