Platform agnostic port resolution for health endpoint (#2757)

souvikghosh04 · Aniruddh25 · web-flow · commit 58fefcb1c942 · 2025-07-18T12:10:59.000+05:30
## Why make this change? - Closes on #2765 To robustly determine the internal port used by the application for self-referential HTTP calls (such as health checks), especially in containerized and reverse-proxy scenarios (e.g., Azure Container Apps), without relying on the ASP.NET Core Forwarded Headers middleware. - Environment-agnostic: Works in Azure Container Apps, AKS, ACI, on-prem, and other containerized environments without requiring special middleware configuration. - Resilient: Handles a variety of deployment scenarios and ingress/proxy setups. - No security risk: Does not trust forwarded headers globally, reducing the risk of header spoofing. ## What is this change? - Refactored ResolveInternalPort() to robustly determine the correct port for internal HTTP calls by: - Parsing the ASPNETCORE_URLS environment variable for the first HTTP port, including support for wildcard bindings like http://+:1234 or http://*:8080. - Falling back to port 5000 if no valid port is found. - No longer relying on X-Forwarded-Port or Host headers, which are not trustworthy for internal routing. - Updated the health check HttpClient to always use http://localhost:<resolved-port> for internal calls, ensuring reliability across all environments. - Updated HTTPS redirection logic to exclude /health (and /graphql if needed) from redirection, allowing internal HTTP health checks to succeed without being redirected. - No changes are required to middleware configuration for this logic to work. ## How was this tested? - [x] Integration Tests - [x] Unit Tests ## Sample Request(s) `GET /health` --------- Co-authored-by: Aniruddh Munde <anmunde@microsoft.com>
diff --git a/src/Service.Tests/UnitTests/PortResolutionHelperTests.cs b/src/Service.Tests/UnitTests/PortResolutionHelperTests.cs
@@ -0,0 +1,133 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+using System;
+using Azure.DataApiBuilder.Service.Utilities;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+
+namespace Azure.DataApiBuilder.Service.Tests.UnitTests
+{
+    /// <summary>
+    /// Tests for the <see cref="PortResolutionHelper"/> class, which resolves the internal port used by the application
+    /// </summary>
+    [TestClass]
+    public class PortResolutionHelperTests
+    {
+        /// <summary>
+        /// Tests the <see cref="PortResolutionHelper.ResolveInternalPort"/> method to ensure it resolves the correct
+        /// port.
+        /// </summary>
+        /// <remarks>This test method sets the "ASPNETCORE_URLS" environment variable to various test
+        /// cases and verifies that the <see cref="PortResolutionHelper.ResolveInternalPort"/> method returns the
+        /// expected port. It handles different URL formats and edge cases, including null or invalid inputs.</remarks>
+        /// <param name="aspnetcoreUrls">A string representing the ASP.NET Core URLs to be tested.</param>
+        /// <param name="expectedPort">The expected port number that should be resolved.</param>
+        [DataTestMethod]
+        [DataRow("http://localhost:5000", 5000)]
+        [DataRow("https://localhost:443", 443)]
+        [DataRow("http://+:1234", 1234)]
+        [DataRow("https://*:8443", 8443)]
+        [DataRow("http://localhost:5000;https://localhost:443", 5000)]
+        [DataRow("https://localhost:443;http://localhost:5000", 5000)]
+        [DataRow("http://localhost:5000,https://localhost:443", 5000)]
+        [DataRow(null, 5000)]
+        [DataRow("", 5000)]
+        [DataRow("http://localhost", 80)]
+        [DataRow("https://localhost", 443)]
+        [DataRow("http://[::1]:5000", 5000)]
+        [DataRow("http://localhost;https://localhost:8443", 80)]
+        [DataRow("https://localhost:8443;https://localhost:9443", 8443)]
+        [DataRow("invalid;http://localhost:5000", 5000)]
+        [DataRow("http://localhost:5000;invalid", 5000)]
+        [DataRow("http://+:", 5000)]
+        [DataRow("https://localhost:5001;http://localhost:5000", 5000)]
+        [DataRow("https://localhost:5001;https://localhost:5002", 5001)]
+        public void ResolveInternalPortResolvesCorrectPortPositiveTest(string aspnetcoreUrls, int expectedPort)
+        {
+            TestPortResolution(aspnetcoreUrls, null, expectedPort);
+        }
+
+        /// <summary>
+        /// Tests that the <see cref="PortResolutionHelper.ResolveInternalPort"/> method uses the  "DEFAULT_PORT"
+        /// environment variable when the "ASPNETCORE_URLS" environment variable is not set.
