kuromukira / azure-functions-jwt-validation-extension

A custom access token validation provider for Azure Functions via Dependency Injection with extra implementation for Firebase Auth.

Custom Token Validation Provider for Azure Functions

A custom access token validation provider for Azure Functions via Dependency Injection. Inspired by https://github.com/BenMorris/FunctionsCustomSercuity with extra implementation for Firebase Auth.

NuGet

Custom Token Validator

Add in your Function's Startup.cs

using Microsoft.Azure.Functions.Extensions.DependencyInjection;
using Microsoft.Azure.Functions.Extensions.JwtCustomHandler;
using Microsoft.Azure.Functions.Extensions.JwtCustomHandler.Interface;
using Microsoft.Extensions.DependencyInjection;
using System;

[assembly: FunctionsStartup(typeof(ExampleFunction.Startup))]
namespace ExampleFunction
{
    public class Startup : FunctionsStartup
    {
        public override void Configure(IFunctionsHostBuilder builder)
        {
            /// Custom Token Validator
            builder.Services.AddSingleton<IClaimsTokenProvider, CustomTokenProvider>(provider => new CustomTokenProvider(
                issuer: Environment.GetEnvironmentVariable("issuer"),
                audience: Environment.GetEnvironmentVariable("audience"),
                issuerSigningKey: Environment.GetEnvironmentVariable("issuerSigningKey")));
        }
    }
}

Inside your Function Class

public class ExamplesFunction
{
    private readonly IClaimsTokenProvider IClaimsTokenProvider;
    public ExamplesFunction(IClaimsTokenProvider provider) => IClaimsTokenProvider = provider;

    [FunctionName("Example_Function")]
    public IActionResult HelloWorldFunction([HttpTrigger(AuthorizationLevel.Anonymous, "get", Route = null)] HttpRequest req)
    {
        try
        {
            if (req.Headers is null)
                throw new NullReferenceException();
            else if (req.Body is null)
                throw new NullReferenceException();

            AccessTokenResult _tokenResult = IClaimsTokenProvider.ValidateToken(req);
            if (_tokenResult.Status != AccessTokenStatus.Valid)
                return new UnauthorizedResult();

            return new OkObjectResult($"Hello there, ${req.Query["name"]}");
        }
        catch (Exception)
        { return new BadRequestObjectResult("Web server encountered an error."); }
    }
}

or you can use the

Firebase Auth Id Token Validator

Add in your Function's Startup.cs

using Microsoft.Azure.Functions.Extensions.DependencyInjection;
using Microsoft.Azure.Functions.Extensions.JwtCustomHandler;
using Microsoft.Azure.Functions.Extensions.JwtCustomHandler.Interface;
using Microsoft.Extensions.DependencyInjection;
using System;

[assembly: FunctionsStartup(typeof(ExampleFunction.Startup))]
namespace ExampleFunction
{
    public class Startup : FunctionsStartup
    {
        public override void Configure(IFunctionsHostBuilder builder)
        {
            /// Firebase Id Token Validator
            builder.Services.AddSingleton<IFirebaseTokenProvider, CustomTokenProvider>(provider => new CustomTokenProvider(
                issuer: "https://securetoken.google.com/<your-firebase-app-name>",
                audience: "<your-firebase-app-name>"));
        }
    }
}

Inside your Function Class

public class ExamplesFunction
{
    private readonly IFirebaseTokenProvider IFirebaseTokenProvider;
    public ExamplesFunction(IFirebaseTokenProvider provider) => IFirebaseTokenProvider = provider;

    [FunctionName("Example_Function")]
    public async Task<IActionResult> HelloWorldFunction(
        [HttpTrigger(AuthorizationLevel.Anonymous, "get", Route = null)] HttpRequest req)
    {
        try
        {
            if (req.Headers is null)
                throw new NullReferenceException();
            else if (req.Body is null)
                throw new NullReferenceException();

            AccessTokenResult _tokenResult = await IFirebaseTokenProvider.ValidateToken(req);
            if (_tokenResult.Status != AccessTokenStatus.Valid)
                return new UnauthorizedResult();

            return new OkObjectResult($"Hello there, ${req.Query["name"]}");
        }
        catch (Exception)
        { return new BadRequestObjectResult("Web server encountered an error."); }
    }
}

Contributors

• kuromukira

Install the following to get started

IDE

1. Visual Studio Code
2. Visual Studio Community

Exntesions

1. C# Language Extension for VSCode

Frameworks

1. .NET

Do you want to contribute? Send me an email or DM me in twitter.

azure-functions-jwt-validation-extension's Issues

Authenticating the calls between 2 Azure functions

Hi,
Consider the following scenario:

• I have two HTTP trigger functions in 2 different Function Apps - Func1 and Func2
• Both Func1 and Func2 are called by public users . The caller is authenticated by Firebase login/password and then a bearer token is sent across to Func1 and Func2.

If Func1 wants to make a call to Func2 then what approach should Func2 take to authenticate itself to Func1 so that Func1 can seamlessly handle both public users and internal calls?

Thank you

Auto publish to NuGet.org via GitHub Actions

See https://dzone.com/articles/build-publish-and-deploy-nuget-package-using-githu

Looks promising.

Thank you

Not Able to Validate Token Getting below error

'IDX10503: Signature validation failed. Token does not have a kid. Keys tried: 'System.Text.StringBuilder'.
Exceptions caught:
'System.Text.StringBuilder'.
token: 'System.IdentityModel.Tokens.Jwt.JwtSecurityToken'.'

Can you please help here to solve the issue

I think
SecurityKey[] keys = x509Data.Values.Select(CreateSecurityKeyFromPublicKey).ToArray(); because of this line we are getting error