Http web request SSL validation

You may need to communicate with external web service in Nav, such as API for Ecommerce, Logistic tracking or whatever.
To do that, you can inspire from codeunit 1297 for Rest API and codeunit 1290 for Soap API.

I find out that Http Web request component from Microsoft .Net do not allow any communications with web service using SSL self-signed certificat, for security concern, un like eg PostMan (if you’re having an error in Nav containing something like “certificate is invalid” when trying to send http request, that’s it).

Certificat can be considered as self-signed in some case such as DNS issue on localhost, low cost emetor, but can also be falsified certificate. But in case you do trust or own the certificate, you should of course able to bypass this verification.

Microsoft explain how to intercept the certificate validation in HttpWebRequest component in following video  :

https://www.youtube.com/watch?v=NW_ZiW6J790

I’ve created the .Net DLL to force all SSL validation on System.Net.HttpWebRequest, as they show :

HttpCertificateValidator.dll.zip
HttpCertificateValidator Source.zip

Please use with needed requests and if you trust the endpoint.

SSL certificat validation are important and should not be ignored when you connect with external source. It is easy to falsify a certificate, the attacker can then redirect all the data feed to himself poofing original destination.

How to use it :

1.Copy HttpCerticiateValidator.dll in the Nav service Add-in folder (will be used server side).

2.Restart Nav service

2.In C/AL declare a DotNet variable Assembly in “Dynamic NAV” then “HttpCertificateValidator” and pick the class “HttpCerticiateValidator.RequestValidator”

Before sending the request (HttpWebRequest.Getresponse) call the Request validator constructor with HttpWebRequest in parameter.
This will simply overide the .Net ssl verification function to accept all certificate.

3. Bellow example send a Rest request with json content and read the response content, handling utf8 encoding and multi chunk response :

// Http request header
DotNetGHttpWebRequest := DotNetGHttpWebRequest.Create('http://...');
DotNetGHttpWebRequest.Method := 'GET';
DotNetGHttpWebRequest.KeepAlive := FALSE;
DotNetGHttpWebRequest.Accept := '*/*';
DotNetGHttpWebRequest.Timeout := 60000;
DotNetGHttpWebRequest.ContentType := 'application/json;charset=utf-8';

// Http request body exemple for Rest API :
// Convert text to bigtext to handle encoding
BigTextL.ADDTEXT('{ "name": "json example" }');

// Generate encoded stream containing request body content
RecLBlob.INIT;
RecLBlob.Blob.CREATEOUTSTREAM(OutStreamL, TEXTENCODING::UTF8);
BigTextL.WRITE(OutStreamL);
RecLBlob.Blob.CREATEINSTREAM(InStreamL);
DotNetLRequestStream := DotNetGHttpWebRequest.GetRequestStream;
COPYSTREAM(DotNetLRequestStream, InStreamL);
DotNetLRequestStream.Flush;
DotNetLRequestStream.Close;
DotNetLRequestStream.Dispose;

// Force SSL Certificat validation
HttpCertificateValidator := HttpCertificateValidator.RequestValidator(DotNetGHttpWebRequest);

// Try to send request and get response :
DotNetGHttpWebResponse := DotNetGHttpWebRequest.GetResponse;

// Read response :
TempBlob.INIT;
TempBlob.Blob.CREATEINSTREAM(InStreamL);
DotNetGHttpWebResponse.GetResponseStream.CopyTo(InStreamL);

// Read response until last chunk
IntLRead := 1;
WHILE IntLRead > 0 DO BEGIN
  IntLRead := InStreamL.READTEXT(TxtLChunkRead); 
  IF IntLRead > 0 THEN
    TxtGResponse := TxtLChunkRead;
END;

// Close Http web request 
DotNetGHttpWebResponse.Close;

// Handle response
IF TxtGResponse [...]

Variables needed :
DotNetGHttpWebRequest – DotNet – System.Net.HttpWebRequest
DotNetLEncoding – DotNet – System.Text.Encoding
DotNetLRequestStream – DotNet – System.IO.Stream
BigTextL  – BigText
RecLBlob – Record – TempBlob
TempBlob – Record – TempBlob
TxtLChunkRead – Text
TxtGResponse – Text
IntLRead – Integer