What is the right way to reference System.Net.Http when targeting .NET 4.7.2?

Question

I have a solution which contains a few web applications and so AspNetCompiler task is running during the build. Also given:

• VS 2017
• msbuild is invoked on the command line with the /err switch, i.e. warnings are promoted to errors

When building our code from scratch I get the following errors (could be promoted warnings, I do not care):

ASPNETCOMPILER : error : The following assembly has dependencies on a version of the .NET Framework that is higher than the target and might not load correctly during runtime causing a failure: Xyz.Web.SystemAdmin, Version=1.0.0.0, Culture=neutral, PublicKeyToken=b3dac0a0872f0a93. The dependencies are: System.Net.Http, Version=4.2.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a. You should either ensure that the dependent assembly is correct for the target framework, or ensure that the target framework you are addressing is that of the dependent assembly. [C:\Xyz\tip\UI\CandidatePortal\CandidatePortal.csproj]
ASPNETCOMPILER : error : The following assembly has dependencies on a version of the .NET Framework that is higher than the target and might not load correctly during runtime causing a failure: Xyz.Web.SystemAdmin, Version=1.0.0.0, Culture=neutral, PublicKeyToken=b3dac0a0872f0a93. The dependencies are: System.Net.Http, Version=4.2.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a. You should either ensure that the dependent assembly is correct for the target framework, or ensure that the target framework you are addressing is that of the dependent assembly. [C:\Xyz\tip\UI\CandidatePortal\CandidatePortal.csproj]
ASPNETCOMPILER : error : The following assembly has dependencies on a version of the .NET Framework that is higher than the target and might not load correctly during runtime causing a failure: RecruitingCommon, Version=1.0.0.0, Culture=neutral, PublicKeyToken=b3dac0a0872f0a93. The dependencies are: System.Net.Http, Version=4.2.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a. You should either ensure that the dependent assembly is correct for the target framework, or ensure that the target framework you are addressing is that of the dependent assembly. [C:\Xyz\tip\UI\CandidatePortal\CandidatePortal.csproj]
ASPNETCOMPILER : error : The following assembly has dependencies on a version of the .NET Framework that is higher than the target and might not load correctly during runtime causing a failure: RecruitingCommon, Version=1.0.0.0, Culture=neutral, PublicKeyToken=b3dac0a0872f0a93. The dependencies are: System.Net.Http, Version=4.2.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a. You should either ensure that the dependent assembly is correct for the target framework, or ensure that the target framework you are addressing is that of the dependent assembly. [C:\Xyz\tip\UI\CandidatePortal\CandidatePortal.csproj]
ASPNETCOMPILER : error : The following assembly has dependencies on a version of the .NET Framework that is higher than the target and might not load correctly during runtime causing a failure: Xyz.Web.Reporting, Version=1.0.0.0, Culture=neutral, PublicKeyToken=b3dac0a0872f0a93. The dependencies are: System.Net.Http, Version=4.2.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a. You should either ensure that the dependent assembly is correct for the target framework, or ensure that the target framework you are addressing is that of the dependent assembly. [C:\Xyz\tip\UI\CandidatePortal\CandidatePortal.csproj]
ASPNETCOMPILER : error : The following assembly has dependencies on a version of the .NET Framework that is higher than the target and might not load correctly during runtime causing a failure: Xyz.Web.Reporting, Version=1.0.0.0, Culture=neutral, PublicKeyToken=b3dac0a0872f0a93. The dependencies are: System.Net.Http, Version=4.2.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a. You should either ensure that the dependent assembly is correct for the target framework, or ensure that the target framework you are addressing is that of the dependent assembly. [C:\Xyz\tip\UI\CandidatePortal\CandidatePortal.csproj]
ASPNETCOMPILER : error : The following assembly has dependencies on a version of the .NET Framework that is higher than the target and might not load correctly during runtime causing a failure: Xyz.Web.ClientAdmin, Version=1.0.0.0, Culture=neutral, PublicKeyToken=b3dac0a0872f0a93. The dependencies are: System.Net.Http, Version=4.2.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a. You should either ensure that the dependent assembly is correct for the target framework, or ensure that the target framework you are addressing is that of the dependent assembly. [C:\Xyz\tip\UI\CandidatePortal\CandidatePortal.csproj]
ASPNETCOMPILER : error : The following assembly has dependencies on a version of the .NET Framework that is higher than the target and might not load correctly during runtime causing a failure: Xyz.Web.ClientAdmin, Version=1.0.0.0, Culture=neutral, PublicKeyToken=b3dac0a0872f0a93. The dependencies are: System.Net.Http, Version=4.2.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a. You should either ensure that the dependent assembly is correct for the target framework, or ensure that the target framework you are addressing is that of the dependent assembly. [C:\Xyz\tip\UI\CandidatePortal\CandidatePortal.csproj]
ASPNETCOMPILER : error : The following assembly has dependencies on a version of the .NET Framework that is higher than the target and might not load correctly during runtime causing a failure: DataCapturing, Version=1.0.0.0, Culture=neutral, PublicKeyToken=b3dac0a0872f0a93. The dependencies are: System.IO.Compression, Version=4.2.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089. You should either ensure that the dependent assembly is correct for the target framework, or ensure that the target framework you are addressing is that of the dependent assembly. [C:\Xyz\tip\UI\CandidatePortal\CandidatePortal.csproj]
ASPNETCOMPILER : error : The following assembly has dependencies on a version of the .NET Framework that is higher than the target and might not load correctly during runtime causing a failure: DataCapturing, Version=1.0.0.0, Culture=neutral, PublicKeyToken=b3dac0a0872f0a93. The dependencies are: System.IO.Compression, Version=4.2.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089. You should either ensure that the dependent assembly is correct for the target framework, or ensure that the target framework you are addressing is that of the dependent assembly. [C:\Xyz\tip\UI\CandidatePortal\CandidatePortal.csproj]
ASPNETCOMPILER : error : The following assembly has dependencies on a version of the .NET Framework that is higher than the target and might not load correctly during runtime causing a failure: Xyz.BusinessAPI, Version=1.0.0.0, Culture=neutral, PublicKeyToken=b3dac0a0872f0a93. The dependencies are: System.Net.Http, Version=4.2.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a; System.IO.Compression, Version=4.2.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089. You should either ensure that the dependent assembly is correct for the target framework, or ensure that the target framework you are addressing is that of the dependent assembly. [C:\Xyz\tip\UI\SSOLauncher\SSOLauncher.csproj]
ASPNETCOMPILER : error : The following assembly has dependencies on a version of the .NET Framework that is higher than the target and might not load correctly during runtime causing a failure: Xyz.BusinessAPI, Version=1.0.0.0, Culture=neutral, PublicKeyToken=b3dac0a0872f0a93. The dependencies are: System.Net.Http, Version=4.2.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a; System.IO.Compression, Version=4.2.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089. You should either ensure that the dependent assembly is correct for the target framework, or ensure that the target framework you are addressing is that of the dependent assembly. [C:\Xyz\tip\UI\SSOLauncher\SSOLauncher.csproj]

