TLS server-certificate validation is turned off: the handler accepts any certificate via DangerousAcceptAnyServerCertificateValidator or a callback that always returns true.
Why AI tools produce this: AI coding tools generate this anti-pattern by default, it appears in a large share of AI-written auth code.
Why this matters
With validation bypassed, an on-path attacker presenting a forged or self-signed certificate is trusted, and the entire TLS protection (including any OAuth token in transit) is defeated (CWE-295). This is a common AI-generated shortcut to silence a certificate error during development.
Remove the override and let the system trust store validate the certificate. If a private CA is involved, install/trust that CA rather than accepting all certificates; scope any relaxed check to a single pinned host in development only.
VULNERABLE
vulnerable.cs
using System.Net.Http;using System.Net.Security;public class HttpClientFactory{ public HttpClient BuildDangerous() { var handler = new HttpClientHandler(); // ruleid: auth.csharp.tls.disable-cert-validation handler.ServerCertificateCustomValidationCallback = HttpClientHandler.DangerousAcceptAnyServerCertificateValidator; return new HttpClient(handler); } public HttpClient BuildAlwaysTrueLambda() { var handler = new HttpClientHandler(); // ruleid: auth.csharp.tls.disable-cert-validation handler.ServerCertificateCustomValidationCallback = (message, cert, chain, errors) => true; return new HttpClient(handler); } public void ConfigureRemote() { // ruleid: auth.csharp.tls.disable-cert-validation System.Net.ServicePointManager.ServerCertificateValidationCallback = (sender, cert, chain, errors) => true; } public void ConfigureSslStream(SslClientAuthenticationOptions options) { // ruleid: auth.csharp.tls.disable-cert-validation options.RemoteCertificateValidationCallback = (sender, cert, chain, errors) => true; }}
SAFE
safe.cs
using System.Net.Http;using System.Net.Security;using System.Security.Cryptography.X509Certificates;public class HttpClientFactory{ public HttpClient BuildTrusted() { var handler = new HttpClientHandler(); handler.ServerCertificateCustomValidationCallback = (message, cert, chain, errors) => errors == SslPolicyErrors.None; return new HttpClient(handler); } public HttpClient BuildDefault() { return new HttpClient(new HttpClientHandler()); }}
Suppressing this rule
If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.