Azure / Azure/azure-functions-dotnet-worker

Using any key except the master host key will not work

Open
#3,031 0 comments 0 reactions 0 assignees View on GitHub
Needs: Triage (Functions) potential-bug
Dominant language
C#
Stars
466
Forks
215
Avg merge
3d 10h
Merged PRs (30d)
7

Description

### Description

I have two function endpoints in one Azure Function. Both are protected with the User Authorization Level. I have it deployed and can see everything. Even have swagger installed and all of those endpoints work. The two functions, however, always return a 401 Unauthorized response on every request, except for when I'm using the master host key which I shouldn't use anywhere public. I even tried one of the Function's function key and that also returned a 401 Unauthorized. I also have this linked to APIM. Weirdly, any call from there doesn't work even with the master key. That's my second issue. I know this isn't a bug with my Authorization middleware because using the master host key will get me the 200 response I'm looking for.

I'm using .net 8 isolated model

### Steps to reproduce

Expose a function that's using the AuthorizationLevel.User value. Link it to APIM. When you try testing it you'll see even when you specify the master host key, you always receive a 401 Unauthorized response. You'll also find you receive a 401 response when you directly invoke your function with any key that isn't the master host key.

In application insights you will also find this unpopulated property on successful requests.

![Image](https://github.com/user-attachments/assets/2e4feae4-efa9-4b85-a84c-626e4e0faaeb)

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the .NET 8 isolated Azure Function with AuthorizationLevel.User, testing both a function key and the master host key, then repeat the calls through APIM. Compare the authorization behavior and the unpopulated Application Insights property; done means valid non-master keys work directly and through APIM without unintended 401 responses.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, csharp
Domain
api, authentication, backend, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.