Azure / Azure/static-web-apps

Using MSAL http interceptor with Azure functions proxies.json still tampers with the auth header

Open
#335 3 comments 0 reactions 0 assignees View on GitHub
Functions
Dominant language
No language data
Stars
346
Forks
67
PR merge metrics
No merged PRs in 30d

Description

I believe my scenario is affected by the behaviour stipulated in [issue 34](https://github.com/Azure/static-web-apps/issues/34). However, I'm using an angular 11 frontend with MSAL 2.0 beta 2 and I only have a single azure function to allow a proxies.json to allow a straight pass through to an external web api. The webapi is a dotnet 5.0 api set up to use Microsoft Identity with JWT bearer authentication and all works fine when a direct api call is made. Deploying to an Azure Static Web app, I can confirm that non authorised api calls work so I know my functions proxies.json route is working as expected but when I try to hit an authorised protected api endpoint, I end up with the following:

Bearer was not authenticated. Failure message: IDX10503: Signature validation failed

On inspection of the logging, I can see that the token is landing at the api with the issuer and audience changed to that of the azure function so it seems as though even though the proxies route is kicking in, my authorization header is still being overwritten.

What's not clear is how I can stop or manage this behaviour. Even if I create a custom msal http interceptor to write a custom auth header, I'm not clear on how I can override the Microsoft Identity Web Api options to use this instead of the standard authentication bearer header. Any pointers or comments would be appreciated as I'm familiar with using Angular wrapped in an nginx container and a separate protected dotnet api through docker compose multi containers but to be able to target a simple static web app would be ideal if I can get protected external api calls cracked!

To confirm setup:

Angular v 11
MSAL 2.0.0-beta.2
MSAL-Browser: 2.13.0

Dotnet 5 webapi with
Microsoft.Identity.Web 1.7.0

AAD app registration using Authorization Code flow with PKCE (i.e. no id or access token) for use with MSAL 2.0

Notable excerpts of code:

Dummy Azure Function:

```c#
public static class DummyFunction
{
[FunctionName("DummyFunction")]
public static async Task Run(
[HttpTrigger(AuthorizationLevel.Anonymous, "get", "post", Route = null)] HttpRequest req,
ILogger log)
{
log.LogInformation("C# HTTP trigger function processed a request.");

// doesn't do anything in here

return new OkObjectResult(responseMessage);
}
}
```
local.settings.json:
``` json
{
"IsEncrypted": false,
"Values": {
"AzureWebJobsStorage": "",
"FUNCTIONS_WORKER_RUNTIME": "dotnet",
"AZURE_FUNCTION_PROXY_DISABLE_LOCAL_CALL": true,
"APIHOST_CRM": "https://.azurewebsites.net"
}
}

```
proxies.json
``` json
{
"$schema": "http://json.schemastore.org/proxies",
"proxies": {
"backend": {
"matchCondition": {
"route": "/api/{*restOfPath}"
},
"backendUri": "%APIHOST_CRM%/api/{restOfPath}",
"debug": true
}
}
}
```
Auth set up in webapi:
```c#
// Setting configuration for protected web api
services
.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
.AddMicrosoftIdentityWebApi(Configuration);
```

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.