Azure / Azure/Azure-Functions

Function App entering a broken state where listing keys stop working

Open
#2,660 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
PowerShell
Stars
1.1k
Forks
215
Avg merge
4h 2m
Merged PRs (30d)
1

Description

I deployed a function app which run into some errors but the Function App does show up in Azure Portal.

Image

After one of the deployments, one of the GET http trigger worked for once by the automation script that calls it.

Image

However, later today when I try to list keys of it in Azure Portal, it keeps giving me this error message "Encountered an error (InternalServerError) from host runtime." when I try to load system keys or host keys or function keys.

Looking at the Logs, it seems that the function app keeps getting 403 errors trying to read from the blob container "azure-webjobs-secrets" from the associated storage account that also contains the "deploymentpackage" container.

From the AppExceptions log, I can see that these 403 errors are about authorization header signature value mismatch.

```
Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.
RequestId:1ba956e3-401e-00c0-0f74-e9aeca000000
Time:2026-05-21T22:54:45.2983390Z
Status: 403 (Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.)
ErrorCode: AuthenticationFailed

Additional Information:
AuthenticationErrorDetail: The MAC signature found in the HTTP request 'redacted' is not the same as any computed signature. Server used following string to sign: 'GET

x-ms-client-request-id:298f5281-a163-4367-9490-6dc13f7fa2a9
x-ms-date:Thu, 21 May 2026 22:54:45 GMT
x-ms-return-client-request-id:true
x-ms-version:2024-11-04
/redacted_storage_account_name/azure-webjobs-secrets
restype:container'.

Content:
AuthenticationFailedServer failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.
RequestId:1ba956e3-401e-00c0-0f74-e9aeca000000
Time:2026-05-21T22:54:45.2983390ZThe MAC signature found in the HTTP request 'redacted' is not the same as any computed signature. Server used following string to sign: 'GET

x-ms-client-request-id:298f5281-a163-4367-9490-6dc13f7fa2a9
x-ms-date:Thu, 21 May 2026 22:54:45 GMT
x-ms-return-client-request-id:true
x-ms-version:2024-11-04
/redacted_storage_account_name/azure-webjobs-secrets
restype:container'.

Headers:
Server: Microsoft-HTTPAPI/2.0
x-ms-request-id: 1ba956e3-401e-00c0-0f74-e9aeca000000
x-ms-error-code: AuthenticationFailed
Date: Thu, 21 May 2026 22:54:44 GMT
Content-Length: 783
Content-Type: application/xml
```

I couldn't explain why it run into this signature mismatch error, especially given that the HTTP trigger had worked at some point. This feels like a bug instead of a misconfiguration. Do you know why the Function App may enter this state? Is there any way to recover from it other than deploying another instanace? I don't think redeploying the same code can guarantee fixing the problem because this problem happened right after one of my deployment and I don't see any specific code causing this.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.