Skip to content

Restore CustomizeHttpRequestMessage to run after the authorization header - #3943

Merged
Bogdan Gavril (bgavrilMS) merged 1 commit into
masterfrom
nebharg/fix-customizehttprequestmessage-regression
Jul 14, 2026
Merged

Restore CustomizeHttpRequestMessage to run after the authorization header#3943
Bogdan Gavril (bgavrilMS) merged 1 commit into
masterfrom
nebharg/fix-customizehttprequestmessage-regression

Conversation

@neha-bhargava

@neha-bhargava Neha Bhargava (neha-bhargava) commented Jul 14, 2026

Copy link
Copy Markdown
Contributor

Problem

CustomizeHttpRequestMessage is documented to run after the message is formed — "including the Authorization header, and just before the message is sent." #3902 moved it before authorization-header creation (to flow the finalized request for request-binding), which violated that contract and regressed callers that read the header in the callback — they saw a null Authorization header.

Fix

Move only the CustomizeHttpRequestMessage invocation back to after the header is set. The request-flow plumbing that #3902/request-binding relies on (options material applied before header creation + SetHttpRequestMessage) is left untouched, so this is a minimal, targeted regression fix.

Test

Adds UpdateRequestAsync_CustomizeHttpRequestMessage_SeesAuthorizationHeaderAsync, asserting the callback observes the Authorization header. Also updated the existing flow test, which had asserted the callback flowed to the provider (no longer true now that it runs after).

Notes

@neha-bhargava
Neha Bhargava (neha-bhargava) requested a review from a team as a code owner July 14, 2026 04:35
@neha-bhargava
Restore CustomizeHttpRequestMessage to run after the authorization he…
9f8e174 
…ader

CustomizeHttpRequestMessage is documented to run after the message is formed,
including the Authorization header, and just before it is sent. #3902 moved it
before authorization-header creation (to flow the finalized request for
request-binding), which regressed callers that read the header in the callback -
they saw a null Authorization header.

This moves only the CustomizeHttpRequestMessage invocation back to after the
header is set, leaving the request-flow plumbing (options material +
SetHttpRequestMessage) untouched. Adds a regression test asserting the callback
observes the Authorization header.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@neha-bhargava
Neha Bhargava (neha-bhargava) force-pushed the nebharg/fix-customizehttprequestmessage-regression branch from 5de5090 to 9f8e174 Compare July 14, 2026 04:35
Neha Bhargava (neha-bhargava) added a commit that referenced this pull request Jul 14, 2026
@neha-bhargava
Add OnBeforeAuthHeaderCreation / OnAfterAuthHeaderCreation hooks to D…
d39f979 
…ownstreamApi

Honor the new AuthorizationHeaderProviderOptions hooks from
Microsoft.Identity.Abstractions 12.5.0:

- OnBeforeAuthHeaderCreation runs before the authorization header is created and
  signed, so callers can shape the request that request-binding protocols
  (SignedHttpRequest q/h/b) sign, ensuring the signature covers the finalized
  request.
- OnAfterAuthHeaderCreation runs after the header is attached, alongside
  CustomizeHttpRequestMessage.

Also declare IAuthorizationHeaderProvider2 only on the Base/Default header
providers (it already extends IAuthorizationHeaderProvider).

Stacked on the regression fix (#3943).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@neha-bhargava Neha Bhargava (neha-bhargava) mentioned this pull request Jul 14, 2026
Merged
Neha Bhargava (neha-bhargava) added a commit that referenced this pull request Jul 14, 2026
@neha-bhargava
Add OnBeforeAuthHeaderCreation / OnAfterAuthHeaderCreation hooks to D…
83999d9 
…ownstreamApi

Honor the new AuthorizationHeaderProviderOptions hooks from
Microsoft.Identity.Abstractions 12.5.0:

- OnBeforeAuthHeaderCreation runs before the authorization header is created and
  signed, so callers can shape the request that request-binding protocols
  (SignedHttpRequest q/h/b) sign, ensuring the signature covers the finalized
  request. Also propagated through MicrosoftIdentityMessageHandler.
- OnAfterAuthHeaderCreation runs after the header is attached. It is a symmetric
  alias of the pre-existing CustomizeHttpRequestMessage (same delegate), so the
  "after" callback is invoked exactly once.

