Handle client certificate rotation for token binding #53916

christothes · 2025-11-13T20:42:11Z

Contributing to the Azure SDK

Please see our CONTRIBUTING.md if you are not familiar with contributing to this repository or have questions.

For specific information about pull request etiquette and best practices, see this section.

Copilot

Pull Request Overview

This PR implements support for client certificate rotation in the Azure.Core transport layer to enable dynamic token binding scenarios. The changes allow transport instances to be updated with new certificate configurations at runtime without requiring full pipeline reconstruction.

Key Changes:

Added UpdateTransport method to HttpPipelineTransport base class and implementations in HttpClientTransport and HttpWebRequestTransport
Introduced ISupportsTransportCertificateUpdate interface for policies that need to trigger transport updates
Extended AccessToken with a BindingCertificate property for Proof of Possession (PoP) scenarios
Added comprehensive test coverage for certificate rotation scenarios (rotating from empty, rotating from existing cert)

Reviewed Changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 13 comments.

Show a summary per file

File	Description
`sdk/core/Azure.Core/src/Pipeline/Internal/ISupportsTransportUpdate.cs`	New internal interface for policies that support transport certificate updates via event subscription
`sdk/core/Azure.Core/src/Pipeline/HttpPipelineTransport.cs`	Added virtual `UpdateTransport` method to base transport class with default NotSupportedException
`sdk/core/Azure.Core/src/Pipeline/HttpClientTransport.cs`	Implemented `UpdateTransport` with support for client and handler factories, using volatile field and Interlocked for thread-safety
`sdk/core/Azure.Core/src/Pipeline/HttpWebRequestTransport.cs`	Implemented `UpdateTransport` using Interlocked.Exchange for thread-safe configuration updates
`sdk/core/Azure.Core/src/Pipeline/HttpPipeline.cs`	Added subscription to `ISupportsTransportCertificateUpdate` events in constructors to enable transport updates
`sdk/core/Azure.Core/src/Pipeline/HttpPipelineTransportOptions.cs`	Added internal `Clone` method for creating copies of transport options during updates
`sdk/core/Azure.Core/src/AccessToken.cs`	Added `BindingCertificate` property and constructor overload to support token binding with client certificates
`sdk/core/Azure.Core/tests/TransportFunctionalTests.cs`	Added two new test methods for certificate rotation scenarios plus code formatting improvements
`sdk/core/Azure.Core/tests/PipelineTestBase.cs`	Extracted `GetCertificate` helper method and added second test certificate constant (Pfx2)
`sdk/core/Azure.Core/tests/HttpPipelineTests.cs`	Added test for transport update mechanism with `TransportUpdatingPolicy` test class
`sdk/core/Azure.Core/tests/HttpClientTransportFunctionalTest.cs`	Removed unused `certCallback` field
`sdk/core/Azure.Core.TestFramework/src/MockTransport.cs`	Implemented `UpdateTransport` to track transport updates in tests
`sdk/core/Azure.Core.TestFramework/src/Azure.Core.TestFramework.csproj`	Changed from PackageReference to ProjectReference for Azure.Core (likely temporary for testing)
`sdk/core/Azure.Core/api/*.cs`	Updated API surface files for all target frameworks with new public constructors and methods

Copilot · 2025-11-13T20:53:49Z

sdk/core/Azure.Core/src/Pipeline/HttpPipeline.cs

+            for (int i = 0; i < pipeline.Length; i++)
+            {
+                // If the policy implements ISupportsTransportCertificateUpdate, we need to subscribe to its TransportUpdated event
+                if (pipeline[i] is ISupportsTransportCertificateUpdate transportUpdated)
+                {
+                    transportUpdated.TransportOptionsChanged += options => _transport.UpdateTransport(options);
+                    break;
+                }
+            }


This is duplicate code from the constructor above (lines 61-69). Consider extracting this logic into a private helper method to avoid code duplication.

Copilot · 2025-11-13T20:53:50Z

sdk/core/Azure.Core/tests/PipelineTestBase.cs


+        protected X509Certificate2 GetCertificate(string pfx)
+        {
+            byte[] cer = Convert.FromBase64String(Pfx);


The parameter pfx is not used in this method. Instead, the method uses the constant Pfx from the class. This should be changed to use the pfx parameter that is passed in.

Suggested change

byte[] cer = Convert.FromBase64String(Pfx);

byte[] cer = Convert.FromBase64String(pfx);

sdk/core/Azure.Core/src/Pipeline/HttpClientTransport.cs

sdk/core/Azure.Core/src/Pipeline/HttpPipeline.cs

sdk/core/Azure.Core/src/Pipeline/Internal/ISupportsTransportUpdate.cs

Copilot · 2025-11-13T20:53:52Z

sdk/core/Azure.Core/tests/TransportFunctionalTests.cs

+
+                var transport = GetTransport(true, options);
+
+                // Initially no client certificate


The comment says "Initially no client certificate" but the code actually sets a client certificate in the options before creating the transport. The comment should say "Initially with first client certificate" or similar to accurately reflect what the code does.

