Azure / Azure/azure-webpubsub

AbuseProtection always fails in Replicas and custom domain

Open
#598 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
147
Forks
96
Avg merge
19h 28m
Merged PRs (30d)
87

Description

### Describe the bug
When in Replicas and custom domain scenarios, the request origins will be multiple values. And current server side to validate the origin has a bug correctly deserialize it, so Abuse Protection will always fail and block further requests.

### Impacts
- Microsoft.Azure.WebJobs.Extensions.WebPubSub(version <=1.6.0)
- Microsoft.Azure.WebPubSub.AspNetCore(version <= 1.1.0)
- Microsoft.Azure.Functions.Worker.Extensions.WebPubSub(verson = 1.5.0-beta.1)

### Exceptions
Check live trace and find Abuse Protection request returns 400.

### Further technical details
Multiple origins in header are not correctly parsed in server SDK where there's a space between multiple values.

See fix: https://github.com/Azure/azure-sdk-for-net/pull/38359

### Workaround
#### Option 1. Disable AbuseProtection.

- Microsoft.Azure.WebJobs.Extensions.WebPubSub
Update the `function.json` to set input/output binding required connection from a custom name, for example, `MyConnection` and put it empty in trigger binding.
```json
{
"disabled": false,
"bindings": [
{
"type": "webPubSubTrigger",
"direction": "in",
"name": "data",
"dataType": "binary",
"hub": "sample_funcchat",
"eventName": "message",
"eventType": "user",
"connection": "" //make empty
},
{
"type": "webPubSub",
"name": "actions",
"hub": "sample_funcchat",
"connection": "MyConnection", //make custom name
"direction": "out"
}
]
}
```

And also set the value in configuration, for example: `local.settings.json`:
```json
{
"IsEncrypted": false,
"Values": {
"AzureWebJobsStorage": "",
"FUNCTIONS_WORKER_RUNTIME": "node",
"WebPubSubHub": "",
"MyConnection": "" //set the connection string with your custom name `MyConnection`
},
"Host": {
"LocalHttpPort": 7071,
"CORS": "*"
}
}
```

#### Option 2. Update to latest SDK.
- [Microsoft.Azure.WebJobs.Extensions.WebPubSub(version >=1.7.0)](https://www.nuget.org/packages/Microsoft.Azure.WebJobs.Extensions.WebPubSub/1.7.0)

a. Remove `extensionBundle` settings in `host.json`. For example, make it simple as below.
```json
{
"version": "2.0"
}
```

b. Explicit install required extensions.
```bash
> func extensions install --package Microsoft.Azure.WebJobs.Extensions.WebPubSub --version 1.7.0
```
- [Microsoft.Azure.WebPubSub.AspNetCore(version >= 1.2.0)](https://www.nuget.org/packages/Microsoft.Azure.WebPubSub.AspNetCore/1.2.0)

```[tasklist]
### Tasks
- [x] Bug fix.
- [x] Release packages. Microsoft.Azure.WebPubSub.AspNetCore [v1.2.0](https://www.nuget.org/packages/Microsoft.Azure.WebPubSub.AspNetCore/1.2.0) Microsoft.Azure.WebJobs.Extensions.WebPubSub [v1.7.0](https://www.nuget.org/packages/Microsoft.Azure.WebJobs.Extensions.WebPubSub/1.7.0) Microsoft.Azure.Functions.Worker.Extensions.WebPubSub [v1.7.0-beta.1](https://www.nuget.org/packages/Microsoft.Azure.Functions.Worker.Extensions.WebPubSub/1.7.0-beta.1)
- [ ] Update package version in Function extension bundle.
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by checking the Function extension bundle configuration and the host.json guidance in the issue, then inspect how the Web PubSub extension package version is maintained in the bundle. Done means the bundle references the released Web PubSub package version; the bug fix and package releases are already marked complete.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
backend, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.