Also declare IAuthorizationHeaderProvider2 only on the Base/Default header
providers (it already extends IAuthorizationHeaderProvider).

Stacked on the regression fix (#3943).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@bgavrilMS
Bogdan Gavril (bgavrilMS) merged commit ca02477 into master Jul 14, 2026
8 checks passed
@bgavrilMS
Bogdan Gavril (bgavrilMS) deleted the nebharg/fix-customizehttprequestmessage-regression branch July 14, 2026 10:36
Neha Bhargava (neha-bhargava) added a commit that referenced this pull request Jul 14, 2026
@neha-bhargava
Add OnBeforeAuthHeaderCreation / OnAfterAuthHeaderCreation hooks to D…
deaf932 
…ownstreamApi

Honor the new AuthorizationHeaderProviderOptions hooks from
Microsoft.Identity.Abstractions 12.5.0:

- OnBeforeAuthHeaderCreation runs before the authorization header is created and
  signed, so callers can shape the request that request-binding protocols
  (SignedHttpRequest q/h/b) sign, ensuring the signature covers the finalized
  request.
- OnAfterAuthHeaderCreation runs after the header is attached. The pre-existing
  CustomizeHttpRequestMessage is still invoked at the same point for backwards
  compatibility.

Both hooks are propagated through MicrosoftIdentityMessageHandler.

Also declare IAuthorizationHeaderProvider2 only on the Base/Default header
providers (it already extends IAuthorizationHeaderProvider), and type the
Base provider's delegate field as IAuthorizationHeaderProvider2 to avoid
upcasting at the metadata delegation sites.

Stacked on the regression fix (#3943).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Neha Bhargava (neha-bhargava) added a commit that referenced this pull request Jul 14, 2026
@neha-bhargava
Add OnBeforeAuthHeaderCreation / OnAfterAuthHeaderCreation hooks to D…
19da5e1 
…ownstreamApi

Honor the new AuthorizationHeaderProviderOptions hooks from
Microsoft.Identity.Abstractions 12.5.0:

- OnBeforeAuthHeaderCreation runs before the authorization header is created and
  signed, so callers can shape the request that request-binding protocols
  (SignedHttpRequest q/h/b) sign, ensuring the signature covers the finalized
  request.
- OnAfterAuthHeaderCreation runs after the header is attached. The pre-existing
  CustomizeHttpRequestMessage is still invoked at the same point for backwards
  compatibility.

Both hooks are propagated through MicrosoftIdentityMessageHandler.

Also declare IAuthorizationHeaderProvider2 only on the Base/Default header
providers (it already extends IAuthorizationHeaderProvider), and type the
Base provider's delegate field as IAuthorizationHeaderProvider2 to avoid
upcasting at the metadata delegation sites.

Stacked on the regression fix (#3943).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Neha Bhargava (neha-bhargava) added a commit that referenced this pull request Jul 14, 2026
@neha-bhargava
Add OnBeforeAuthHeaderCreation / OnAfterAuthHeaderCreation hooks to D…
022f5fc 
…ownstreamApi

Honor the new AuthorizationHeaderProviderOptions hooks from
Microsoft.Identity.Abstractions 12.5.0:

- OnBeforeAuthHeaderCreation runs before the authorization header is created and
  signed, so callers can shape the request that request-binding protocols
  (SignedHttpRequest q/h/b) sign, ensuring the signature covers the finalized
  request.
- OnAfterAuthHeaderCreation runs after the header is attached. The pre-existing
  CustomizeHttpRequestMessage is still invoked at the same point for backwards
  compatibility.

Both hooks are propagated through MicrosoftIdentityMessageHandler.

Also declare IAuthorizationHeaderProvider2 only on the Base/Default header
providers (it already extends IAuthorizationHeaderProvider), and type the
Base provider's delegate field as IAuthorizationHeaderProvider2 to avoid
upcasting at the metadata delegation sites.