Suggested change

// Initially no client certificate

// Initially with first client certificate (clientCert)

Copilot · 2025-11-13T20:53:53Z

sdk/core/Azure.Core/src/Pipeline/HttpWebRequestTransport.cs

+        {
+            if (this == Shared)
+            {
+                throw new InvalidOperationException("Cannot update the shared HttpClientTransport instance.");


The error message says "Cannot update the shared HttpClientTransport instance" but this is HttpWebRequestTransport, not HttpClientTransport. The error message should be corrected to reference the correct transport type.

Suggested change

throw new InvalidOperationException("Cannot update the shared HttpClientTransport instance.");

throw new InvalidOperationException("Cannot update the shared HttpWebRequestTransport instance.");

Copilot · 2025-11-13T20:53:53Z

sdk/core/Azure.Core/tests/HttpPipelineTests.cs

+
+        private X509Certificate2 GetTestCertificate()
+        {
+            // byte[] cer = Convert.FromBase64String(Pfx);


There is a commented-out line // byte[] cer = Convert.FromBase64String(Pfx); followed by the same line uncommented. The commented line should be removed as it appears to be leftover from development.

Suggested change

// byte[] cer = Convert.FromBase64String(Pfx);

sdk/core/Azure.Core/src/AccessToken.cs

KrzysztofCwalina · 2025-11-13T20:54:39Z

sdk/core/Azure.Core.TestFramework/src/MockTransport.cs


        public bool? ExpectSyncPipeline { get; set; }

+        public List<HttpPipelineTransportOptions> TransportUpdates { get; } = [];


why is this public?

This is on the mock transport so that code that is testing this can observe the transport updates that have occurred.

KrzysztofCwalina · 2025-11-13T20:55:35Z

sdk/core/Azure.Core/api/Azure.Core.net462.cs

        public void Dispose() { }
        public override void Process(Azure.Core.HttpMessage message) { }
        public override System.Threading.Tasks.ValueTask ProcessAsync(Azure.Core.HttpMessage message) { throw null; }
+        public override void UpdateTransport(Azure.Core.Pipeline.HttpPipelineTransportOptions options) { }


since the method is on transport type, should it be called simply Update?

Yes, I think that makes sense.

github-actions · 2025-11-13T20:57:44Z

API Change Check

APIView identified API level changes in this PR and created the following API reviews

Azure.Core

christothes added 14 commits November 13, 2025 14:00

wip

6d28cf0

tweaks to Pipeline and TransportPolicy

e6e0db9

wip

523ed95

wip

77964b3

wip

fc99dd6

policy based update

1793f3f

wip

1c0d769

wip with working tests

60070f6

export

0b99d3c

API fb

d3b2c7b

export

e9bf39d

wip

29450fd

cleanup

c21a9c6

cleanup

b786f3c

christothes requested a review from a team as a code owner November 13, 2025 20:42

Copilot AI review requested due to automatic review settings November 13, 2025 20:42

github-actions bot added the Azure.Core label Nov 13, 2025

Copilot started reviewing on behalf of christothes November 13, 2025 20:43 View session

Copilot finished reviewing on behalf of christothes November 13, 2025 20:45

Copilot AI reviewed Nov 13, 2025

View reviewed changes

KrzysztofCwalina reviewed Nov 13, 2025

View reviewed changes

fb

1a938c0

	byte[] cer = Convert.FromBase64String(Pfx);
	byte[] cer = Convert.FromBase64String(pfx);


		var transport = GetTransport(true, options);

		// Initially no client certificate

	// Initially no client certificate
	// Initially with first client certificate (clientCert)

	throw new InvalidOperationException("Cannot update the shared HttpClientTransport instance.");
	throw new InvalidOperationException("Cannot update the shared HttpWebRequestTransport instance.");


		public bool? ExpectSyncPipeline { get; set; }

		public List<HttpPipelineTransportOptions> TransportUpdates { get; } = [];

Handle client certificate rotation for token binding #53916

Are you sure you want to change the base?

Handle client certificate rotation for token binding #53916

Conversation

christothes commented Nov 13, 2025

Contributing to the Azure SDK

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

KrzysztofCwalina Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

christothes Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

KrzysztofCwalina Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

christothes Nov 13, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Nov 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

API Change Check

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions bot commented Nov 13, 2025 •

edited

Loading