Azure App Service Web app authentication is off misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_13
Category - Subcategory	Public Exposure - APIs
Provider	AZURE
Severity	LOW
Framework	ARM, Bicep, Terraform, Terraform Plan
Mapped CSPM/KSPM Rule	71247168-8fae-45ba-af00-250cbc9dac68

Impact

Azure App Service Authentication is a feature that prevents anonymous HTTP requests from reaching the API app. Users with tokens are authenticated before they reach the API app. If an anonymous request is received from a browser, App Service redirects to a logon page. To handle the logon process, select from a set of identity providers or implement a custom authentication mechanism. Enabling App Service Authentication allows every incoming HTTP request to pass through it before being handled by the application code. Authentication of users with specified providers are handled, for example, Azure Active Directory, Facebook, Google, Microsoft Account, and Twitter. It also handles authentication of validation, storing and refreshing of tokens, managing the authenticated sessions, and injecting identity information into request headers.

How to Fix

Resource: azurerm_app_service

• Arguments: auth_settings:enabled [source,go]

---

resource "azurerm_app_service" "example" { ...

• auth_settings {
• enabled = true ... } }

---