Azure / Azure/azure-functions-host

Support AzureWebJobsSecretStorageType=None, NullSecretsRepository

Open
#8,087 5 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
C#
Stars
2k
Forks
482
Avg merge
2d 12h
Merged PRs (30d)
38

Description

#8083 / [v4 PR] provides a simple fix for #5922, but the approach is somewhat fragile. A more robust approach would be to implement a NullSecretsRepository, while maintaining the current behavior of defaulting to blob storage.

| `AzureWebJobsSecretStorageType` | `AzureWebJobsStorage` | Secret Provider |
|---------------------------------------|----------------------------|------------------|
| `null` | `null` | NullSecretsRepository |
| `null` | exists | BlobStorageSecretsRepository |
| `None` | `null` | NullSecretsRepository |
| `None` | exists | NullSecretsRepository|

In the case where NullSecretsRepository is used, all authentication will be done through JWT token / bearer auth.

Care should be taken to ensure that admin endpoints cannot be successfully called with blank keys, ex. `/admin/host/status?code=`

Contributor guide

Open the contributing guide

Research direction

Start by tracing how AzureWebJobsSecretStorageType and AzureWebJobsStorage select the secret provider, then inspect the authentication path for admin endpoints. Done means None selects NullSecretsRepository in every table case, null storage preserves blob-storage defaults where specified, bearer authentication works, and blank admin keys cannot authorize requests.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, csharp
Domain
authentication, backend, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.