Azure / Azure/azure-functions-host
SyncTriggers failing if http used on an "https-only" app
- Dominant language
- C#
- Stars
- 2k
- Forks
- 482
- Avg merge
- 2d 12h
- Merged PRs (30d)
- 38
Description
If a customer has these two settings...
- `SCM_SKIP_SSL_VALIDATION`=`1`
- HTTPS Only = On (viewable in portal)
...the functions host will attempt to make an `http` request to SyncTriggers. This will fail with a 404.
It ends up being a 404 because the request follows the following path:
- `POST` (with payload) issued to `http://{sitename}/operations/settriggers`
- Antares FrontEnd returns a `301 MovedPermanently` -- which the HttpClient follows this -- which becomes https -- and turns from a POST into a GET while dropping the payload. I never knew this happened, but context:
- [RFC explaining that 301 can become GET](https://developer.mozilla.org/en-US/docs/Web/HTTP/Redirections#permanent_redirections)
- [.NET RedirectHandler code that does a "force GET" when following redirects on a 301 with a POST](https://github.com/dotnet/runtime/blob/9bba3836ed4ddf2592ae9b92b3110dc6af03e453/src/libraries/System.Net.Http/src/System/Net/Http/SocketsHttpHandler/RedirectHandler.cs#L67-L80)
- this GET is not handled by the FrontEnd (it only intercepts POSTs) and makes its way back to the site itself, which returns a 404... to itself.
There's several investigations we can make here:
1. Does this request need to be http? https does seem to work as the GET works. Don't have much context, but [here is the code](https://github.com/Azure/azure-functions-host/blob/32a7b34c464c383b2a3ed09c6c5b59915f4f639b/src/WebJobs.Script.WebHost/Management/FunctionsSyncManager.cs#L724-L728).
2. If it does have to be http in this case, we can change `AllowAutomaticRedirect` in the HttpClient, handle the 301 directly, and present a nice error to the customer. Or use DiagnosticEvents, etc -- but provide guidance on how to get SyncTriggers working again.
Contributor guide
Research direction
Start at src/WebJobs.Script.WebHost/Management/FunctionsSyncManager.cs around lines 724-728, then trace the SyncTriggers HTTP request and its HttpClient redirect behavior. Determine whether the request must use HTTP; if so, inspect how redirects and errors are surfaced. Done means SyncTriggers works for HTTPS-only apps or provides clear customer guidance instead of the current 404.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100