Azure / Azure/azure-functions-host
When a KubernetesSecretsRepository is implemented, anonymous functions will throw a 500 if the code querystring or x-functions-key header is present in the request
- Dominant language
- C#
- Stars
- 2k
- Forks
- 482
- Avg merge
- 2d 12h
- Merged PRs (30d)
- 38
Description
When a KubernetesSecretsRepository is implemented, anonymous functions will throw a 500 if the query string parameter "code" or the header "x-functions-key" is present in the request. This prevents anonymous and authenticated functions from working properly in the same function app inside of Kubernetes
#### Repro steps
Provide the steps required to reproduce the problem:
1. Create a function app with both anonymous http triggers and authenticated triggers
2. Dockerize it
3. Implement KuberenetesSecretRepository as found here https://github.com/Azure/azure-functions-host/pull/4462
4. Deploy the function to AKS
5. Navigate to the anonymous function and do not pass the auth code in either the querystring or the header
6. Anonymous endpoint works as expected
7. Add the auth key using either the querystring "?code=" or the x-functions-key header
8. Anonymous function still works
9. Change the authcode to an invalid value
10. Anonymous function throws a 500
#### Expected behavior
No matter if the 'code' querystring or 'x-functions-key' header is sent, Authorization.Anonymous should take precedence over the presence of those values.
For example the 'code' querystring is part of the oauth2 spec, we use an auth.anonymous http trigger as a web-hook from a 3rd party system that sends in a querystring param also using 'code'. This works while running the functions in AppService, but fails in the cluster with a 500. This is because even though the function is set to authorization.anonymous, the presence of the "code" query string causes it to validate the value. if it matches what we have stored in the Kubernetes secret, the request passes through. if it has any other value, a 500 is thrown.
#### Known workarounds
Remove the KubernetesSecretsRepository functionality, set all functions in the app as anonymous, and manually check the x-functions-key header on each request for the expected value
Contributor guide
Research direction
Start by reviewing the KubernetesSecretsRepository implementation in the linked pull request and the host's handling of the code query parameter and x-functions-key header. Reproduce the anonymous-trigger request with valid and invalid values, then confirm anonymous requests do not return 500 while authenticated-trigger authorization still works.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, csharp, kubernetes
- Domain
- authentication, backend, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100