Azure / Azure/azure-functions-host

GetAuthorizationKeyInfoAsync should error out if a function key header with multiple values is detected

Open
#5,594 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
2k
Forks
482
Avg merge
2d 10h
Merged PRs (30d)
36

Description

This is a customer reported issue.

#### Repro steps:
1) Create a function app in the Portal
2) Create an httptrigger function

To test an httptrigger function in the Portal, a customer can use the test window on the left (next to the function code editor) to send the request (see below). However, if a customer adds the `x-functions-key` and its value in the header, the response is a 401.

![image](https://user-images.githubusercontent.com/12720858/73804390-81599200-4778-11ea-9658-0cf658204546.png)

This is happening because the Portal already adds the function key and its value to the header by default. So, when the customer adds that same header, the two values of the key are combined separated by a comma (see below). This issue only repros when testing in the Portal; sending the request to the function via Postman, Fiddler or PowerShell works as expected.

![image](https://user-images.githubusercontent.com/12720858/73804557-02188e00-4779-11ea-94ba-ac276355cb0b.png)

To unblocked the customer, I will suggest to test using Postman, Fiddler or PowerShell. However, when parsing the function key header, if we detect multiple values, we should error out. The error message should say that we only support a single value for the function key header.

https://github.com/Azure/azure-functions-host/blob/06913c48a043e33c19776fde7795bb256579f31c/src/WebJobs.Script.WebHost/Security/Authentication/Keys/AuthenticationLevelHandler.cs#L84

Contributor guide

Open the contributing guide

Research direction

Start in src/WebJobs.Script.WebHost/Security/Authentication/Keys/AuthenticationLevelHandler.cs at the linked line and trace how the function key header is parsed. Verify the multiple-value case and confirm that it produces an error stating that only a single value is supported for the function key header.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, csharp
Domain
authentication, backend
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.