Skip to content

Use a local HTTPS server in SslTest.HttpsShouldWork - #12058

Merged
simonrozsival merged 2 commits into
mainfrom
copilot/fix-flaky-ssl-test
Jul 14, 2026
Merged

Use a local HTTPS server in SslTest.HttpsShouldWork#12058
simonrozsival merged 2 commits into
mainfrom
copilot/fix-flaky-ssl-test

Conversation

CopilotAI commented Jul 13, 2026

Copy link
Copy Markdown
Contributor

HttpsShouldWork depended on live Microsoft and Bing endpoints, allowing external HTTP failures such as 504 responses to fail on-device tests.

  • Local HTTPS coverage

    • Replaces external requests with the existing loopback LocalHttpsServer.
    • Uses the server’s /ok endpoint and verifies the response is HTTP 200 with content.
  • Certificate handling

    • Temporarily accepts the self-signed test certificate.
    • Restores the previous ServicePointManager callback after the request.
usingvarserver=LocalHttpsServer.Start();HttpWebRequestrequest=(HttpWebRequest)WebRequest.Create(server.OkUri);usingHttpWebResponseresponse=(HttpWebResponse)request.GetResponse();

Co-authored-by: simonrozsival <374616+simonrozsival@users.noreply.github.com>
CopilotAI changed the title [WIP] Fix flaky SslTest.HttpsShouldWork due to external server errorsUse a local HTTPS server in SslTest.HttpsShouldWorkJul 13, 2026
CopilotAI requested a review from simonrozsivalJuly 13, 2026 20:10
@simonrozsival
simonrozsival marked this pull request as ready for review July 13, 2026 21:55
CopilotAI review requested due to automatic review settings July 13, 2026 21:55

CopilotAI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR improves reliability of on-device networking tests by removing dependency on external HTTPS endpoints in SslTest.HttpsShouldWork and instead using the existing loopback LocalHttpsServer, reducing flakiness from transient internet/service failures.

Changes:

  • Replace requests to dotnet.microsoft.com/bing.com with a request to LocalHttpsServer’s /ok endpoint.
  • Validate the local response (HTTP 200 + non-empty content) and assert the local server had no unhandled exceptions.
  • Temporarily override ServicePointManager.ServerCertificateValidationCallback during the request (with restoration afterward).
Show a summary per file
FileDescription
tests/Mono.Android-Tests/Mono.Android-Tests/System.Net/SslTest.csSwitch HttpsShouldWork to use the in-process local HTTPS test server instead of external sites.

Copilot's findings

  • Files reviewed: 1/1 changed files
  • Comments generated: 1

@simonrozsivalsimonrozsival added the ready-to-review This PR is ready to review/merge, I think any CI failures are just flaky (ignorable). label Jul 14, 2026
simonrozsival added a commit that referenced this pull request Jul 14, 2026
> Re-opened as a direct PR (supersedes #12098) so the `dotnet-android` pipeline runs automatically without `/azp run` approval.
### Context
Following up on #12022 (which migrated most on-device networking tests off live external URLs to the loopback `LocalHttpServer`/`LocalHttpsServer`) and #12058 (which handles `SslTest.HttpsShouldWork`), a few on-device tests were still reaching out to the public internet. Those requests made the tests flaky whenever the external endpoints were slow, rate-limited, or unavailable.
This migrates the remaining tests to local loopback servers.
### Tests migrated
| Test | Was hitting |
| ---- | ----------- |
| `SslTest.SslWithinTasksShouldWork` | `dotnet.microsoft.com` |
| `ProxyTest.QuoteInvalidQuoteUrlsShouldWork` | `msftconnecttest.com` |
| `AndroidMessageHandlerTests.ServerCertificateCustomValidationCallback_ApproveRequest` | `www.microsoft.com` |
| `AndroidMessageHandlerTests.ServerCertificateCustomValidationCallback_RejectRequest` | `www.microsoft.com` |
| `AndroidMessageHandlerTests.AndroidMessageHandlerSendsClientCertificate` | `corefx-net-tls.azurewebsites.net` |
| `AndroidMessageHandlerIntegrationTests.GetString_Many` | `google.com` |
| `HttpClientHandlerTestBase.Disposed` | `google.com` |
| `WebSocketTests.TestSocketConnection` | `echo.websocket.org` (was `[Ignore]`d) |
`ProxyTest` keeps its original point — an unescaped `|` in the query string (`?query&foo|bar`) — now exercised against the local `/ok` endpoint. `WebSocketTests` was previously disabled because the public echo server no longer exists; it is re-enabled against a local server.
### Test infrastructure (`LocalTestServers.cs`)
- **Client certificates (mutual TLS)**: `LocalHttpsServer.Start (requestClientCertificate: true)` now requests a client certificate during the TLS handshake, and a new `/echo-client-certificate` endpoint returns the certificate the server received (base64 DER). This replaces the external `EchoClientCertificate.ashx` endpoint.
- **`LocalWebSocketServer`**: a loopback WebSocket echo server that performs the upgrade handshake and echoes messages back (uses `WebSocket.CreateFromStream` after a manual `101 Switching Protocols` response).
### Notes
- `HttpsShouldWork` is intentionally left to #12058.
- The `http://10.255.255.1` cancellation/timeout tests deliberately use an unroutable address (not the public internet) and are unchanged.
- Cosmetic external hostnames that were never actually contacted (`CancelRequestViaProxy`'s base address behind a dead proxy, and `DisallowAutoRedirect`'s redirect target) were pointed at `localhost`.
The new server logic (HTTP, HTTPS, mutual-TLS echo, and WebSocket echo) was verified end-to-end against `HttpClient` and `ClientWebSocket` on desktop .NET.
@simonrozsival
simonrozsival enabled auto-merge (squash) July 14, 2026 14:03
@simonrozsival
simonrozsival merged commit 33008fb into mainJul 14, 2026
43 checks passed
@simonrozsival
simonrozsival deleted the copilot/fix-flaky-ssl-test branch July 14, 2026 14:26
@jonathanpeppersjonathanpeppers mentioned this pull request Aug 12, 2026
10 tasks
@github-actionsgithub-actionsBot locked and limited conversation to collaborators Aug 14, 2026
Sign up for freeto subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

ready-to-reviewThis PR is ready to review/merge, I think any CI failures are just flaky (ignorable).

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Flaky test] SslTest.HttpsShouldWork fails on external server errors (504 Gateway Time-out)

4 participants

@simonrozsival@jonathanpeppers