gRPC for .NET 2.84

Apply these rules to the managed Grpc.Net.Client and Grpc.AspNetCore.Server stack on .NET 10, after the ASP.NET Core 10.0 prompt and its C# 14 baseline. Apply the browser rules when enabling gRPC-Web or ASP.NET Core JSON transcoding.

Channels and credentials

• Create production GrpcChannel instances with trusted HTTPS addresses and serve gRPC on TLS endpoints. Authenticate and encrypt the proxy-to-service hop too; TLS termination at the edge does not protect that hop.
• Keep UnsafeUseInsecureChannelCallCredentials false. Its guard applies to CallCredentials, not arbitrary headers: never send credentials over plaintext through Metadata, HttpClient.DefaultRequestHeaders, interceptors, or delegating handlers.
• Resolve per-user credentials inside AddCallCredentials or CallCredentials.FromInterceptor, honor AuthInterceptorContext.CancellationToken, and select tokens for the intended downstream audience. Never capture one request's token in a shared channel, singleton interceptor, or pooled handler, or blindly forward incoming authorization metadata.
• For SSRF prevention, choose channel addresses, resolver schemes, authorities, and ports from administrator-controlled configuration. Validate every destination produced by a custom resolver against the permitted service network and enforce that policy at egress; a trusted resolver name alone does not authorize its addresses. For dns:/// and static:/// channels, set Credentials = ChannelCredentials.SecureSsl explicitly. Set DisableResolverServiceConfig = true unless the resolver is trusted to