Azure / Azure/azure-functions-host
Configurable Disablement of Anonymous Auth level for user functions
- Dominant language
- C#
- Stars
- 2k
- Forks
- 482
- Avg merge
- 2d 10h
- Merged PRs (30d)
- 36
Description
We should consider putting an Azure Policy addressable feature flag in place for Function Apps to declare that anonymous access isn't supported for Function invocations. Similar to the **FunctionsRuntimeAdminIsolationEnabled** flag we added for the Vanguard work. Here's a proposal:
- We add a **FunctionsRuntimeAnonymousAccessDisabled** site level property (peer to the other)
- The platform flows this setting to the site via a `FUNCTIONS_ANONYMOUS_ACCESS_DISABLED` app setting
- The runtime will check Http functions on startup, and if any are deployed with Anonymous access, we'll handle it as a validation failure for that function. The error will be logged and the function won't be indexed.
**Note**: that this restriction is only for user Functions, not for general Anonymous access to the app (e.g. root site access, admin/host/ping, etc. which is used by the platform)
Contributor guide
Assessment
This issue has not been assessed yet.