Enforce HTTPS for WS-Trust endpoints

[Logan Dorsey (logdog16)]

Changes proposed in this request

• Harden WS-Trust endpoint validation and redirect handling.
• Require HTTPS for remotely supplied federation metadata and selected WS-Trust endpoints.
• Add regression coverage for endpoint selection and rejected insecure requests.

Testing

• Added unit tests covering federation metadata validation, WS-Trust endpoint selection, redirect handling, and request suppression.
• Product and unit-test projects build successfully across the affected target frameworks.
• Focused test execution is blocked locally by an MSTest 4.0.2 adapter/runtime mismatch; CI validation is required.

Performance impact
No expected measurable impact. The additional HTTP client configuration is created only when needed and is pooled for reuse.

Documentation

• No documentation changes are required.

[Copilot]

Pull request overview

This PR hardens WS-Trust and federation metadata handling by enforcing HTTPS-only endpoints and adding redirect-related protections, along with unit test coverage to prevent regressions in endpoint selection and request behavior.

Changes:

• Enforces HTTPS for federation metadata URLs and for WS-Trust endpoints selected/used by WS-Trust flows, with explicit non-HTTPS redirect rejection.
• Introduces redirect-control plumbing (new allowAutoRedirect parameter on IHttpManager.SendRequestAsync, HttpResponse.RequestUri, and an internal IHttpClientFactoryWithRedirectControl) to support disabling auto-redirect for sensitive requests.
• Adds/extends unit tests for MEX parsing, endpoint selection, and redirect/insecure-endpoint rejection scenarios.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/Microsoft.Identity.Test.Unit/RequestsTests/IntegratedWindowsAuthUsernamePasswordTests.cs	Adds regression test ensuring injected HTTP WS-Trust endpoints from metadata are rejected before any WS-Trust request is sent.
tests/Microsoft.Identity.Test.Unit/Helpers/ParallelRequestMockHandler.cs	Updates test IHttpManager implementation signature to include redirect control.
tests/Microsoft.Identity.Test.Unit/CoreTests/WsTrustTests/WsTrustTests.cs	Adds tests for disallowing auto-redirect and rejecting non-HTTPS redirects / HTTP WS-Trust endpoints.
tests/Microsoft.Identity.Test.Unit/CoreTests/WsTrustTests/MexParserTests.cs	Adds tests for HTTPS-only endpoint selection and rejecting HTTP MEX endpoints / non-HTTPS redirects; expands input validation coverage.
tests/Microsoft.Identity.Test.Unit/CoreTests/HttpTests/HttpClientFactoryTests.cs	Verifies redirect-disabled clients use a separate cached instance from the default pool.
src/client/Microsoft.Identity.Lab.Api/Http/MockHttpManager.cs	Propagates allowAutoRedirect through mocks and applies it to the handler used by test HttpClient instances.
src/client/Microsoft.Identity.Client/WsTrust/WsTrustWebRequestManager.cs	Adds federation metadata URL validation, HTTPS enforcement, redirect checks, disables auto-redirect for WS-Trust calls, and introduces helpers for HTTPS/redirect detection.
src/client/Microsoft.Identity.Client/WsTrust/MexDocument.cs	Filters out non-HTTPS WS-Trust endpoint addresses during MEX parsing.
src/client/Microsoft.Identity.Client/PlatformsCommon/Shared/SimpleHttpClientFactory.cs	Adds redirect-controlled pooling for non-mTLS clients and supports redirect control via internal interface.
src/client/Microsoft.Identity.Client/MsalErrorMessage.cs	Updates/introduces WS-Trust-specific error messages for HTTPS requirements and redirect rejection.
src/client/Microsoft.Identity.Client/Http/IHttpManager.cs	Extends SendRequestAsync contract to include allowAutoRedirect.
src/client/Microsoft.Identity.Client/Http/IHttpClientFactoryWithRedirectControl.cs	Adds internal interface for factories that can supply redirect-enabled/disabled clients.
src/client/Microsoft.Identity.Client/Http/HttpResponse.cs	Adds RequestUri to help detect final request URI after redirects.
src/client/Microsoft.Identity.Client/Http/HttpManager.cs	Threads redirect control through request execution and records RequestUri in HttpResponse.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated no new comments.

[Logan Dorsey (logdog16)]

Bogdan Gavril (@bgavrilMS) / Travis Walker (@trwalke) / Neha Bhargava (@neha-bhargava) can I get a review on this? I've got an active ICM for this bug and need it merged.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

src/client/Microsoft.Identity.Client/WsTrust/WsTrustWebRequestManager.cs:186

• When MaxRedirects is reached for a WS-Trust request, the loop breaks and the method throws a FederatedServiceReturnedError based on the last 3xx response, which can be misleading. Throwing a dedicated exception when the redirect limit is exceeded would make failures easier to understand.

                if (!TryGetSecureRedirectUri(resp, requestUri, out Uri redirectUri) ||
                    redirectCount >= MaxRedirects)
                {
                    break;
                }