Provide client certificate in WebSocketContext

I have following scenario:

• WebSocket server running 3 URLs
• 1st and 2nd URL need to validate client certificate
• 3rd URL should accept calls without client certificate

Current implementation allows me to only set

server.SslConfiguration.ClientCertificateRequired = true;
server.SslConfiguration.ClientCertificateValidationCallback = ...;

However this validation happens in context where I can't get to URL. I can't validate certificate differently per URL. Because this callback comes from .NET class there is not much we could do here.

What we can do is to provide access to the certificate in the WebSocketContext. I can then do:

protected override void OnOpen()
{
    if (Context.RequestUri.AbsolutePath != "/public")
    {
        X509Certificate certificate = Context.ClientCertificate;
        ValidateCertificate(certificate);  // throws if certificate is invalid
    }
    // ... rest of logic ...
}

Start by tracing how the server's SslConfiguration and .NET client-certificate callback feed into WebSocketContext, then inspect the WebSocketContext API used from OnOpen. The change is done when handlers can access the client certificate through Context while retaining URL-specific validation.