[Eduard van Valkenburg (eavanvalkenburg)]

Motivation and Context

Preserve established behavior while making the default configuration more visible to users.

Description

• Preserve established default behavior.
• Add a targeted configuration warning.
• Keep explicit validation behavior unchanged and add focused tests.

Contribution Checklist

• The code builds clean without any errors or warnings
• The PR follows the SK Contribution Guidelines and the pre-submission formatting script raises no violations
• All unit tests pass, and I have added new tests where possible
• I didn't break anyone 😄

[Copilot]

Copilot review overview

🟡 Changes recommended

The default HTTP and redirect behavior is a security-sensitive change requiring an explicit decision or retention of deny-by-default behavior.

Review effort: Lite
Findings: 1

Open (1)

• Preserve deny-by-default HTTP URL and redirect behavior · New

What changed in this PR

Clarifies Python HttpPlugin defaults by changing behavior when no domain allow list is configured, adding a warning, and expanding tests.

Changes:

• Updates default URL validation and redirect handling.
• Adds a configuration warning for missing allowed_domains.
• Adds focused coverage for defaults, warnings, and redirects.

File	Summary
python/​tests/​unit/​core_plugins/​test_http_plugin.py	Adds tests for default behavior, warnings, requests, and redirects.
python/​semantic_kernel/​core_plugins/​http_plugin.py	Updates default validation, redirect behavior, documentation, and warning logic.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Python Test Coverage Report •

File	Stmts	Miss	Cover	Missing
core_plugins
http_plugin.py	76	0	100%
TOTAL	29045	5595	80%

Python Unit Test Overview

Tests	Skipped	Failures	Errors	Time
4122	22 💤	0 ❌	0 🔥	2m 13s ⏱️