All our projects reference System.Net.Http like this:

<Reference Include="System.Net.Http" />

No project does binding redirects for this assembly in its app.config or web.config file.

All the projects target the .NET framework 4.7.2, but some 3rd party dependencies are .NET Standard.

Anyway, I have searched the Internet and:

1. Some claim that referencing System.Net.Http should only be done from NuGet, some say the opposite.
2. Some claim that binding redirects are necessary, others - the opposite.
3. Some say the problem was resolved with .NET Framework 4.7.2 (obviously not)

I also know:

• The GAC contains System.Net.Http.dll with the Assembly Version of 4.0.0.0 and the File Version of 4.7.3190.0 built by: NET472REL1LAST_C. From which I conclude it correspond to .NET 4.7.2
• On the other hand, during the compilation, msbuild resolves the reference to c:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\.NETFramework\v4.7.2\System.Net.Http.dll, which has the Assembly Version of 4.2.0.0 and the File Version of 4.7.3062.0 built by: NET472REL1.

Now I am confused. The file version of System.Net.Http.dll from the Reference Assemblies suggests it is older than that from the GAC, but its Assembly Version is 4.2.0.0 ? How will this dependency be resolved at run-time on a machine that has the version 4.0.0.0 in the GAC and nothing else? Checking the Reference Assemblies for older .NET versions (like 3.7.1 and below) shows System.Net.Http.dll with the Assembly Version of 4.0.0.0, so this mess is introduced with the .NET framework 4.7.2

So, how do I make the damn thing compile cleanly? Also, I do not understand how come only AspNetCompiler complains. How does one troubleshoot it at all? The binary log does not seem to help with AspNetCompiler errors one bit.

Answer 1

I have only found 1 way to make this work so far. We had to go to .net framework 4.7.2 to take care of the Chromium SameSite cookie requirements. There seem to be several sites documenting this, but we could not go to Microsoft.Owin 4.x due to a long list of NuGet dependency issues. Some of the info below is for the SameSite fix, but I struggled a lot with the System.Net.Http assembly in .net framework 4.7.2 so that is below too.

I found if you take your MVC and Web.Api projects to .net framework 4.7.2, then make sure all your projects that use System.Net.Http reference the GAC 4.2.0.0 version. I have class library projects that also run Web.api controllers. Those I also installed the NuGet System.Net.Http along side the GAC version. You may have to edit your project file to reference both. The NuGet assembly reference in the project file should include an ExcludeAssets element. Example Exclude Assets I ended up converting my non-main project web.api class library projects to use the PackageReference instead of packages.config. I think this is required to use the excludeAssets.

I also used the nuget package manager console to re-install all nuget packages to target framework 4.7.2. Re-install NuGet packages to re-target framework 4.7.2

Your main project web.config should NOT have a runtime dependentAssembly section defined for System.Net.Http. It needs to be excluded so it is selected automatically. The other class library projects I did include the dependentAssembly reference to System.Net.Http version 4.2.0.0. I also added the assembly definition and runtime dependentAssembly to my Views web.config and all my Views web.config files within my Areas. I'm not sure how necessary this is.

<system.web>
    <compilation>
        <assemblies>
            <add assembly="System.Web.Mvc, Version=5.2.7.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
            <add assembly="System.Net.Http, Version=4.2.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
        </assemblies>
    </compilation>
</system.web>
<runtime>
    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
        <dependentAssembly>
            <assemblyIdentity name="System.Net.Http" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />
            <bindingRedirect oldVersion="0.0.0.0-4.2.0.0" newVersion="4.2.0.0" />
        </dependentAssembly>
        <dependentAssembly>
            <assemblyIdentity name="System.Web.Mvc" publicKeyToken="31bf3856ad364e35" culture="neutral" />
            <bindingRedirect oldVersion="0.0.0.0-5.2.7.0" newVersion="5.2.7.0" />
        </dependentAssembly>
    </assemblyBinding>
</runtime>

I used this site to help write a cookie rewriter. I found that this only takes care of system.web cookies and not OWIN cookies. Cookie rewriter for same site

I didn't have access to the 4.x OWIN fix to add the SameSite property to the OWIN cookies, but I did find a way that the system will do it for you automatically by adding the SystemWebCookieManager to the OWIN options. SameSiteCookieManager