Avoid spam request to Azure functions

Question

I'm using an Azure function app for my website to help send email. I use Azure Function authentication and pass the key as header from Ajax request and that works well. But my issue is that, having the function call in the JS of the website make it prone to my friends sending automated Http requests, such that the function is repeatedly executed Is there a way to avoid this. May be using the request sender IP?

Answer 1

Azure Function keys are not supposed to be shipped to the end user devices (be it browser, mobile app, IoT device etc). You should hide function calls behind some authentication flow.

See these links for some options:

• Authentication and authorization in Azure App Service

• Working with identity in an Azure Function

A very similar question, but from Mobile app point of view:

• How to safely call Azure Function with function level authorization in Xamarin mobile app?