Azure / Azure/azure-functions-host

Configurable Disablement of Anonymous Auth level for user functions

Open
#9,942 0 comments 0 reactions 1 assignee Claimed by @aishwaryabh View on GitHub
design supportability
Dominant language
C#
Stars
2k
Forks
482
Avg merge
2d 10h
Merged PRs (30d)
36

Description

We should consider putting an Azure Policy addressable feature flag in place for Function Apps to declare that anonymous access isn't supported for Function invocations. Similar to the **FunctionsRuntimeAdminIsolationEnabled** flag we added for the Vanguard work. Here's a proposal:

- We add a **FunctionsRuntimeAnonymousAccessDisabled** site level property (peer to the other)
- The platform flows this setting to the site via a `FUNCTIONS_ANONYMOUS_ACCESS_DISABLED` app setting
- The runtime will check Http functions on startup, and if any are deployed with Anonymous access, we'll handle it as a validation failure for that function. The error will be logged and the function won't be indexed.

**Note**: that this restriction is only for user Functions, not for general Anonymous access to the app (e.g. root site access, admin/host/ping, etc. which is used by the platform)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.