Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Not clear about the behavior on OpenAPI__ApiKey configuration running in Azure Function App #438

Open
xiejiams opened this issue May 16, 2022 · 0 comments

Comments

@xiejiams
Copy link

xiejiams commented May 16, 2022

Describe the issue
In version 1.3, the current ApiKey in Azure Function configuration doing nothing. The code will always be the function key, and it could be authenticated by the x-function-key in the header. However, in doc it says we MUST specify the ApiKey.

Authenticated by the x-function-key with the function key is secure. It is what I like. However, it is different to the document
and it is confusing.

I have seen a related issue #383. I only see that fix fixing the SwaggerUI file.
Is it designed to only fix the swagger ui endpoint ApiKey behavior? Or it will affect the OpenAPI document endpoint ApiKey as well.

It is confusing every developer who is trying to deploy their function. The current documentation wastes our time to figure out what is going on and what should be the bug and correct behavior for the OpenAPI__ApiKey configuration.

To Reproduce
Steps to reproduce the behavior:

  1. Deploy the azure function.
  2. Specify the "OpenApi__AuthLevel__Document" = "Function" and (NOT specify or specify OpenApi_ApiKey to any value) in configuration.
  3. Using the value specify in the OpenApi__ApiKey configuration to authenticate from either Url Query code or header x-function-api will response 401. Instead, using function key in either Url Query code or header x-function-key will be 200.

Expected behavior
Please remove the "Make sure that you MUST provide the OpenApi__AuthKey value, if you choose the OpenApi__AuthLevel__Document value other than Anonymous" in the document.
Documenting that: Without OpenApi__ApiKey configuration in deployed function, it will auto use the Azure Function Key to authenticate the OpenApi document endpoint, if the OpenApi__AuthLevel__Document is other than Anonymous.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant