Add warning for using SWA provider without the Azure Platform

Author: Aniruddh25

src/Core/AuthenticationHelpers/AppServiceAuthenticationInformation.cs

@@ -19,14 +19,22 @@ public static class AppServiceAuthenticationInfo
     /// Environment variable key whose value represents Identity Provider such as "AzureActiveDirectory"
     /// </summary>
     public const string APPSERVICESAUTH_IDENTITYPROVIDER_ENVVAR = "WEBSITE_AUTH_DEFAULT_PROVIDER";
+
+    // ── AppService messages ──────────────────────────────────────────────────────────────────────
     /// <summary>
     /// Error message used when AppService Authentication is configured in production mode in a non AppService Environment.
     /// </summary>
-    public const string APPSERVICE_PROD_MISSING_ENV_CONFIG = "AppService environment not detected while runtime is in production mode.";
+    public const string APPSERVICE_PROD_MISSING_ENV_CONFIG =
+        "AppService environment not detected while runtime is in production mode. " +
+        "The X-MS-CLIENT-PRINCIPAL header is not cryptographically validated by DAB and can be trivially " +
+        "forged when the service is not hosted behind an Azure App Service EasyAuth proxy. " +
+        "Set host.mode to 'development' for local testing, or deploy behind Azure App Service.";
     /// <summary>
     /// Warning message logged when AppService environment not detected (applicable to development mode).
     /// </summary>
-    public const string APPSERVICE_DEV_MISSING_ENV_CONFIG = "AppService environment not detected, EasyAuth authentication may not behave as expected.";
+    public const string APPSERVICE_DEV_MISSING_ENV_CONFIG =
+        "AppService environment not detected. The X-MS-CLIENT-PRINCIPAL header is not cryptographically " +
+        "validated; EasyAuth authentication may not behave as expected outside an Azure App Service environment.";
 
     /// <summary>
     /// Returns a best guess whether AppService is enabled in the environment by checking for

src/Core/AuthenticationHelpers/StaticWebAppsAuthentication.cs

@@ -33,6 +33,31 @@ public class StaticWebAppsClientPrincipal
         public IEnumerable<string>? UserRoles { get; set; }
     }
 
+    /// <summary>
+    /// Environment variable key set by the Azure platform for every App Service and Static Web Apps
+    /// hosted site. Its presence is the best-effort signal that the runtime is executing behind an
+    /// Azure-managed proxy that injects and validates the X-MS-CLIENT-PRINCIPAL header.
+    /// </summary>
+    public const string WEBSITE_SITE_NAME_ENVVAR = "WEBSITE_SITE_NAME";
+
+    // ── StaticWebApps messages ───────────────────────────────────────────────────────────────────
+    /// <summary>
+    /// Error message used when StaticWebApps Authentication is configured in production mode
+    /// without a detectable Azure-hosted environment.
+    /// </summary>
+    public const string SWA_PROD_MISSING_ENV_CONFIG =
+        "StaticWebApps environment not detected while runtime is in production mode. " +
+        "The X-MS-CLIENT-PRINCIPAL header is not cryptographically validated by DAB and can be trivially " +
+        "forged when the service is not hosted behind an Azure Static Web Apps proxy. " +
+        "Set host.mode to 'development' for local testing, or deploy behind Azure Static Web Apps.";
+
+    /// <summary>
+    /// Warning message logged when StaticWebApps environment not detected (applicable to development mode).
+    /// </summary>
+    public const string SWA_DEV_MISSING_ENV_CONFIG =
+        "StaticWebApps environment not detected. The X-MS-CLIENT-PRINCIPAL header is not cryptographically " +
+        "validated; EasyAuth authentication may not behave as expected outside an Azure Static Web Apps environment.";
+
     /// <summary>
     /// Base64 decodes and deserializes the x-ms-client-principal payload containing
     /// SWA token metadata.
@@ -98,4 +123,14 @@ error is NotSupportedException ||
 
         return identity;
     }
+
+    /// <summary>
+    /// Returns a best-effort indication that the runtime is executing inside an Azure Static Web Apps
+    /// environment by checking for the presence of <see cref="WEBSITE_SITE_NAME_ENVVAR"/>, which is
+    /// injected by the Azure platform for every SWA-hosted application.
+    /// </summary>
+    public static bool AreExpectedSWAEnvVarsPresent()
+    {
+        return !string.IsNullOrEmpty(Environment.GetEnvironmentVariable(WEBSITE_SITE_NAME_ENVVAR));
+    }
 }

src/Service/Startup.cs

@@ -1148,11 +1148,36 @@ private void ConfigureAuthentication(IServiceCollection services, RuntimeConfigP
                     EasyAuthType easyAuthType = EnumExtensions.Deserialize<EasyAuthType>(runtimeConfig.Runtime.Host.Authentication.Provider);
                     bool isProductionMode = mode != HostMode.Development;
                     bool appServiceEnvironmentDetected = AppServiceAuthenticationInfo.AreExpectedAppServiceEnvVarsPresent();
+                    bool swaEnvironmentDetected = StaticWebAppsAuthentication.AreExpectedSWAEnvVarsPresent();
 
                     if (easyAuthType == EasyAuthType.AppService && !appServiceEnvironmentDetected)
                     {
+                        if (isProductionMode)
+                        {
+                            // SECURITY: In production the X-MS-CLIENT-PRINCIPAL header is blindly trusted.
+                            // Refuse to start when there is no evidence of an App Service EasyAuth proxy.
+                            throw new DataApiBuilderException(
+                                message: AppServiceAuthenticationInfo.APPSERVICE_PROD_MISSING_ENV_CONFIG,
+                                statusCode: System.Net.HttpStatusCode.ServiceUnavailable,
+                                subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError);
+                        }
+
                         _logBuffer.BufferLog(LogLevel.Warning, AppServiceAuthenticationInfo.APPSERVICE_DEV_MISSING_ENV_CONFIG);
                     }
+                    else if (easyAuthType == EasyAuthType.StaticWebApps && !swaEnvironmentDetected)
+                    {
+                        if (isProductionMode)
+                        {
+                            // SECURITY: In production the X-MS-CLIENT-PRINCIPAL header is blindly trusted.
+                            // Refuse to start when there is no evidence of a Static Web Apps proxy.
+                            throw new DataApiBuilderException(
+                                message: StaticWebAppsAuthentication.SWA_PROD_MISSING_ENV_CONFIG,
+                                statusCode: System.Net.HttpStatusCode.ServiceUnavailable,
+                                subStatusCode: DataApiBuilderException.SubStatusCodes.ConfigValidationError);
+                        }
+
+                        _logBuffer.BufferLog(LogLevel.Warning, StaticWebAppsAuthentication.SWA_DEV_MISSING_ENV_CONFIG);
+                    }
 
                     string defaultScheme = easyAuthType == EasyAuthType.AppService
                         ? EasyAuthAuthenticationDefaults.APPSERVICEAUTHSCHEME