Azure / Azure/azure-functions-host

SyncTriggers failing if http used on an "https-only" app

Open
#10,053 1 comment 0 reactions 0 assignees View on GitHub
needs-investigation supportability
Dominant language
C#
Stars
2k
Forks
482
Avg merge
2d 12h
Merged PRs (30d)
38

Description

If a customer has these two settings...
- `SCM_SKIP_SSL_VALIDATION`=`1`
- HTTPS Only = On (viewable in portal)

...the functions host will attempt to make an `http` request to SyncTriggers. This will fail with a 404.

It ends up being a 404 because the request follows the following path:
- `POST` (with payload) issued to `http://{sitename}/operations/settriggers`
- Antares FrontEnd returns a `301 MovedPermanently` -- which the HttpClient follows this -- which becomes https -- and turns from a POST into a GET while dropping the payload. I never knew this happened, but context:
- [RFC explaining that 301 can become GET](https://developer.mozilla.org/en-US/docs/Web/HTTP/Redirections#permanent_redirections)
- [.NET RedirectHandler code that does a "force GET" when following redirects on a 301 with a POST](https://github.com/dotnet/runtime/blob/9bba3836ed4ddf2592ae9b92b3110dc6af03e453/src/libraries/System.Net.Http/src/System/Net/Http/SocketsHttpHandler/RedirectHandler.cs#L67-L80)
- this GET is not handled by the FrontEnd (it only intercepts POSTs) and makes its way back to the site itself, which returns a 404... to itself.

There's several investigations we can make here:
1. Does this request need to be http? https does seem to work as the GET works. Don't have much context, but [here is the code](https://github.com/Azure/azure-functions-host/blob/32a7b34c464c383b2a3ed09c6c5b59915f4f639b/src/WebJobs.Script.WebHost/Management/FunctionsSyncManager.cs#L724-L728).
2. If it does have to be http in this case, we can change `AllowAutomaticRedirect` in the HttpClient, handle the 301 directly, and present a nice error to the customer. Or use DiagnosticEvents, etc -- but provide guidance on how to get SyncTriggers working again.

Contributor guide

Open the contributing guide

Research direction

Start at src/WebJobs.Script.WebHost/Management/FunctionsSyncManager.cs around lines 724-728, then trace the SyncTriggers HTTP request and its HttpClient redirect behavior. Determine whether the request must use HTTP; if so, inspect how redirects and errors are surfaced. Done means SyncTriggers works for HTTPS-only apps or provides clear customer guidance instead of the current 404.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
api, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.