[BUG] Api Key not being sent when deleting webhook

Type of Connector

Custom Connector

Name of Connector

Everhour

Describe the bug

I have create a custom connector for Everhour. It works fine, but they don't include the Location header in their response to the request creating the webhook. So I added custom code to my connector adding the header:

public class Script : ScriptBase
{
public override async Task<HttpResponseMessage> ExecuteAsync()
    {
        HttpResponseMessage response = await this.Context.SendAsync(this.Context.Request, this.CancellationToken).ConfigureAwait(continueOnCapturedContext: false);
        if (response.IsSuccessStatusCode)
        {
            if (this.Context.OperationId == "Trigger")
            {
                return await this.AddLocationHeader(response).ConfigureAwait(false);
            }
        }
        return response;
    }
    private async Task<HttpResponseMessage> AddLocationHeader(HttpResponseMessage response)
    {
        var responseString = await response.Content.ReadAsStringAsync().ConfigureAwait(continueOnCapturedContext: false);
        var result = JObject.Parse(responseString);
        response.Headers.Add("Location", "https://private-anon-d7b81b023f-everhour.apiary-mock.com/hooks/" + result["id"]);
        return response;
    }
}

So now the connector runs that URL when the flow is turned off. The problem is that no authentication headers are sent. The delete action is defined in the connector, but the deletion seems to ignore the definition (you can see I even added a random header just to make sure it is sent, but it isn't):

  /hooks/{hook_id}:
    delete:
      responses:
        '204':
          description: Success
          schema: {}
      summary: Delete a Webhook
      description: Deletes a webhook given an id
      operationId: DeleteWebhook
      x-ms-visibility: internal
      parameters:
        - $ref: '#/parameters/Content-type'
        - name: hook_id
          in: path
          required: true
          type: integer
        - name: X-My-Header
          in: header
          type: string
          default: My value

I'd appreciate any help here. I know what the headers are not sent, because their API offers a mock address that displays the calls. The delete call looks like this:

host: private-anon-d7b81b023f-everhour.apiary-mock.com
x-real-ip: 2.18.26.80
content-length: 0
x-ms-trigger-type: openapiconnectionwebhook
accept-language: en-us
x-ms-workflow-id: a342b9ba4f754909a4e476fd7d3094bb
x-ms-workflow-version: 08584735468993414396
x-ms-workflow-name: d666f7fd-f1f0-4d3a-a471-00077a8a487b
x-ms-workflow-system-id: /locations/uksouth/scaleunits/prod-14/workflows/a342b9ba4f754909a4e476fd7d3094bb
x-ms-workflow-run-id: 08584735468990753370210395964cu00
x-ms-workflow-operation-name: trigger
x-ms-execution-location: uksouth
x-ms-workflow-subscription-id: b1b36c61-d929-4258-8ace-6d31523e9820
x-ms-workflow-resourcegroup-name: 21c205cc335d4b0fb444ff527de57ab6-1c51a2c5741d41fe8e6f5ae93dc0bc90
x-ms-tracking-id: 72a6d878-283d-4ef3-b782-56b74e71f6f5
x-ms-correlation-id: 72a6d878-283d-4ef3-b782-56b74e71f6f5
x-ms-client-request-id: 72a6d878-283d-4ef3-b782-56b74e71f6f5
user-agent: azure-logic-apps/1.0 (workflow a342b9ba4f754909a4e476fd7d3094bb; version 08584735468993414396) microsoft-flow/1.0
x-ms-activity-vector: 00.01.in.0b.in.1b.in.03.in.1p
x-akamai-config-log-detail: true
accept-encoding: gzip
akamai-origin-hop: 1
via: 1.1 akamai.net(ghost) (akamaighost)
pragma: no-cache
cache-control: no-cache, max-age=0
akamai-grn: 0.501a1202.1728059986.171cd967
opc-request-id: gen_cd32fd0b-b143-4a21-8153-7cb859ec7f26

The operation "Trigger" definition is:

  /hooks:
    x-ms-notification-content:
      description: Default response
      schema: {}
    post:
      responses:
        '201':
          description: Default
      summary: Triggers
      operationId: Trigger
      x-ms-trigger: single
      parameters:
        - $ref: '#/parameters/Content-type'
        - name: body
          in: body
          required: true
          schema:
            type: object
            properties:
              targetUrl:
                type: string
                description: targetUrl
                x-ms-notification-url: true
                x-ms-visibility: internal
                title: ''
              events:
                type: array
                items:
                  type: string
                description: events
              project:
                type: string
                description: project
            required:
              - targetUrl
      description: Any trigger

Is this a security bug?

No, this is not a security bug

What is the severity of this bug?

Severity 2 - One or more important connector features are down

To Reproduce

Turn off the flow using the connector.

Expected behavior

The authentication header is sent with the delete requests.

Environment summary

Web.

Additional context

No additional context.

No repository file or test is named. Start by tracing the custom connector's Script.ExecuteAsync implementation and the OpenAPI definitions for /hooks and /hooks/{hook_id}, then reproduce turning off the flow against the Everhour mock endpoint. Done means the DeleteWebhook request includes the configured authentication and X-My-Header headers.