Azure / Azure/azure-functions-host
GetAuthorizationKeyInfoAsync should error out if a function key header with multiple values is detected
- Dominant language
- C#
- Stars
- 2k
- Forks
- 482
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 36
Description
This is a customer reported issue.
#### Repro steps:
1) Create a function app in the Portal
2) Create an httptrigger function
To test an httptrigger function in the Portal, a customer can use the test window on the left (next to the function code editor) to send the request (see below). However, if a customer adds the `x-functions-key` and its value in the header, the response is a 401.

This is happening because the Portal already adds the function key and its value to the header by default. So, when the customer adds that same header, the two values of the key are combined separated by a comma (see below). This issue only repros when testing in the Portal; sending the request to the function via Postman, Fiddler or PowerShell works as expected.

To unblocked the customer, I will suggest to test using Postman, Fiddler or PowerShell. However, when parsing the function key header, if we detect multiple values, we should error out. The error message should say that we only support a single value for the function key header.
https://github.com/Azure/azure-functions-host/blob/06913c48a043e33c19776fde7795bb256579f31c/src/WebJobs.Script.WebHost/Security/Authentication/Keys/AuthenticationLevelHandler.cs#L84
Contributor guide
Research direction
Start in src/WebJobs.Script.WebHost/Security/Authentication/Keys/AuthenticationLevelHandler.cs at the linked line and trace how the function key header is parsed. Verify the multiple-value case and confirm that it produces an error stating that only a single value is supported for the function key header.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, csharp
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 48/100