Skip to content

Distributed tracing and metrics are not emitted on redirects with custom ICredentials #115938

New issue
New issue
Open
#115939
Open
Distributed tracing and metrics are not emitted on redirects with custom ICredentials#115938
#115939
Labels
area-System.Net.Httpbug
Milestone
 
10.0.0
@antonfirsov

Description

@antonfirsov
antonfirsov
opened on May 23, 2025

There is an overlook in the code that disables auth for redirects with custom ICredentials:

runtime/src/libraries/System.Net.Http/src/System/Net/Http/SocketsHttpHandler/SocketsHttpHandler.cs

Lines 547 to 558 in 915f129

if (settings._allowAutoRedirect)
{
// Just as with WinHttpHandler, for security reasons, we do not support authentication on redirects
// if the credential is anything other than a CredentialCache.
// We allow credentials in a CredentialCache since they are specifically tied to URIs.
HttpMessageHandlerStage redirectHandler =
(settings._credentials == null || settings._credentials is CredentialCache) ?
handler :
new HttpConnectionHandler(poolManager); // will not authenticate
handler = new RedirectHandler(settings._maxAutomaticRedirections, handler, redirectHandler);
}

In case settings._credentials is not a CredentialCache we pass an HttpConnectionHandler to RedirectHandler to be used on redirects. This will opt out from the previously configured handler chain in the method, which unfortunately also includes MetricsHandler and DiagnosticsHandler, not only HttpAuthenticatedConnectionHandler.

This bug has a very limited impact.

Metadata

Metadata

Assignees

No one assigned

    Labels

    area-System.Net.Httpbug

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions