Add client-side WebHttpBinding support (closes #1413, #46)

[afifi-ins]

Closes #1413
Closes #46

Summary

Adds client-side WebHttpBinding support to .NET (Core) WCF. The entire System.ServiceModel.Web namespace (binding, behavior, attributes, WebChannelFactory<T>, UriTemplate, WebOperationContext, QueryStringConverter, ...) has been absent from dotnet/wcf since the start — confirmed missing in both dotnet/wcf and dotnet/runtime (the runtime ships a System.ServiceModel.Web shim that only forwards Syndication/JSON types — zero WCF REST types). Issues #1413 and #46 have tracked this gap since 2015–2016.

This PR introduces a new src/System.ServiceModel.Web/ package that ships ~14,000 LOC of client-side REST support, sourced from:

• CoreWCF.WebHttp v1.8.0 (MIT, .NET Foundation) — encoder factories, attributes, contexts, behavior, dispatcher formatters
• Microsoft .NET Framework Reference Source mirror in mono/mono (MIT since 2014) — the full UriTemplate cluster and WebChannelFactory<T> (CoreWCF doesn't ship these because they're either standalone utilities or strictly client-only)

What ships

Namespace	Public types
System	UriTemplate, UriTemplateTable, UriTemplateMatch, UriTemplateMatchException, UriTemplateEquivalenceComparer
System.ServiceModel	WebHttpBinding, WebHttpSecurity, WebHttpSecurityMode
System.ServiceModel.Channels	WebMessageEncodingBindingElement, WebContentTypeMapper, WebBodyFormatMessageProperty, WebContentFormat
System.ServiceModel.Description	WebHttpBehavior (~870 LOC)
System.ServiceModel.Dispatcher	QueryStringConverter, UriTemplateClientFormatter, SingleBodyParameter{,DataContract,XmlSerializer}MessageFormatter, DataContractJsonSerializerOperationFormatter, HttpStreamFormatter, {Xml,Json,Multiplexing}FormatMapping, UnwrappedTypesXmlSerializerManager, NameValueCache
System.ServiceModel.Web	WebGetAttribute, WebInvokeAttribute, WebChannelFactory<T>, WebFaultException, WebFaultException<T>, WebOperationContext, IncomingWebRequestContext, IncomingWebResponseContext, OutgoingWebRequestContext, OutgoingWebResponseContext, WebMessageFormat, WebMessageBodyStyle

Surgically deferred (NotSupportedException with clear messages)

dotnet/wcf is a client-only library, so the following server-side features are explicitly stubbed and documented per commit. Use CoreWCF.WebHttp on the server side:

• WebHttpBehavior.ApplyDispatchBehavior (and the helpers it called: WebHttpDispatchOperationSelector, UriTemplateDispatchFormatter, WebErrorHandler, FormatSelectingMessageInspector, MultiplexingDispatchMessageFormatter, HelpPage, HttpUnhandledOperationInvoker, ...)
• Raw octet-stream pass-through (ByteStreamMessage, MessageBodyStream, raw StreamBodyWriter)
• JSONP (WebScriptEnablingBehavior, JavascriptCallbackBehaviorAttribute)
• AspNetCacheProfileAttribute
• IIS WebServiceHost / WebServiceHostFactory

Primitives changes

Just one item — minimum required for a client-only port:

• InternalsVisibleTo("System.ServiceModel.Web") added to System.ServiceModel.Primitives.csproj so the new assembly can reach DiagnosticUtility.ExceptionUtility, Fx, XmlSerializerOperationBehavior.Reflector, internal IDispatchMessageFormatter, OperationFormatter.CreateDeserializationFailedFault, BufferedMessage/BufferedMessageData/BufferedMessageWriter, etc.

Same IVT entry added to System.ServiceModel.Http.csproj for HttpTransportDefaults.

Tests

• Unit tests in src/System.ServiceModel.Web/tests/ — 3 tests covering binding/factory/behavior construction. All passing locally (80ms).
• Scenario / outerloop tests in src/System.Private.ServiceModel/tests/Scenarios/Binding/WebHttp/Binding.WebHttp.IntegrationTests.csproj — 4 round-trip tests (EchoWithGet XML, EchoWithGetJson JSON, EchoWithPost, EchoWithGetPath path-var). Built and discovered; pending live CI run.
• Server-side test host WebHttpTestServiceHost.cs in tools/IISHostedWcfService/App_code/testhosts/ with contract IWcfWebHttpService. Auto-picked-up by SelfHostedCoreWcfService via the existing <Compile Include="..\IISHostedWcfService\**\*.cs"> glob. Helix auto-discovers the new test project via the **\*.IntegrationTests.csproj glob in eng/SendToHelix.proj — no CI registration changes needed.
• New file tests/Common/Scenarios/Endpoints.WebHttp.cs extends the existing public static partial class Endpoints with HttpBaseAddress_WebHttp[_*] properties.

Build verification

build.cmd -build -configuration Release
=> Build succeeded.
   0 Warning(s)
   0 Error(s)

Release notes

release-notes/SupportedFeatures-v2.1.0.md: WebHttpBinding bumped from 🚫 to ⚠️ (partially supported) on Windows / Linux / macOS.

Commits

1. Scaffold System.ServiceModel.Web package (csproj, sln, IVT, EnablePackageValidation=false)
2. Port UriTemplate cluster from .NET Framework reference source (20 files / ~4,800 LOC)
3. Suppress SYSLIB0051 on UriTemplateMatchException serialization ctor
4. Demote MSB3243 to message in test csproj (collision with runtime v4 shim)
5. Port Phase 3: encoding plumbing from CoreWCF.WebHttp v1.8.0
6. Port Phase 4: attributes, faults, web operation context
7. Port Phase 5: WebHttpBinding, WebHttpBehavior, client-side dispatchers (the big one — ~10,300 LOC)
8. Port WebChannelFactory + add Phase 6 test infrastructure
9. Bump WebHttpBinding from not-supported to partially-supported

Source attribution

Every commit message documents source provenance:

• mono/mono @ 0f53e9e1 for files lifted from the Microsoft Reference Source
• CoreWCF/CoreWCF @ v1.8.0 for files lifted from CoreWCF.WebHttp
• All sources MIT-licensed; .NET Foundation MIT header applied to every ported file

[mconnew]

ConfigureAuthentication maps ClientCredentialType but never sets http.ProxyAuthenticationScheme. dotnet/wcf's own HttpTransportSecurity.ConfigureAuthentication does set it (http.ProxyAuthenticationScheme = HttpProxyCredentialTypeHelper.MapToAuthenticationScheme(_proxyCredentialType)), and HttpChannelFactory consumes it when an explicit proxy address is configured. As written, Security.Transport.ProxyCredentialType is silently dropped here.

This is compounded by WebHttpBinding not exposing ProxyAddress/UseDefaultWebProxy/BypassProxyOnLocal (all settable on the transport element), so the authenticated-proxy support that .NET Framework's WebHttpBinding had is effectively lost. Suggest mapping the proxy scheme here (mirroring the MapToAuthenticationScheme switch below, since HttpProxyCredentialTypeHelper is internal to System.ServiceModel.Http) and surfacing the proxy properties on the binding.

[afifi-ins]

Fixed in 2e64a7d: ConfigureAuthentication now sets both http.AuthenticationScheme (from ClientCredentialType) and http.ProxyAuthenticationScheme (from ProxyCredentialType). Called HttpProxyCredentialTypeHelper.MapToAuthenticationScheme directly - it's internal to System.ServiceModel.Http but visible to us via [InternalsVisibleTo], so no need to duplicate the switch inline. This pairs with f34d2bc which exposes ProxyAddress/UseDefaultWebProxy/BypassProxyOnLocal on WebHttpBinding, so authenticated corporate proxies now work end-to-end.

Test: WebHttpBinding_ProxyCredentialType_FlowsToTransportProxyAuthenticationScheme [WcfTheory] covers all five HttpProxyCredentialType values.

[mconnew]

The comment here isn't accurate — AllowCookies is fully supported in dotnet/wcf. HttpTransportBindingElement.AllowCookies exists and HttpChannelFactory honors it (clientHandler.UseCookies = AllowCookies); WSHttpBinding/HttpBindingBase already wire it to both transports. It can be implemented the same way rather than left as a commented/throwing stub:

[DefaultValue(HttpTransportDefaults.AllowCookies)]
public bool AllowCookies
{
    get { return _httpTransportBindingElement.AllowCookies; }
    set
    {
        _httpTransportBindingElement.AllowCookies = value;
        _httpsTransportBindingElement.AllowCookies = value;
    }
}

The same goes for ProxyAddress, UseDefaultWebProxy, and BypassProxyOnLocal — .NET FX exposed them and they're settable on the transport element, but they're omitted here. (HostNameComparisonMode genuinely isn't on the element yet, so leaving that one out is fair.)

[afifi-ins]

Fixed in f34d2bc: added AllowCookies, ProxyAddress, UseDefaultWebProxy, BypassProxyOnLocal on WebHttpBinding, each propagating to both the HTTP and HTTPS transport binding elements (same pattern HttpBindingBase uses). Removed the misleading not-supported comment. Left HostNameComparisonMode out per your note.

Tests:

• WebHttpBinding_AllowCookies_PropagatesToBothTransports, WebHttpBinding_ProxyAddress_PropagatesToBothTransports, WebHttpBinding_UseDefaultWebProxy_And_BypassProxyOnLocal_PropagateToBothTransports: walk both HTTP and HTTPS transport BEs via CreateBindingElements() and assert.
• WebHttpBinding_AllowCookies_RoundTripsCookieHeader: end-to-end via a local HttpListener - the first response Set-Cookie: sid=abc123, the test asserts the second request carries sid=abc123 back.

[mconnew]

The reference WebHttpBinding overrides BuildChannelFactory to throw InvalidOperationException up front when Security.Mode is Transport/TransportCredentialOnly and Transport.ClientCredentialType == InheritedFromHost (a value that's invalid on a client). That override isn't ported.

The case still fails — InheritedFromHost maps to AuthenticationSchemes.None, so HttpTransportBindingElement.BuildChannelFactory throws — but as an ArgumentException (HttpAuthSchemeCannotBeNone), a different exception type/message than .NET Framework produced. Minor, but porting the guard restores parity and gives a clearer error at factory-creation time.

[afifi-ins]

Fixed in db4e189: added the BuildChannelFactory(BindingParameterCollection) override on WebHttpBinding that throws InvalidOperationException up front for Transport / TransportCredentialOnly + InheritedFromHost, matching WSHttpBinding's equivalent guard. Also fixed a pre-existing bug in Resources/Strings.resx: the HttpClientCredentialTypeInvalid entry we inherited from the CoreWCF port had a wrong message body ('There is no {0} on the incoming Message.') - restored the correct .NET Framework text.

Tests:

• WebHttpBinding_InheritedFromHost_ThrowsInvalidOperationExceptionAtFactoryCreation [WcfTheory] over Transport and TransportCredentialOnly: exercises the guard via binding.BuildChannelFactory() directly (the same path ChannelFactory.CreateFactory takes at Open).
• WebHttpBinding_InheritedFromHost_DoesNotThrow_WhenSecurityModeIsNone: negative test confirming the guard doesn't over-fire in None mode.

[mconnew]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).

[mconnew]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).

[mconnew]

| |WebHttpBinding |:no_entry_sign:

We shouldn't be modifying this file as it's the features released with a really old version.

[afifi-ins]

Reverted in f4b0821 — restored the WebHttpBinding row to its original state and left the v2.1.0 notes untouched. Thanks.

[mconnew]

Can you explain what internals are needed by System.ServiceModel.Web from System.ServiceModel.Http? Would any of them be reasonable to expose publicly? Basically should we keep this or can we work around all the issues? InternalsVisibleTo is generally not the best way to solve a problem unless absolutely needed.

[afifi-ins]

Good question — I dug into exactly what''s consumed. The System.ServiceModel.Web package references only two internal symbols from System.ServiceModel.Http, and both are trivially removable, so we can drop this InternalsVisibleTo entirely.

1. HttpTransportDefaults (internal static class of const defaults) — 5 uses, all [DefaultValue(...)] attributes on the WebHttpBinding proxy/cookie properties (AllowCookies, BypassProxyOnLocal, ProxyAddress, UseDefaultWebProxy, TransferMode). WSHttpBinding/HttpBindingBase can use these because they live inside System.ServiceModel.Http; WebHttpBinding can''t.

• Workaround: inline the literal default values in the attributes (they''re compile-time constants anyway): [DefaultValue(false)] for AllowCookies/BypassProxyOnLocal, [DefaultValue(true)] for UseDefaultWebProxy, [DefaultValue(null)] for ProxyAddress, [DefaultValue(TransferMode.Buffered)] for TransferMode (TransferMode is public). No internal needed.

2. HttpProxyCredentialTypeHelper.MapToAuthenticationScheme — 1 use, in HttpTransportHelpers.ConfigureAuthentication (maps HttpProxyCredentialType -> AuthenticationSchemes).

• Workaround: inline the ~6-line switch locally, exactly as you suggested on the HttpTransportHelpers.cs thread ("mirroring the MapToAuthenticationScheme switch below"). The file already has the sibling ClientCredentialType switch inlined, so this is consistent.

Verified empirically: removing the IVT and rebuilding, the only compiler break is the HttpTransportDefaults references — confirming those two are the entire surface.

So: we can remove this InternalsVisibleTo line. I''ll fold the two inlinings into the cleanup pass. (The separate System.ServiceModel.Primitives -> System.ServiceModel.Web IVT is a different case — it''s the same entry every sibling package already has for shared Primitives internals, so I''ll leave that one as-is unless you want it revisited too.)

[mconnew]

{

Consider replacing with ObjectPool<T> from the runtime.

---

Refers to: src/System.ServiceModel.Web/src/System/ServiceModel/Pool.cs:9 in db4e189. [](commit_id = db4e189, deletion_comment = False)

[mconnew]

public class UriTemplate

No need for the type forward as this won't be consumed by assemblies compiled for .NET 3.5

---

Refers to: src/System.ServiceModel.Web/src/System/UriTemplate.cs:19 in a0df75f. [](commit_id = a0df75f, deletion_comment = False)

[mconnew]

Update to use naming conventions for instance fields

---

Refers to: src/System.ServiceModel.Web/src/System/UriTemplate.cs:22 in a0df75f. [](commit_id = a0df75f, deletion_comment = False)

[mconnew]

        }

Use nameof for arguments/parameters that are referenced by exceptions.

---

Refers to: src/System.ServiceModel.Web/src/System/UriTemplate.cs:57 in a0df75f. [](commit_id = a0df75f, deletion_comment = False)

[mconnew]

        : this(template, ignoreTrailingSlash, null)

Formatting, there should be a blank line between each method/constructor

---

Refers to: src/System.ServiceModel.Web/src/System/UriTemplate.cs:45 in a0df75f. [](commit_id = a0df75f, deletion_comment = False)

[mconnew]

        this.ignoreTrailingSlash = ignoreTrailingSlash;

this. shouldn't generally be needed and the current coding standards says to omit it if not needed.

---

Refers to: src/System.ServiceModel.Web/src/System/UriTemplate.cs:59 in a0df75f. [](commit_id = a0df75f, deletion_comment = False)

[mconnew]

                SR.UTBadBaseAddress));

SR.Format is only needed when there string resource is parameterized. When it isn't parameterized, you can use the string resource directly without calling SR.Format.

---

Refers to: src/System.ServiceModel.Web/src/System/UriTemplate.cs:337 in a0df75f. [](commit_id = a0df75f, deletion_comment = False)

[mconnew]

    //  templates as such based on the structure of them and not based on the set of uri

Nit: Typo in comment. Intuative -> intuitive.

---

Refers to: src/System.ServiceModel.Web/src/System/UriTemplate.cs:410 in a0df75f. [](commit_id = a0df75f, deletion_comment = False)

[mconnew]

            // and warning suppression isn't working

This can probably be removed as it was included to stop a false positive on a static analysis rule in the .NET Framework source code. Replace with an Fx.Assert that they are not null to ensure the stated assertion holds true.

---

Refers to: src/System.ServiceModel.Web/src/System/UriTemplate.cs:429 in a0df75f. [](commit_id = a0df75f, deletion_comment = False)

[mconnew]

        {

Formatting, we put blank lines after closing braces of code block, unless the next line is another closing brace.

---

Refers to: src/System.ServiceModel.Web/src/System/UriTemplate.cs:451 in a0df75f. [](commit_id = a0df75f, deletion_comment = False)

[mconnew]

        Fx.Assert(segmentsCount >= this.firstOptionalSegment - 1, "How can that be? The Trie is constructed that way!");

Nit: extra space on final line of comment

---

Refers to: src/System.ServiceModel.Web/src/System/UriTemplate.cs:582 in a0df75f. [](commit_id = a0df75f, deletion_comment = False)

[mconnew]

    {

All methods should have their accessibility explicitly stated. We do rely on default accessibility.

---

Refers to: src/System.ServiceModel.Web/src/System/UriTemplate.cs:633 in a0df75f. [](commit_id = a0df75f, deletion_comment = False)

[mconnew]

            }

Update to use expression bodies where appropriate.

---

Refers to: src/System.ServiceModel.Web/src/System/UriTemplate.cs:981 in a0df75f. [](commit_id = a0df75f, deletion_comment = False)