search

Azure / azure-functions-signalrservice-extension

Azure Functions bindings for SignalR Service. Project moved to https://github.com/Azure/azure-sdk-for-net/tree/main/sdk/signalr/Microsoft.Azure.WebJobs.Extensions.SignalRService .
MIT License
97 stars 46 forks source link

Probable DDoS vulnerability #199

Open AlbertoLeon opened 3 years ago

AlbertoLeon commented 3 years ago

When a negotiate end point expects UserId binding in headers for example {headers.x-ms-signalr-userid} but it is not present, the end point responds a 500 InvalidOperationException instead of a BadRequest.

This could overload the server handling the error and logging the strack trace and all that stuff. Apart of taking so mutch time to respond, what impacts negatively in performance.

A proposed solution could be to respond BadRequest with the message "A required header is missing for binding purposes". Then log in appropiately on Application Insights with the message: An attemp missed the header x-ms-signalr-userid required in Binding UserId.

Y-Sindo commented 3 years ago

The resolution of {x-ms-signalr-userid} utilizes some codes provided by https://github.com/Azure/azure-webjobs-sdk. Could you please open an issue in the project?