Inheritance sec rules violated by type: 'System.Net.Http.WebRequestHandler'


I am Trying to access Active Directory data through graph API. i am getting the following error on running the application.

Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code.

Exception Details: "System.TypeLoadException: Inheritance security rules violated by type: 'System.Net.Http.WebRequestHandler'. Derived types must either match the security accessibility of the base type or be less accessible."

Source Error:

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stack Trace:

[TypeLoadException: Inheritance security rules violated by type: 'System.Net.Http.WebRequestHandler'. Derived types must either match the security accessibility of the base type or be less accessible.]
   Microsoft.Owin.Security.OpenIdConnect.OpenIdConnectAuthenticationMiddleware.ResolveHttpMessageHandler(OpenIdConnectAuthenticationOptions options) +0
   Microsoft.Owin.Security.OpenIdConnect.OpenIdConnectAuthenticationMiddleware..ctor(OwinMiddleware next, IAppBuilder app, OpenIdConnectAuthenticationOptions options) +996
   lambda_method(Closure , OwinMiddleware , IAppBuilder , OpenIdConnectAuthenticationOptions ) +54

[TargetInvocationException: Exception has been thrown by the target of an invocation.]
   System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, Boolean constructor) +0
   System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal(Object obj, Object[] parameters, Object[] arguments) +92
   System.Delegate.DynamicInvokeImpl(Object[] args) +117
   System.Delegate.DynamicInvoke(Object[] args) +12
   Microsoft.Owin.Builder.AppBuilder.BuildInternal(Type signature) +236
   Microsoft.Owin.Builder.AppBuilder.Build(Type returnType) +21
   Microsoft.Owin.Host.SystemWeb.OwinAppContext.Initialize(Action`1 startup) +565
   Microsoft.Owin.Host.SystemWeb.OwinBuilder.Build(Action`1 startup) +58
   Microsoft.Owin.Host.SystemWeb.OwinHttpModule.InitializeBlueprint() +95
   System.Threading.LazyInitializer.EnsureInitializedCore(T& target, Boolean& initialized, Object& syncLock, Func`1 valueFactory) +115
   System.Threading.LazyInitializer.EnsureInitialized(T& target, Boolean& initialized, Object& syncLock, Func`1 valueFactory) +72
   Microsoft.Owin.Host.SystemWeb.OwinHttpModule.Init(HttpApplication context) +96
   System.Web.HttpApplication.RegisterEventSubscriptionsWithIIS(IntPtr appContext, HttpContext context, MethodInfo[] handlers) +523
   System.Web.HttpApplication.InitSpecial(HttpApplicationState state, MethodInfo[] handlers, IntPtr appContext, HttpContext context) +176
   System.Web.HttpApplicationFactory.GetSpecialApplicationInstance(IntPtr appContext, HttpContext context) +364
   System.Web.Hosting.PipelineRuntime.InitializeApplication(IntPtr appContext) +303

[HttpException (0x80004005): Exception has been thrown by the target of an invocation.]
   System.Web.HttpRuntime.FirstRequestInit(HttpContext context) +770
   System.Web.HttpRuntime.EnsureFirstRequestInit(HttpContext context) +95
   System.Web.HttpRuntime.ProcessRequestNotificationPrivate(IIS7WorkerRequest wr, HttpContext context) +195

Version Information: Microsoft .NET Framework Version:4.0.30319; ASP.NET Version:4.6.1069.1 

As i am a beginner i am struck with the error. Could any one please let me know what needs to be done to overcome this error
asked on Stack Overflow Jul 28, 2016 by user6606680 • edited Feb 10, 2020 by Yahoo Serious

5 Answers


It seems the bug has now been closed on GitHub ( and a new version of System.Net.Http has been released.

I was able to upgrade System.Net.Http to version 4.3.1 with NuGet and that solved the issue.

answered on Stack Overflow Mar 9, 2017 by infl3x

This worked for me: System.Net.Http v4.1.0.0 seems to have some issues. In web.config or app.config, point to the old version (v4.0.0.0)

    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
            <assemblyIdentity name="System.Net.Http" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />
            <bindingRedirect oldVersion="" newVersion="" />

Note, that when you install a new unrelated NuGet package, the bindingRedirect changes may be overwritten, and you need to set binding to again.

answered on Stack Overflow Aug 12, 2016 by SturmUndDrang • edited Feb 22, 2017 by MiFreidgeim SO-stop being evil

I found upgrading System.Net.Http via Nuget fixes it.

answered on Stack Overflow Apr 13, 2017 by Jim • edited Jan 30, 2019 by demo

I solved with downgrade System.Net.Http from 4.3.0 to 4.0.0 with Visual Studio NuGet Package Manager


I have faced the problem working with .net core web application (.net framework). I have tried everything I've read hear, but only migrating to .net 4.5.1 from .net 4.6.1 helped.

answered on Stack Overflow Apr 7, 2017 by user1793358

User contributions licensed under CC BY-SA 3.0