[Eduard van Valkenburg (eavanvalkenburg)]

Motivation and Context

HttpPlugin validates the DNS addresses for allow-listed hosts before sending a request, but previously discarded those validated addresses before opening the connection. The HTTP transport could therefore resolve the hostname independently at connection time.

This change keeps validation and connection behavior consistent without redesigning the plugin or changing its explicit unrestricted/private-network opt-ins. No public issue is linked.

Description

• Retain the IPv4/IPv6 addresses returned by the existing public-network validator.
• Supply aiohttp with a host-scoped resolver that returns only those validated addresses.
• Keep the original normalized URL for the request so Host headers, TLS SNI, and certificate validation retain the hostname identity.
• Apply the same pinned connector path to GET, POST, PUT, and DELETE.
• Preserve existing behavior for literal IP URLs and the explicit allow_all_domains / allow_private_network_access opt-ins.
• Add regression coverage for every HTTP method and a real connection test proving a later hostname lookup is not used.

Validation:

• uv build — passed; source distribution and wheel built successfully.
• uv run --python 3.12 --frozen ruff check semantic_kernel\core_plugins\http_plugin.py tests\unit\core_plugins\test_http_plugin.py — passed.
• uv run --python 3.12 --frozen pytest -q tests\unit\core_plugins\test_http_plugin.py — passed (226 tests).
• uv run --python 3.12 --frozen pytest -q tests\unit\connectors\openapi_plugin\test_server_url_validator.py tests\unit\connectors\openapi_plugin\test_openapi_runner_dns_pinning.py — passed (91 tests).
• uv run --python 3.12 --frozen mypy semantic_kernel\core_plugins\http_plugin.py — passed.
• The repository pre-commit wrapper was attempted, but local hook-environment initialization did not complete; the changed Python files passed the direct Ruff formatting/lint checks above.

Contribution Checklist

• The code builds clean without any errors or warnings
• The PR follows the SK Contribution Guidelines and the pre-submission formatting script raises no violations
• All unit tests pass, and I have added new tests where possible
• I didn't break anyone 😄

[Copilot]

🟢 Approval recommended

The implementation consistently pins all four HTTP methods to validated addresses, with focused regression coverage and no identified blocking issues.

No open issues 🎉

What changed in this PR

This PR closes the gap between DNS validation and connection establishment in Python’s HttpPlugin by connecting only to validated addresses.

Changes:

• Adds a host-scoped resolver and uses it for GET, POST, PUT, and DELETE.
• Preserves the normalized hostname for HTTP headers and TLS, along with existing network-access opt-ins.
• Adds per-method regression coverage and a real-connection test verifying that no second DNS lookup occurs.

File	Description
python/​tests/​unit/​core_plugins/​test_http_plugin.py	Adds resolver-pinning and real-connection regression tests.
python/​semantic_kernel/​core_plugins/​http_plugin.py	Retains validated addresses and supplies a pinned resolver to each HTTP method.

_{Review effort: Balanced}

[github-actions]

Python Test Coverage Report •

File	Stmts	Miss	Cover	Missing
core_plugins
http_plugin.py	112	2	98%	45, 66
TOTAL	29187	5466	81%

Python Unit Test Overview

Tests	Skipped	Failures	Errors	Time
4522	22 💤	0 ❌	0 🔥	2m 19s ⏱️