Azure Functions disable Secure Client Initiated Renegotiation

Andy Grüning 26 Reputation points
2022-04-29T12:37:49.457+00:00

Hi there,

we ran a penetration test on a mobile app that makes requests to azure functions.
The pen test states that it allows "Secure Client Initiated Renegotiation", which is a security issue.

Is there a way to disable it on an azure app?
I cant find any documentation on this topic.

Thanks in advance for any help!

Azure Functions
Azure Functions
An Azure service that provides an event-driven serverless compute platform.
4,328 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. MughundhanRaveendran-MSFT 12,436 Reputation points
    2022-05-04T06:53:45.517+00:00

    @Andy Grüning ,

    Thanks for posting your query in Q&A.

    I had a discussion internally with the Functions team. Actually, the Secure Client-Initiated Renegotiation has to be disabled from the backend (at the Functions platform level). It will be disabled and released worldwide by the end of May (tentatively) if everything goes well. Please note that, this is applicable only to Http triggered function.

    I hope this helps!

    Please 'Accept as answer' and ‘Upvote’ if it helped so that it can help others in the community looking for help on similar topics.