Http Trigger Azure function should not accessible outside from App Service

Question

I am using http trigger azure function in my App Service. I want this http trigger azure function should not accessible publicly and accessible only from the App Service.

Currently I have created host key for http trigger function and I am using this for authenticate request.

Which authentication method should I use for this? Any thoughts.

Azure Function:

public static class RemoveSubscriptionsForPayers
    {
        [FunctionName(nameof(RemoveSubscriptionsForPayers))]
        public static async Task<IActionResult> Run(
            [HttpTrigger(AuthorizationLevel.Function, "post", Route = null)] HttpRequest req,
            [Inject] ILoggingService loggingService,
            [Inject] ICommandValidator commandValidator,
            [Inject] ICommandHandler<ResultDto,RemoveSubscriptionsForPayersCommand> commandHandler)
        {
            var logger = new Logger(loggingService);

            try
            {
                IActionResult actionResult = null;

                string requestBody = await new StreamReader(req.Body).ReadToEndAsync();

                logger.Info($"RemoveSubscriptionsForPayersCommand received on {nameof(RemoveSubscriptionsForPayers)}");

                var command = requestBody.AsPoco<RemoveSubscriptionsForPayersCommand>();

                if (commandValidator.Validate<RemoveSubscriptionsForPayersCommand>(req, command, new RemoveSubscriptionsForPayersCommandValidator(), logger, ref actionResult))
                {
                    var response =await commandHandler.HandleAsync(command, logger);
                    actionResult = new OkObjectResult(response);
                }

                return actionResult;
            }
            catch (Exception ex)
            {
                logger.Error($"Exception while processing {nameof(RemoveSubscriptionsForPayers)}", ex,
                  nameof(RemoveSubscriptionsForPayers));

                throw;
            }
        }
    }

Frank Gong Frank Gong · Accepted Answer · 2020-11-04T02:18:44

You can use Azure AD to authenticate your functions, which is more secure.

After opening Azure AD authentication, you need to obtain an access token.

Please open Azure active directory in the Azure portal and find App registrations, you need to search for the function you registered in Azure AD in the search box.

you need to find the parameter values of the url and body to obtain the token here.

URL to get access token

Body:

client_id
scope
username and password
grant_type: The value of grant_type is fixed, both are password.
client_secret

You can get Token like this:

Now you can use the access token of Azure AD to access your functions.

The request header name is Authorization, and the header value is Bearer <access-token>:

Http Trigger Azure function should not accessible outside from App Service

1 Answers