[Roger Barreto (rogerbarreto)]

Motivation and Context

HttpPlugin validated resolved addresses before sending a request, but the built-in HTTP transport did not retain that address set when opening the connection. This change keeps the validation decision and the resulting connection consistent.

Description

• Moves the existing validated-address connection handling into the shared internal HTTP client provider.
• Passes the addresses validated by HttpPlugin to the built-in transport while preserving the original HTTP and TLS hostname.
• Keeps validated and explicitly unchecked requests in separate connection pools.
• Fails closed for hostname requests when a caller-supplied client or target framework cannot guarantee address binding.
• Adds deterministic request projection, connection, and custom-client regression coverage.

Validation:

• dotnet build dotnet\src\Plugins\Plugins.Core\Plugins.Core.csproj -c Debug --tl:off --warnaserror --no-restore — passed for net10.0, net8.0, and netstandard2.0 with no warnings.
• dotnet build dotnet\src\Functions\Functions.OpenApi\Functions.OpenApi.csproj -c Debug --tl:off --warnaserror --no-restore — passed for net10.0, net8.0, and netstandard2.0 with no warnings.
• dotnet build dotnet\src\Plugins\Plugins.UnitTests\Plugins.UnitTests.csproj -f net10.0 -c Debug --tl:off --warnaserror --no-restore — passed with no warnings.
• dotnet build dotnet\src\Functions\Functions.UnitTests\Functions.UnitTests.csproj -f net10.0 -c Debug --tl:off --warnaserror --no-restore — passed with no warnings.
• dotnet test dotnet\src\Plugins\Plugins.UnitTests\Plugins.UnitTests.csproj -f net10.0 -c Debug --no-restore -v Normal --logger trx — passed: 583 passed, 15 environment-specific skips, 0 failed.
• dotnet test dotnet\src\Functions\Functions.UnitTests\Functions.UnitTests.csproj -f net10.0 -c Debug --no-restore --filter FullyQualifiedName~OpenApiHttpClientProviderTests -v Normal --logger trx — passed: 11 passed, 0 failed.
• Container-based dotnet format --verify-no-changes for the affected projects — passed.

Contribution Checklist

• The code builds clean without any errors or warnings
• The PR follows the SK Contribution Guidelines and the pre-submission formatting script raises no violations
• All unit tests pass, and I have added new tests where possible
• I didn't break anyone 😄

[Copilot]

🟡 Changes recommended

The validated HTTP handler leaves proxy routing enabled, allowing a configured proxy to bypass address validation and reach private addresses even when AllowPrivateNetworkAccess is false.

1 open issue

• Validated requests still use proxies, bypassing private-network checks · New

What changed in this PR

This PR connects HttpPlugin address validation to the built-in HTTP transport, reusing connection-handling logic previously owned by the OpenAPI provider.

Changes:

• Moves validated-address connection handling and separate validated/unchecked pools into the shared HTTP client provider.
• Passes validated addresses from HttpPlugin to the transport and rejects hostname requests when address binding cannot be guaranteed.
• Adds tests for address propagation, custom-client rejection, and connections that preserve the original HTTP hostname.

File	Description
dotnet/​src/​Plugins/​Plugins.UnitTests/​Core/​HttpPluginTests.cs	Adds address-binding and custom-client regression tests.
dotnet/​src/​Plugins/​Plugins.Core/​HttpPlugin.cs	Supplies validated addresses and enforces transport support.
dotnet/​src/​InternalUtilities/​src/​Http/​HttpClientProvider.cs	Centralizes address-bound connections and separate connection pools.
dotnet/​src/​Functions/​Functions.OpenApi/​OpenApiHttpClientProvider.cs	Delegates transport creation to the shared provider.

_{Review effort: Balanced}

[Roger Barreto (rogerbarreto)]

Valid. Validated pool now disables proxy routing; unchecked pool still honors configured and system proxies. Added configured-proxy regressions for both paths. Fixed in 6386ad474.