Setting the ServerCertificateValidationCallback
delegate won't help you - SSL/TLS is not the protocol being referred to - the protocol violation is with regards to the HTTP headers (eg. long after TLS has been established).
There's a .NET configuration flag called useUnsafeHeaderParsing
that controls whether such violations are ignored or not.
Using reflection, it can also be set from the runtime. This Technet forum answer give's a great example of how to do so in PowerShell, we can wrap that in a nifty function like below:
function Set-UseUnsafeHeaderParsing
{
param(
[Parameter(Mandatory,ParameterSetName='Enable')]
[switch]$Enable,
[Parameter(Mandatory,ParameterSetName='Disable')]
[switch]$Disable
)
$ShouldEnable = $PSCmdlet.ParameterSetName -eq 'Enable'
$netAssembly = [Reflection.Assembly]::GetAssembly([System.Net.Configuration.SettingsSection])
if($netAssembly)
{
$bindingFlags = [Reflection.BindingFlags] 'Static,GetProperty,NonPublic'
$settingsType = $netAssembly.GetType('System.Net.Configuration.SettingsSectionInternal')
$instance = $settingsType.InvokeMember('Section', $bindingFlags, $null, $null, @())
if($instance)
{
$bindingFlags = 'NonPublic','Instance'
$useUnsafeHeaderParsingField = $settingsType.GetField('useUnsafeHeaderParsing', $bindingFlags)
if($useUnsafeHeaderParsingField)
{
$useUnsafeHeaderParsingField.SetValue($instance, $ShouldEnable)
}
}
}
}
And then use like:
Set-UseUnsafeHeaderParsing -Enable
before calling Invoke-WebRequest