Azure / Azure/azure-functions-host

When a KubernetesSecretsRepository is implemented, anonymous functions will throw a 500 if the code querystring or x-functions-key header is present in the request

Open
#8,310 2 comments 5 reactions 0 assignees View on GitHub
area: configuration bug
Dominant language
C#
Stars
2k
Forks
482
Avg merge
2d 12h
Merged PRs (30d)
38

Description

When a KubernetesSecretsRepository is implemented, anonymous functions will throw a 500 if the query string parameter "code" or the header "x-functions-key" is present in the request. This prevents anonymous and authenticated functions from working properly in the same function app inside of Kubernetes

#### Repro steps

Provide the steps required to reproduce the problem:

1. Create a function app with both anonymous http triggers and authenticated triggers
2. Dockerize it
3. Implement KuberenetesSecretRepository as found here https://github.com/Azure/azure-functions-host/pull/4462
4. Deploy the function to AKS
5. Navigate to the anonymous function and do not pass the auth code in either the querystring or the header
6. Anonymous endpoint works as expected
7. Add the auth key using either the querystring "?code=" or the x-functions-key header
8. Anonymous function still works
9. Change the authcode to an invalid value
10. Anonymous function throws a 500

#### Expected behavior
No matter if the 'code' querystring or 'x-functions-key' header is sent, Authorization.Anonymous should take precedence over the presence of those values.

For example the 'code' querystring is part of the oauth2 spec, we use an auth.anonymous http trigger as a web-hook from a 3rd party system that sends in a querystring param also using 'code'. This works while running the functions in AppService, but fails in the cluster with a 500. This is because even though the function is set to authorization.anonymous, the presence of the "code" query string causes it to validate the value. if it matches what we have stored in the Kubernetes secret, the request passes through. if it has any other value, a 500 is thrown.

#### Known workarounds
Remove the KubernetesSecretsRepository functionality, set all functions in the app as anonymous, and manually check the x-functions-key header on each request for the expected value

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the KubernetesSecretsRepository implementation in the linked pull request and the host's handling of the code query parameter and x-functions-key header. Reproduce the anonymous-trigger request with valid and invalid values, then confirm anonymous requests do not return 500 while authenticated-trigger authorization still works.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, csharp, kubernetes
Domain
authentication, backend, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.