Stacked on the regression fix (#3943).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@neha-bhargava Neha Bhargava (neha-bhargava) mentioned this pull request Jul 14, 2026
Closed
Neha Bhargava (neha-bhargava) added a commit that referenced this pull request Jul 14, 2026
@neha-bhargava
Add OnBeforeAuthHeaderCreation / OnAfterAuthHeaderCreation hooks to D…
96929f4 
…ownstreamApi

Honor the new AuthorizationHeaderProviderOptions hooks from
Microsoft.Identity.Abstractions 12.5.0:

- OnBeforeAuthHeaderCreation runs before the authorization header is created and
  signed, so callers can shape the request that request-binding protocols
  (SignedHttpRequest q/h/b) sign, ensuring the signature covers the finalized
  request.
- OnAfterAuthHeaderCreation runs after the header is attached. The pre-existing
  CustomizeHttpRequestMessage is still invoked at the same point for backwards
  compatibility.

Both hooks are propagated through MicrosoftIdentityMessageHandler.

Also declare IAuthorizationHeaderProvider2 only on the Base/Default header
providers (it already extends IAuthorizationHeaderProvider), and type the
Base provider's delegate field as IAuthorizationHeaderProvider2 to avoid
upcasting at the metadata delegation sites.

Stacked on the regression fix (#3943).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Neha Bhargava (neha-bhargava) added a commit that referenced this pull request Jul 14, 2026
@neha-bhargava
Add OnBeforeAuthHeaderCreation / OnAfterAuthHeaderCreation hooks to D…
0517cbb 
…ownstreamApi

Honor the new AuthorizationHeaderProviderOptions hooks from
Microsoft.Identity.Abstractions 12.5.0:

- OnBeforeAuthHeaderCreation runs before the authorization header is created and
  signed, so callers can shape the request that request-binding protocols
  (SignedHttpRequest q/h/b) sign, ensuring the signature covers the finalized
  request.
- OnAfterAuthHeaderCreation runs after the header is attached. The pre-existing
  CustomizeHttpRequestMessage is still invoked at the same point for backwards
  compatibility.

Both hooks are propagated through MicrosoftIdentityMessageHandler.

Also declare IAuthorizationHeaderProvider2 only on the Base/Default header
providers (it already extends IAuthorizationHeaderProvider), and type the
Base provider's delegate field as IAuthorizationHeaderProvider2 to avoid
upcasting at the metadata delegation sites.

Stacked on the regression fix (#3943).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Gladwin Johnson (gladjohn) pushed a commit that referenced this pull request Jul 14, 2026
@neha-bhargava
Add OnBeforeAuthHeaderCreation / OnAfterAuthHeaderCreation hooks to D…
169ba33 
…ownstreamApi (#3942)

Honor the new AuthorizationHeaderProviderOptions hooks from
Microsoft.Identity.Abstractions 12.5.0:

- OnBeforeAuthHeaderCreation runs before the authorization header is created and
  signed, so callers can shape the request that request-binding protocols
  (SignedHttpRequest q/h/b) sign, ensuring the signature covers the finalized
  request.
- OnAfterAuthHeaderCreation runs after the header is attached. The pre-existing
  CustomizeHttpRequestMessage is still invoked at the same point for backwards
  compatibility.

Both hooks are propagated through MicrosoftIdentityMessageHandler.

Also declare IAuthorizationHeaderProvider2 only on the Base/Default header
providers (it already extends IAuthorizationHeaderProvider), and type the
Base provider's delegate field as IAuthorizationHeaderProvider2 to avoid
upcasting at the metadata delegation sites.

Stacked on the regression fix (#3943).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This was referenced Jul 17, 2026
Merged
Merged
Closed
Closed
Closed
Closed
Open
Closed
Closed
Merged
Merged
Closed
This was referenced Aug 2, 2026
Merged
Merged
Open
Open
Merged
Open
Open
Merged
Merged
Merged
Open
Open
Merged
Merged
Closed
Closed
Closed
Merged
Closed
James Gunn (gunndabad) added a commit to DFE-Digital/teaching-record-system that referenced this pull request Aug 6, 2026
@dependabot @gunndabad
Bump Microsoft.Identity.Web and Microsoft.IdentityModel.Protocols.Ope…
89e846c 
…nIdConnect (#3696)

