App Service site name truncation (`take(name-uniqueString, 60)`) can weaken uniqueness for long resource names
- Dominant language
- C#
- Stars
- 6.3k
- Forks
- 991
- Avg merge
- 2d 12h
- Merged PRs (30d)
- 201
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Describe the bug
App Service website resources generated for `AddAzureAppServiceEnvironment` name each site using:
```bicep
name: take('${toLower('api')}-${uniqueString(resourceGroup().id)}', 60)
```
The `uniqueString(resourceGroup().id)` disambiguator (13 chars) is placed at the **end** of the string, and `take(..., 60)` truncates from the **tail**. For short resource names this is fine, but when the Aspire resource name is long (roughly ≥46 characters), the `take(…, 60)` truncation eats into — or entirely removes — the trailing `uniqueString`. Two app services whose names share a long common prefix (differing only after the truncation boundary) can then truncate to the **same** 60-character site name, causing a resource-name collision in the same resource group.
This is the same class of truncation-vs-uniqueness problem previously seen with Azure Container App environment naming: putting the uniqueness suffix in a position where it can be truncated defeats its purpose.
Note: this is a **pre-existing** naming pattern in the App Service environment publisher. It was surfaced while reviewing #18738 (delegated subnet support) but is **not** introduced or changed by that PR — the delegated-subnet additions (shared VNet-level subnet, and the per-site `networkConfig` child namespaced under the unique site name) do not add collision risk. Filing separately so the underlying site-name truncation weakness is tracked.
### Expected Behavior
Site names should preserve the `uniqueString` disambiguator even when the resource name is long — e.g. by truncating the name prefix while guaranteeing the `uniqueString` suffix is always retained, so two distinct app services can never collapse to the same site name.
### Steps To Reproduce
Inspect the generated Bicep for an App Service website with a long resource name, or the snapshot `tests/Aspire.Hosting.Azure.Tests/Snapshots/AzureAppServiceTests.AddAppServiceWithDelegatedSubnet.verified.bicep` (site name on the `webapp` resource). Two app services whose names share a ≥46-character prefix would `take(…, 60)` to the same value.
### Anything else?
- Affected area: `Aspire.Hosting.Azure.AppService` site name generation.
- Related PR (context only, not the cause): https://github.com/microsoft/aspire/pull/18738
- Only the site-name generation is affected. Child resources (`main`, `stage`, `virtualNetwork` networkConfig, `slotConfigNames`) inherit the unique parent site name as their namespace and are safe.
Contributor guide
Research direction
Start in the Aspire.Hosting.Azure.AppService site-name generation and inspect the generated Bicep in tests/Aspire.Hosting.Azure.Tests/Snapshots/AzureAppServiceTests.AddAppServiceWithDelegatedSubnet.verified.bicep. Add coverage for long resource names and verify that generated site names retain the uniqueString suffix and remain distinct after truncation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, csharp
- Domain
- cloud
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 68/100