[release/10.0] AppContext for HttpSys CBT hardening

[BrennanConroy]

AppContext for HttpSys CBT hardening

Description

Request from a partner team to allow setting hardened security for their HTTP.Sys applications.

Customer Impact

By default there is no impact, this change is opt-in. If the change is enabled then it sets hardened security for the endpoints exposed by the HTTP.Sys application.

Regression?

• Yes
• No

Risk

• High
• Medium
• Low

Purely opt-in change. We've also verified the change with the partner team.

Verification

• Manual (required)
• Automated

Packaging changes reviewed?

• Yes
• No
• N/A

[dotnet-policy-service]

Hi @@BrennanConroy. Please make sure you've updated the PR description to use the Shiproom Template. Also, make sure this PR is not marked as a draft and is ready-to-merge.

To learn more about how to prepare a servicing PR click here.

[Copilot]

Pull Request Overview

This PR adds opt-in support for Channel Binding Token (CBT) hardening in HttpSys through an AppContext switch. By default, there is no impact to existing applications as this security hardening feature is disabled unless explicitly enabled.

• Adds HTTP_CHANNEL_BIND_INFO native struct support
• Implements CBT hardening configuration via AppContext switch Microsoft.AspNetCore.Server.HttpSys.EnableCBTHardening
• Sets hardening level to HttpAuthenticationHardeningMedium when enabled

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/Servers/HttpSys/src/NativeMethods.txt	Adds HTTP_CHANNEL_BIND_INFO to the native methods list for P/Invoke generation
src/Servers/HttpSys/src/NativeInterop/UrlGroup.cs	Implements CBT hardening configuration in UrlGroup constructor when AppContext switch is enabled

[Copilot]

The HTTP_CHANNEL_BIND_INFO struct is missing the Flags field initialization. All other similar HTTP_*_INFO structs in this codebase (e.g., HTTP_BINDING_INFO, HTTP_CONNECTION_LIMIT_INFO, HTTP_TIMEOUT_LIMIT_INFO, HTTP_SERVER_AUTHENTICATION_INFO) set Flags = HttpApi.HTTP_PROPERTY_FLAGS_PRESENT to indicate the property is being set. This field should be added for consistency and to ensure proper property setting behavior.

[Copilot]

The IntPtr construction uses target-typed new expression new(&channelBindingSettings) which is inconsistent with other SetProperty calls in this file that use explicit new IntPtr(&...) (lines 76, 87, 97, 130, 146). For consistency with the existing codebase, use new IntPtr(&channelBindingSettings) instead.

Suggested change

	SetProperty(HTTP_SERVER_PROPERTY.HttpServerChannelBindProperty, new(&channelBindingSettings), (uint)ChannelBindInfoSize);
	SetProperty(HTTP_SERVER_PROPERTY.HttpServerChannelBindProperty, new IntPtr(&channelBindingSettings), (uint)ChannelBindInfoSize);