Inheritance security rules violated by type: 'System.Net.Http.WebRequestHandler'. Derived types must either match the security accessibility of the base type or be less accessible.

# Inheritance security rules violated by type: 'System.Net.Http.WebRequestHandler'

## Summary

Using System.Net.Http 4.1.0-4.3.0 results in an exception when starting a web app that's .NET 4.6.1:
* Inheritance security rules violated by type: 'System.Net.Http.WebRequestHandler'. Derived types must either match the security accessibility of the base type or be less accessible.

Details in https://github.com/dotnet/corefx/issues/11100
Updated [System.Net.Http 4.3.1 package](https://www.nuget.org/packages/System.Net.Http/4.3.1) contains a fix and is available on nuget.

## Impact

Here's list of technical breaking changes caused by the solution withworkarounds for each.
Note that these new behaviors are specific when running on net46 / Desktop. When you run on .NET Core, the behavior is intact.

1. `HttpClientHandler.CheckCertificateRevocationList` (introduced in System.Net.Http 4.1)
* New behavior: Throws `PlatformNotSupportedException`
* Workaround: Use `ServicePointManager.CheckCertificateRevocationList` instead (impacts the whole AppDomain, not just single `HttpClientHandler` as it did in System.Net.Http 4.1-4.3)
2. `HttpClientHandler.SslProtocols` (introduced in System.Net.Http 4.1)
* New behavior: Throws `PlatformNotSupportedException`
* Workaround: Use `ServicePointManager.SecurityProtocol` instead (impacts the whole AppDomain, not just single `HttpClientHandler` as it did in System.Net.Http 4.1-4.3)
3. `HttpClientHandler.ServerCertificateCustomValidationCallback` (introduced in System.Net.Http 4.1)
* New behavior: Works fine, except that the first parameter of type `HttpRequestMessage` is always `null`
* Workaround: Use `ServicePointManager.ServerCertificateValidationCallback`
4. HTTP/2.0 support (introduced in System.Net.Http 4.1)
* New behavior: System.Net.Http (for net46 = Desktop) no longer supports HTTP/2.0 protocol on Windows 10.
* Workaround: Target System.Net.Http.WinHttpHandler NuGet package instead.
* Details:
* HTTP/2.0 support is part of the new CoreFx HTTP stack which on Windows is based on WinHTTP. The original HTTP stack in .NET Framework 4.6 did not support HTTP/2.0 protocol. If HTTP/2.0 protocol is needed, there is a separate NuGet package, System.Net.Http.WinHttpHandler which provides a new HttpClient handler. This handler is similar in features to `HttpClientHandler` (the normal default handler for HttpClient) but will support HTTP/2.0 protocol. When using HttpClient on .NET Core runtime, the WinHttpHandler is actually built-in to HttpClientHandler. But on .NET Framework, you need to explicitly use WinHttpHandler.
* Regardless of whether you are running using .NET Framework runtime (with WinHttpHandler) or .NET Core runtime using HttpClientHandler (or WinHttpHandler), there are additional requirements in order to get HTTP/2.0 protocol working on Windows:
* The client must be running on Windows 10 Anniversary Build (build 14393 or later).
* The `HttpRequestMessage.Version` must be explicitly set to 2.0 (the default is normally 1.1). Sample code:

```c#
var handler = new WinHttpHandler();
var client = new HttpClient(handler);
var request = new HttpRequestMessage(HttpMethod.Get, "http://www.example.com");
request.Version = new Version(2, 0);

HttpResponseMessage response = await client.SendAsync(request);
```

## Rationale

After much discussion it was decided the best way forward would be to revert the HttpClientHandler implementation in net46 build of CoreFX back to using original .NET Framework HTTP stack instead of WinHTTP (WinHttpHandler) based stack.

Additionally, we will revise the implementation of the new APIs on HttpClientHandler we introduced in 4.1.0.0 OOB package so that it works accordingly for the net46 build. [Details and tracking progress](https://github.com/dotnet/corefx/issues/11100#issuecomment-276293185).

---

*As a reminder, announcement threads are locked. Please use the [original issue](https://github.com/dotnet/corefx/issues/11100) for feedback and questions. Thanks!*