Authentication Enabled | Vulnerability Database

App Service authentication is activated

Enabling authentication ensures that all communications in the application are authenticated. The auth_settings block needs to be filled out with the appropriate auth backend settings

Impact

Anonymous HTTP requests will be accepted

Recommended Actions

Follow the appropriate remediation steps below to resolve the issue.

Log into the Microsoft Azure Management Console.
Select the “Search resources, services, and docs” option at the top and search for App Services.
Select the “App Services” by clicking on the “Name” link to access the configuration changes.
Scroll down the selected “App Services” navigation panel and in “Settings” click on the “Authentication / Authorization” option.
On the “Authentication / Authorization” page check if “App Service Authentication” is “ON/OFF”. If it’s turned “OFF” all unauthenticated requests to the login page will not be redirected.
Repeat steps number 2 - 5 to cross check “Authentication / Authorization” for other “App Services."
Navigate to the “App Services”, select the “App Service” and click on the “Name”, select the “Authentication / Authorization” under “Settings.”
Click on the “ON” option under “App Service Authentication” and click on the “Save” button at the top to make the chamges.
Repeat above steps for enabling “Authentication” to redirect all unauthenticated requests to the login page.

Enable authentication to prevent anonymous request being accepted

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


resource "azurerm_app_service" "good_example" {
  name                = "example-app-service"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  app_service_plan_id = azurerm_app_service_plan.example.id
  
  auth_settings {
    enabled = true
  }
}

Remediation Links

https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/app_service#enabled