Updated
[Microsoft.Identity.Web](https://github.com/AzureAD/microsoft-identity-web)
from 4.12.2 to 4.14.2.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.Identity.Web's
releases](https://github.com/AzureAD/microsoft-identity-web/releases)._

## 4.14.2

### Dependencies updates
- Bump the `Microsoft.IdentityModel.*` (Wilson) version to 8.22.0. See
[#​3986](AzureAD/microsoft-identity-web#3986).
- Fix the net8.0 crypto floor to use the patched
`System.Security.Cryptography.Xml` 8.0.4 (and its
`System.Security.Cryptography.Pkcs` 8.0.1 dependency) instead of
over-bumping to the 9.0.18 servicing line (CVE-2026-47302, -47304,
-50525, -50648). net9.0 (9.0.18) and net10.0 (10.0.10) are unchanged.
See
[#​3989](AzureAD/microsoft-identity-web#3989).

## 4.14.0

## New features
- Add `MicrosoftIdentityOptions.PartitionAppTokenCacheByAudience` to
partition the app token cache by resource/audience. See #​3979.
- Expose MSAL's background token-refresh callback through Id.Web via
`TokenAcquisitionExtensionOptions.OnBackgroundTokenRefreshCompleted`.
See #​3973.
- Add `MicrosoftIdentityOptions.UseFastUnboundedCache`; stop
short-circuiting the in-memory token cache serialization provider. See
#​3970.
- OIDC FIC (`Microsoft.Identity.Web.OidcFIC`) now supports mTLS token
binding. See #​3851.

## Bug fixes
- Token binding: the CCA cache key now distinguishes a bound credential
(`UseBoundCredential = true`) from its unbound equivalent; the
certificate-error retry path invalidates the cache entry for the actual
request mode (bearer vs mTLS PoP).
- Forward the OpenTelemetry tags enricher onto the inner FIC
client-assertion leg. See #​3968.

## Dependencies updates
- `Microsoft.Identity.Client` → 4.87.0 (#​3975)
- `Microsoft.Identity.Abstractions` → 12.6.0 (#​3976)
- `System.Security.Cryptography.Xml` /
`System.Security.Cryptography.Pkcs` → patched (CVE-2026-47302, -47304,
-50525, -50648) (#​3964)
- notsecurity group: 1 update (#​3965)

**Full changelog**:
AzureAD/microsoft-identity-web@4.13.2...4.14.0


## 4.13.2

## What's Changed
* Apply reserved-header handling on the request-clone path and cover all
X-MS-TOKEN- headers by @​iNinja in
AzureAD/microsoft-identity-web#3915
* Restore independent PR pipeline + pool-aware MI identity + net462/472
unit tests by @​iarekk in
AzureAD/microsoft-identity-web#3935
* Post-release 4.13.0: changelog and public API shipped move by
@​neha-bhargava in
AzureAD/microsoft-identity-web#3937
* Remove redundant 'Run unit tests' GitHub Action by @​iarekk in
AzureAD/microsoft-identity-web#3939
* Apply consistent redirect-URI validation on AccountController.SignIn
by @​iNinja in
AzureAD/microsoft-identity-web#3940
* Fix duplicate logging of MsalUiRequiredException (in-repo copy of
#​3910) by @​iarekk in
AzureAD/microsoft-identity-web#3941
* Use MSAL's recent UserFIC API for agentic flows by @​Avery-Dunn in
AzureAD/microsoft-identity-web#3842
* Restore CustomizeHttpRequestMessage to run after the authorization
header by @​neha-bhargava in
AzureAD/microsoft-identity-web#3943
* Bump Microsoft.IdentityModel.Tokens.Saml from 5.7.0 to 8.19.1 by
@​dependabot[bot] in
AzureAD/microsoft-identity-web#3909
* Revert #​3909: keep OWIN Saml/WsFederation on 5.7.0 by @​iarekk in
AzureAD/microsoft-identity-web#3944
* Bump Microsoft.Identity.Abstractions from 12.4.0 to 12.5.0 by
@​neha-bhargava in
AzureAD/microsoft-identity-web#3947
* Add OnBeforeAuthHeaderCreation / OnAfterAuthHeaderCreation hooks to
DownstreamApi by @​neha-bhargava in
AzureAD/microsoft-identity-web#3942
* Update IdentityModelV5Version and SamlPackageVersion to 5.7.1 in proj…
by @​trwalke in
AzureAD/microsoft-identity-web#3950
* Rename retired MSALMSIV2 agent pool to MISEManagedIdentity by
@​gladjohn with @​Copilot in
AzureAD/microsoft-identity-web#3949
* Improve IDW10109 error handling for credential loading failures by
@​Avery-Dunn in
AzureAD/microsoft-identity-web#3946
* Bump MSAL dependencies to 4.86.1 in central props by @​gladjohn with
@​Copilot in AzureAD/microsoft-identity-web#3953
* Bump the notsecurity group with 3 updates by @​dependabot[bot] in
AzureAD/microsoft-identity-web#3954


