Make web api endpoint callable only by an Azure function app

erotavlas 6 Reputation points
2021-09-29T02:50:21.687+00:00

Hello,
I'm building the backend of a mobile app on Azure, I was thinking to use Function apps in conjunction with ASP.NET Core 3.1 Web Api. I need to do the following

  • Run a Function app to get some data periodically from online source,.
  • From the function app then send the data using POST request to an api endpoint and the method will write the data to an SQLite database
  • I only want that particular api endpoint visible / accessible to the Function app because no public user, or the mobile application should be allowed to post any data to the database
  • The other api endpoint should only be accessible to the mobile app (but not someone browsing the net who happens to find out the url) But that is a separate issue.

Is it possible to accomplish the part where I want the POST method visible to the Function app?

Azure Functions
Azure Functions
An Azure service that provides an event-driven serverless compute platform.
4,320 questions
ASP.NET Core
ASP.NET Core
A set of technologies in the .NET Framework for building web applications and XML web services.
4,207 questions

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Bruce (SqlWork.com) 56,926 Reputation points
    2021-09-29T15:08:59.843+00:00

    This is what azure virtual networks (vnets ) are for.

    https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-overview

  2. Jose Antonio Silva 6 Reputation points
    2021-12-03T19:26:58.98+00:00

    @erotavlas , you server (web-api) needs to demand some sort of secret/claim from the client code (Az function).

    If you need a quick solution, just hide some secret on both sides of those 2 services (shared key) and make the call using that secret as part of the request. (eg. https://dzone.com/articles/api-key-user-aspnet-web-api).

    If you want to do it more advanced, then a Managed Identity for the Az Function and an authorization to call that API/scope should be the way to go. Create a different scope for the mobile app, and another for the backend calls (Az Function). This is the way to go if you are already using or planning to use AzureAD for AuthN+AuthZ in your app/api.
    eg.:
    managed identities https://learn.microsoft.com/en-us/azure/app-service/overview-managed-identity?context=%2Fazure%2Factive-directory%2Fmanaged-identities-azure-resources%2Fcontext%2Fmsi-context&tabs=dotnet
    webapi scopes https://learn.microsoft.com/en-us/azure/active-directory/develop/scenario-protected-web-api-verification-scope-app-roles?tabs=aspnetcore

    0 comments