Custom certificate validation (ARCH307)

Key dotnet.security.custom-certificate-validation · Severity error · Category security · CWE CWE-295

Overriding certificate validation with a callback that returns true accepts every TLS certificate, enabling man-in-the-middle attacks.

Incorrect

var handler = new HttpClientHandler
{
    ServerCertificateCustomValidationCallback =
        (msg, cert, chain, errors) => true
};

Correct

var handler = new HttpClientHandler();
// Default validation is used; trust the system certificate store.

Fix

Remove custom validation callbacks and rely on the platform’s default chain validation; if pinning is truly required, validate the chain and errors instead of returning true.