**Full Changelog**:
AzureAD/microsoft-identity-web@4.13.0...4.13.2

## 4.13.0

## What's Changed
* Categorize managed-identity E2E tests and exclude them from the PR
build by @​iarekk in
AzureAD/microsoft-identity-web#3923
* Add more tests for TokenAcquisitionMetadata.ExpiresOn from
AuthenticationResult by @​neha-bhargava in
AzureAD/microsoft-identity-web#3904
* Test: consolidate MI E2E test onto shared Msal_Integration_tests UAMI
by @​RyAuld in
AzureAD/microsoft-identity-web#3926
* docs: Credential architecture internals documentation by @​gladjohn in
AzureAD/microsoft-identity-web#3886
* Potential fix for code scanning alert no. 35: Missing cross-site
request forgery token validation by @​gladjohn in
AzureAD/microsoft-identity-web#3929
* Register IAuthorizationHeaderProvider2 in DI by @​neha-bhargava in
AzureAD/microsoft-identity-web#3927
* Bump Microsoft.Identity.Client to 4.86.0 by @​neha-bhargava in
AzureAD/microsoft-identity-web#3931
* Split PR pipeline into independent net8 stages; add MI E2E stage on
MSALMSIV2 by @​iarekk in
AzureAD/microsoft-identity-web#3933
* Run missing unit test projects in the ADO PR build by @​iarekk in
AzureAD/microsoft-identity-web#3934
* Revert PRs #​3933 and #​3934: restore single-job PR pipeline by
@​gladjohn with @​Copilot in
AzureAD/microsoft-identity-web#3936


**Full Changelog**:
AzureAD/microsoft-identity-web@4.12.2...4.13.0

Commits viewable in [compare
view](AzureAD/microsoft-identity-web@4.12.2...4.14.2).
</details>

Updated
[Microsoft.IdentityModel.Protocols.OpenIdConnect](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet)
from 8.19.2 to 8.22.0.

<details>
<summary>Release notes</summary>

_Sourced from [Microsoft.IdentityModel.Protocols.OpenIdConnect's
releases](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/releases)._

## 8.22.0

## What's Changed

* Promote exception to property, add test by @​westin-m in
AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3486
* Add IgnoreCaseWhenValidatingAudience flag to audience validation by
@​cpp11nullptr in
AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3563

**Full Changelog**:
AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.21.0...8.22.0

## 8.21.0

## Performance Improvements
- Add JsonWebToken header-replacement path to avoid re-parsing payload.
See [PR
#​3553](AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3553).
- Add claims dictionary preallocation. See [PR
#​3550](AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3550).

## Bug Fixes
- Fix CI build failures: remove unused log message and add missing DPoP
API entries. See [PR
#​3551](AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet#3551).

Commits viewable in [compare
view](AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet@8.19.2...8.22.0).
</details>

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: James Gunn <james@gunn.io>
This was referenced Aug 7, 2026
Closed
Open
Open
Open
Merged
Closed
Open
This was referenced Aug 14, 2026
Open
Open
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bgavrilMS Bogdan Gavril (bgavrilMS) bgavrilMS approved these changes
@pmaytak Peter (pmaytak) pmaytak approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@neha-bhargava @bgavrilMS @pmaytak