AbuseProtection always fails in Replicas and custom domain
- Dominant language
- TypeScript
- Stars
- 147
- Forks
- 96
- Avg merge
- 19h 28m
- Merged PRs (30d)
- 87
Description
### Describe the bug
When in Replicas and custom domain scenarios, the request origins will be multiple values. And current server side to validate the origin has a bug correctly deserialize it, so Abuse Protection will always fail and block further requests.
### Impacts
- Microsoft.Azure.WebJobs.Extensions.WebPubSub(version <=1.6.0)
- Microsoft.Azure.WebPubSub.AspNetCore(version <= 1.1.0)
- Microsoft.Azure.Functions.Worker.Extensions.WebPubSub(verson = 1.5.0-beta.1)
### Exceptions
Check live trace and find Abuse Protection request returns 400.
### Further technical details
Multiple origins in header are not correctly parsed in server SDK where there's a space between multiple values.
See fix: https://github.com/Azure/azure-sdk-for-net/pull/38359
### Workaround
#### Option 1. Disable AbuseProtection.
- Microsoft.Azure.WebJobs.Extensions.WebPubSub
Update the `function.json` to set input/output binding required connection from a custom name, for example, `MyConnection` and put it empty in trigger binding.
```json
{
"disabled": false,
"bindings": [
{
"type": "webPubSubTrigger",
"direction": "in",
"name": "data",
"dataType": "binary",
"hub": "sample_funcchat",
"eventName": "message",
"eventType": "user",
"connection": "" //make empty
},
{
"type": "webPubSub",
"name": "actions",
"hub": "sample_funcchat",
"connection": "MyConnection", //make custom name
"direction": "out"
}
]
}
```
And also set the value in configuration, for example: `local.settings.json`:
```json
{
"IsEncrypted": false,
"Values": {
"AzureWebJobsStorage": "",
"FUNCTIONS_WORKER_RUNTIME": "node",
"WebPubSubHub": "",
"MyConnection": "" //set the connection string with your custom name `MyConnection`
},
"Host": {
"LocalHttpPort": 7071,
"CORS": "*"
}
}
```
#### Option 2. Update to latest SDK.
- [Microsoft.Azure.WebJobs.Extensions.WebPubSub(version >=1.7.0)](https://www.nuget.org/packages/Microsoft.Azure.WebJobs.Extensions.WebPubSub/1.7.0)
a. Remove `extensionBundle` settings in `host.json`. For example, make it simple as below.
```json
{
"version": "2.0"
}
```
b. Explicit install required extensions.
```bash
> func extensions install --package Microsoft.Azure.WebJobs.Extensions.WebPubSub --version 1.7.0
```
- [Microsoft.Azure.WebPubSub.AspNetCore(version >= 1.2.0)](https://www.nuget.org/packages/Microsoft.Azure.WebPubSub.AspNetCore/1.2.0)
```[tasklist]
### Tasks
- [x] Bug fix.
- [x] Release packages. Microsoft.Azure.WebPubSub.AspNetCore [v1.2.0](https://www.nuget.org/packages/Microsoft.Azure.WebPubSub.AspNetCore/1.2.0) Microsoft.Azure.WebJobs.Extensions.WebPubSub [v1.7.0](https://www.nuget.org/packages/Microsoft.Azure.WebJobs.Extensions.WebPubSub/1.7.0) Microsoft.Azure.Functions.Worker.Extensions.WebPubSub [v1.7.0-beta.1](https://www.nuget.org/packages/Microsoft.Azure.Functions.Worker.Extensions.WebPubSub/1.7.0-beta.1)
- [ ] Update package version in Function extension bundle.
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by checking the Function extension bundle configuration and the host.json guidance in the issue, then inspect how the Web PubSub extension package version is maintained in the bundle. Done means the bundle references the released Web PubSub package version; the bug fix and package releases are already marked complete.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100