WPF sent default Windows credentials to any host; a Copilot-co-authored mitigation limited them to trusted zones but cached its private-address DNS answer, so DNS rebinding could still capture NTLM or Kerberos credentials.

+//   Do NOT remove the gate logic without security review.++//+// Description:+//+// Helper that decides whether default (NTLM/Kerberos/Negotiate) credentials+// should be attached to an outgoing WebRequest, based on the URL Security Zone+// of the target URI.+//+// Historical note:+//   On .NET Framework, WPF used to register an ICredentialPolicy with+//   System.Net.AuthenticationManager.CredentialPolicy. The framework's auth+//   client modules (NTLM/Kerberos/Negotiate/Basic/Digest) would consult that+//   policy when responding to a 401 challenge and, for Internet/Untrusted+//   zones, suppress the credentials. That mechanism is implemented by+//   <see cref="CustomCredentialPolicy"/>, which is preserved in source for+//   backward-compatibility purposes (selected via the AppContext switch+//   "Switch.System.Windows.Net.DoNotApplyZoneCheckForDefaultCredentials").+//+//   On .NET 5+, AuthenticationManager.CredentialPolicy is obsolete (SYSLIB0009)+//   and is a runtime no-op: the new HttpClient-based pipeline never consults+//   it. Registering a policy therefore does nothing, which silently regressed+//   the original safety behavior.+//+//   To restore .NET Framework parity, callers can perform the zone check+//   inline before enabling UseDefaultCredentials by calling+//   ShouldSendDefaultCredentials below. This is the default behavior; the+//   AppContext switch above can be set to true to opt out and restore the+//   previous (no-op) registration path as a compatibility escape hatch.+//+// Policy:+//   Allow default credentials to flow only to Local Machine / Intranet /

+//!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

+using System;+using System.Collections.Concurrent;+using System.Net;+using System.Net.Sockets;+using System.Runtime.InteropServices;++using MS.Internal.PresentationCore;+using MS.Win32;

++        /// <summary>+        /// Returns true if it is safe to attach default (NTLM/Kerberos/Negotiate)+        /// credentials to a request targeted at <paramref name="uri"/>.+        ///+        /// Restores the .NET Framework behavior that used to be provided by the+        /// now-obsolete <c>AuthenticationManager.CredentialPolicy</c> mechanism

-        // Per-host result cache. The decision for a given hostname is stable for the-        // lifetime of the process barring DNS changes; caching avoids a synchronous-        // DNS lookup on every outgoing request.-        private static readonly ConcurrentDictionary<string, bool> s_localHostCache =+        // Per-host result cache with expiration. Positive ("send credentials")+        // decisions are NEVER cached because a stale "true" is the dangerous+        // direction — it would leak credentials after a DNS rebinding attack.+        // Negative ("do not send") decisions are cached with a short TTL since+        // a stale "false" is safe (fail-closed).+        private static readonly ConcurrentDictionary<string, CachedZoneDecision> s_localHostCache =             new(StringComparer.OrdinalIgnoreCase); +        // Cache TTL for negative (deny) decisions only. Positive decisions are+        // always re-resolved to prevent DNS rebinding credential leaks.+        private static readonly TimeSpan s_cacheTtl = TimeSpan.FromSeconds(120);++        private readonly struct CachedZoneDecision+        {+            public readonly bool IsLocalOrPrivate;+            public readonly long ExpiresAtTicks;+

+        }+         /// <summary>         /// Returns true when every IP address that <paramref name="host"/> resolves         /// to is non-routable: IPv4 loopback (127.0.0.0/8), IPv4 link-local@@ -159,7 +179,8 @@ internal static bool ShouldSendDefaultCredentials(Uri uri)         /// loopback/Intranet decisions are reliable even on modern Windows installs         /// where the zone manager is degraded (no IE/Edge zone configuration).         /// DNS failures resolve to "not local/private" and fail closed in the caller.-        /// Results are cached per host for the lifetime of the process.+        /// Positive (allow) decisions are always re-resolved to prevent DNS rebinding.+        /// Negative (deny) decisions are cached with a TTL.         /// </remarks>         private static bool AllResolvedAddressesAreLocalOrPrivate(string host)         {@@ -168,41 +189,54 @@ private static bool AllResolvedAddressesAreLocalOrPrivate(string host)                 return false;             } -            return s_localHostCache.GetOrAdd(host, static h =>+            // Only serve cached NEGATIVE results (fail-closed is safe to cache).+            // Positive results must always be re-resolved to detect DNS rebinding.+            if (s_localHostCache.TryGetValue(host, out CachedZoneDecision cached)+                && !cached.IsExpired+                && !cached.IsLocalOrPrivate)             {-                IPAddress[] addresses;-                if (IPAddress.TryParse(h, out IPAddress literal))-                {-                    addresses = new[] { literal };-                }-                else

+            {+                addresses = new[] { literal };+            }+            else+            {+                try                 {-                    try-                    {-                        addresses = Dns.GetHostAddresses(h);-                    }-                    catch-                    {-                        // DNS failure: do not relax the policy. Fall through to