如何为Java版Azure Function App HttpTrigger配置Basic认证

你现有的匿名HttpTrigger函数要加Basic认证，不用Azure自带的ADMIN/FUNCTION级别认证，直接在函数代码里实现即可。下面是修改后的完整代码，以及关键逻辑说明：

package com.function;

import com.microsoft.azure.functions.ExecutionContext;
import com.microsoft.azure.functions.HttpMethod;
import com.microsoft.azure.functions.HttpRequestMessage;
import com.microsoft.azure.functions.HttpResponseMessage;
import com.microsoft.azure.functions.HttpStatus;
import com.microsoft.azure.functions.annotation.AuthorizationLevel;
import com.microsoft.azure.functions.annotation.FunctionName;
import com.microsoft.azure.functions.annotation.HttpTrigger;

import java.util.Base64;
import java.util.Optional;

/**
 * Azure Functions with HTTP Trigger and Basic Auth.
 */
public class Function {
    // 建议从环境变量读取凭证，避免硬编码
    private static final String VALID_USERNAME = System.getenv("BASIC_AUTH_USERNAME") != null ? System.getenv("BASIC_AUTH_USERNAME") : "admin";
    private static final String VALID_PASSWORD = System.getenv("BASIC_AUTH_PASSWORD") != null ? System.getenv("BASIC_AUTH_PASSWORD") : "password";

    @FunctionName("httpExample")
    public HttpResponseMessage run(
            @HttpTrigger(
                name = "req",
                methods = {HttpMethod.GET, HttpMethod.POST},
                authLevel = AuthorizationLevel.ANONYMOUS)
                HttpRequestMessage<Optional<String>> request,
            final ExecutionContext context) {
        context.getLogger().info("Java HTTP trigger processed a request.");

        // 第一步：处理Basic认证逻辑
        String authHeader = request.getHeaders().get("Authorization");
        if (authHeader == null || !authHeader.startsWith("Basic ")) {
            return request.createResponseBuilder(HttpStatus.UNAUTHORIZED)
                    .header("WWW-Authenticate", "Basic realm=\"HttpExampleFunction\"")
                    .body("Missing or invalid authentication header")
                    .build();
        }

        // 解析Base64编码的凭证
        String credentials = authHeader.substring("Basic ".length());
        try {
            String decoded = new String(Base64.getDecoder().decode(credentials));
            String[] parts = decoded.split(":", 2);
            if (parts.length != 2 || !parts[0].equals(VALID_USERNAME) || !parts[1].equals(VALID_PASSWORD)) {
                return request.createResponseBuilder(HttpStatus.UNAUTHORIZED)
                        .header("WWW-Authenticate", "Basic realm=\"HttpExampleFunction\"")
                        .body("Invalid username or password")
                        .build();
            }
        } catch (IllegalArgumentException e) {
            // Base64解码失败
            return request.createResponseBuilder(HttpStatus.UNAUTHORIZED)
                    .header("WWW-Authenticate", "Basic realm=\"HttpExampleFunction\"")
                    .body("Invalid authentication format")
                    .build();
        }

        // 第二步：认证通过后，执行原有的业务逻辑
        final String query = request.getQueryParameters().get("name");
        final String name = request.getBody().orElse(query);

        if (name == null) {
            return request.createResponseBuilder(HttpStatus.BAD_REQUEST).body("Please pass a name on the query string or in the request body").build();
        } else {
            return request.createResponseBuilder(HttpStatus.OK).body("Hello, " + name).build();
        }
    }
}

关键逻辑拆解 #

• 凭证读取：优先从环境变量BASIC_AUTH_USERNAME和BASIC_AUTH_PASSWORD读取合法用户名密码，避免硬编码在代码里，部署时直接在Function App的配置里添加这两个环境变量即可。
• 认证头校验：先检查请求头是否包含Authorization且以Basic 开头，不满足则返回401并带上WWW-Authenticate头，让客户端触发Basic认证弹窗。
• 凭证解析与验证：把Base64编码的凭证解码后分割成用户名和密码，和合法值对比，不匹配或解码失败都返回401。
• 业务逻辑执行：只有认证通过后，才会执行原来的查询参数/请求体处理逻辑。

测试方式 #

用curl测试的话，带上Basic认证参数：

# GET请求带查询参数
curl -u admin:password "{your host}/api/HttpExample?name=Test"

# POST请求带请求体
curl -u admin:password -d "TestBody" {your host}/api/HttpExample

内容的提问来源于stack exchange，提问作者Venkatesh