Static web app security at azure

Question

We are about to make a static web app as:

https://learn.microsoft.com/en-us/azure/static-web-apps/

1. frontend is Vue.
2. backend is Web App type Asp .NET API written with C# in Azure.
3. backend is linked to UI in Azure static Web App APISs management.
4. we use Azure AD as an authentication provider
5. staticwebapp.config.json is configured correctly for API routes

As we can read here:

https://learn.microsoft.com/en-us/azure/static-web-apps/apis-app-service

"By default, when an App Service app is linked to a static web app, the App Service app only accepts requests that are proxied through the linked static web app. An Azure App Service app can only be linked to a single static web app at a time."

Now the questions are:

1. How we can be 100% sure on the backend that roles (in x-ms-client-principal header) are not edited/hacked on frontend
2. How we be 100% sure that App Service does not accept requests outside static web app UI?
3. Is this setup secure or are there known problems?

Answer 1

@Heikki Vilppu thanks for the question.

By default, Static Web Apps environments are publicly accessible, but you can configure a password and require visitors to enter it before viewing the app. Azure Static Web Apps provides a streamlined authentication experience, where no other actions or configurations are required to use GitHub, Twitter, and Azure Active Directory (Azure AD) for authentication. Azure App Service lets you secure your apps with HTTPS, and provides other security features such as static IP restrictions, client authentication and authorization, service-to-service authentication, and network isolation

Regarding your 3 questions:

• To ensure that roles in the x-ms-client-principal header are not edited/hacked on the frontend, you can use Azure Active Directory (Azure AD) for authentication as you mentioned above. Azure AD provides a streamlined authentication experience where no other actions or configurations are required to use it for authentication
• To ensure that App Service does not accept requests outside the static web app UI, you can configure static IP restrictions. This feature allows you to restrict access to your app only from specific IP addresses or ranges
• The setup is secure by default. However, since we don't know every single detail about your setup or environment its hard to say its 100% secure. With that being said, please follow best practices for security, keep your systems updated, and monitor for any unusual activity in your web app.

Hope this helps!

-Grace