HTTP & APIs
Plugin.Maui.TlsPin
HttpClient SPKI / public-key pin — fail-closed
Current NuGet 1.0.1
Pins HttpClient TLS to SPKI / public-key hashes for .NET MAUI on Android, iOS, Mac Catalyst, and Windows. Empty or mismatched pins reject the request unless report-only staging is on.
Install
dotnet add package Plugin.Maui.TlsPinPackage ID: Plugin.Maui.TlsPin
Plugin.Maui.* restores from GitHub Packages. Add the org feed first — see Use nuvyntralabs GitHub Packages from a C# project.
Overview
Plugin.Maui.TlsPin is the certificate-pin layer for MAUI HttpClient. UseTlsPin() is a no-op registrar; IHttpClientBuilder.AddTlsPin(...) attaches pins per named client. Empty pin sets throw on registration. A mismatch fails the request unless ReportOnly is true — report-only still raises OnPinFailure. Ship at least one backup pin. RequireHttps defaults true. Retry, typed REST, and token refresh stay on ApiResilience, HttpForge, and SecureSession.
Current release
- 1.0.1. Current nuget.org pack.
- 1.0.0. First stable release. AddTlsPin, fail-closed empty pins, optional ReportOnly staging.
Full upgrade map for the 3 September 2026 hardening wave: Hardened plugin releases.
Capabilities
- IHttpClientBuilder.AddTlsPin with host → SPKI SHA-256 sets.
- Fail-closed empty or mismatched pins.
- Report-only staging that still calls OnPinFailure.
- HTTPS required by default. Android, iOS, Mac Catalyst, and Windows.
- .NET MAUI
- TLS
- SPKI
- HTTPS
- C#
- Mac Catalyst
- Windows
Discussion
Comment on Plugin.Maui.TlsPin. The thread lives on this component's GitHub repository (nuvyntralabs/Plugin.Maui.TlsPin). Sign in with GitHub — Giscus uses Discussions, Utterances uses Issues.