Azure function limit to site collection

Question

Hello all

I have a SPFx webpart calling Azure function api app to return data from Azure database. On the function app, I can setup AAD authentication and CROS to limit the origins to SharePoint root url.

Is there a way that I can limit the CORS (or using other method) to limit the call from a specific site collection? e.g. from mycompany.sharepoint.com/sites/A, but not from mycompany.sharepoint.com/site/B ? I deploy the webpart to the site collection catalog and would want the calls from that site only.

Thanks

Answer 1

You could try to add the site collection URL where SPFX is located to the request body, then judge whether to accept the request after the azure function receives the URL value.

this.context.pageContext.web.absoluteUrl  

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Have you considered just writing that in as detection logic on the Function, i.e. if request is not from /sites/A, then reject?