microsoft / microsoft/aspire

App Service site name truncation (`take(name-uniqueString, 60)`) can weaken uniqueness for long resource names

Open
#18,750 0 comments 0 reactions 0 assignees View on GitHub
area-integrations
Dominant language
C#
Stars
6.3k
Forks
991
Avg merge
2d 12h
Merged PRs (30d)
201

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Describe the bug

App Service website resources generated for `AddAzureAppServiceEnvironment` name each site using:

```bicep
name: take('${toLower('api')}-${uniqueString(resourceGroup().id)}', 60)
```

The `uniqueString(resourceGroup().id)` disambiguator (13 chars) is placed at the **end** of the string, and `take(..., 60)` truncates from the **tail**. For short resource names this is fine, but when the Aspire resource name is long (roughly ≥46 characters), the `take(…, 60)` truncation eats into — or entirely removes — the trailing `uniqueString`. Two app services whose names share a long common prefix (differing only after the truncation boundary) can then truncate to the **same** 60-character site name, causing a resource-name collision in the same resource group.

This is the same class of truncation-vs-uniqueness problem previously seen with Azure Container App environment naming: putting the uniqueness suffix in a position where it can be truncated defeats its purpose.

Note: this is a **pre-existing** naming pattern in the App Service environment publisher. It was surfaced while reviewing #18738 (delegated subnet support) but is **not** introduced or changed by that PR — the delegated-subnet additions (shared VNet-level subnet, and the per-site `networkConfig` child namespaced under the unique site name) do not add collision risk. Filing separately so the underlying site-name truncation weakness is tracked.

### Expected Behavior

Site names should preserve the `uniqueString` disambiguator even when the resource name is long — e.g. by truncating the name prefix while guaranteeing the `uniqueString` suffix is always retained, so two distinct app services can never collapse to the same site name.

### Steps To Reproduce

Inspect the generated Bicep for an App Service website with a long resource name, or the snapshot `tests/Aspire.Hosting.Azure.Tests/Snapshots/AzureAppServiceTests.AddAppServiceWithDelegatedSubnet.verified.bicep` (site name on the `webapp` resource). Two app services whose names share a ≥46-character prefix would `take(…, 60)` to the same value.

### Anything else?

- Affected area: `Aspire.Hosting.Azure.AppService` site name generation.
- Related PR (context only, not the cause): https://github.com/microsoft/aspire/pull/18738
- Only the site-name generation is affected. Child resources (`main`, `stage`, `virtualNetwork` networkConfig, `slotConfigNames`) inherit the unique parent site name as their namespace and are safe.

Contributor guide

Open the contributing guide

Research direction

Start in the Aspire.Hosting.Azure.AppService site-name generation and inspect the generated Bicep in tests/Aspire.Hosting.Azure.Tests/Snapshots/AzureAppServiceTests.AddAppServiceWithDelegatedSubnet.verified.bicep. Add coverage for long resource names and verify that generated site names retain the uniqueString suffix and remain distinct after truncation.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, csharp
Domain
cloud
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.