+        /// </summary>
+        /// <remarks>This test sets the "DEFAULT_PORT" environment variable to "4321" and verifies that 
+        /// <see cref="PortResolutionHelper.ResolveInternalPort"/> returns this value. It ensures that  the method
+        /// correctly defaults to using "DEFAULT_PORT" when "ASPNETCORE_URLS" is null.</remarks>
+        [TestMethod]
+        public void ResolveInternalPortUsesDefaultPortEnvVarTest()
+        {
+            TestPortResolution(null, "4321", 4321);
+        }
+
+        /// <summary>
+        /// Tests that the <see cref="PortResolutionHelper.ResolveInternalPort"/> method uses the default port when the
+        /// environment variable <c>ASPNETCORE_URLS</c> is set to invalid values.
+        /// </summary>
+        /// <remarks>This test sets the <c>ASPNETCORE_URLS</c> environment variable to invalid URLs and
+        /// the <c>DEFAULT_PORT</c> environment variable to a valid port number. It verifies that <see
+        /// cref="PortResolutionHelper.ResolveInternalPort"/> correctly falls back to using the default port specified
+        /// by <c>DEFAULT_PORT</c>.</remarks>
+        [TestMethod]
+        public void ResolveInternalPortUsesDefaultPortWhenUrlsAreInvalidTest()
+        {
+            TestPortResolution("invalid-url;another-invalid", "4321", 4321);
+        }
+
+        /// <summary>
+        /// Tests that the <see cref="PortResolutionHelper.ResolveInternalPort"/> method falls back to the default port
+        /// when the <c>DEFAULT_PORT</c> environment variable is set to a non-numeric value.
+        /// </summary>
+        /// <remarks>This test sets the <c>DEFAULT_PORT</c> environment variable to an invalid value and
+        /// verifies that <see cref="PortResolutionHelper.ResolveInternalPort"/> correctly falls back to using
+        /// the default port of 5000 when the <c>DEFAULT_PORT</c> cannot be parsed as a valid integer.</remarks>
+        [TestMethod]
+        public void ResolveInternalPortFallsBackToDefaultWhenDefaultPortIsInvalidTest()
+        {
+            TestPortResolution(null, "abc", 5000);
+        }
+
+        /// <summary>
+        /// Negative tests for the <see cref="PortResolutionHelper.ResolveInternalPort"/> method.
+        /// </summary>
+        /// <param name="aspnetcoreUrls">A string representing the ASP.NET Core URLs to be tested.</param>
+        /// <param name="expectedPort">The expected port number that should be resolved.</param>
+        [DataTestMethod]
+        [DataRow("http://localhost:5000 https://localhost:443", 5000)] // space invalid, falls back to default
+        [DataRow("http://localhost:5000|https://localhost:443", 5000)] // invalid delimiter, falls back to default
+        [DataRow("localhost:5000", 5000)] // missing scheme: fallback to default
+        [DataRow("http://:", 5000)] // incomplete URL: fallback to default
+        [DataRow("ftp://localhost:21", 5000)] // unsupported scheme: fallback to default
+        [DataRow("http://unix:/var/run/app.sock", 80)] // unix socket: defaults to 80 (no port specified)
+        [DataRow("http://unix:var/run/app.sock", 5000)] // malformed unix socket: fallback to default
+        [DataRow("http://unix:", 80)] // incomplete unix socket: defaults to 80
+        public void ResolveInternalPortResolvesCorrectPortNegativeTest(string aspnetcoreUrls, int expectedPort)
+        {
+            TestPortResolution(aspnetcoreUrls, null, expectedPort);
+        }
+
+        /// <summary>
+        /// Helper method to test port resolution with environment variables.
+        /// </summary>
+        /// <param name="aspnetcoreUrls">The ASPNETCORE_URLS environment variable value to set.</param>
+        /// <param name="defaultPort">The DEFAULT_PORT environment variable value to set.</param>
+        /// <param name="expectedPort">The expected port number that should be resolved.</param>
+        private static void TestPortResolution(string aspnetcoreUrls, string defaultPort, int expectedPort)
+        {
+            string originalUrls = Environment.GetEnvironmentVariable("ASPNETCORE_URLS");
+            string originalDefaultPort = Environment.GetEnvironmentVariable("DEFAULT_PORT");
+            Environment.SetEnvironmentVariable("ASPNETCORE_URLS", aspnetcoreUrls);
+            Environment.SetEnvironmentVariable("DEFAULT_PORT", defaultPort);
+            try
+            {
+                int port = PortResolutionHelper.ResolveInternalPort();
+                Assert.AreEqual(expectedPort, port);
+            }
+            finally
+            {
+                Environment.SetEnvironmentVariable("ASPNETCORE_URLS", originalUrls);
+                Environment.SetEnvironmentVariable("DEFAULT_PORT", originalDefaultPort);
+            }
+        }
+    }
+}
diff --git a/src/Service/Startup.cs b/src/Service/Startup.cs
@@ -28,6 +28,7 @@
 using Azure.DataApiBuilder.Service.Exceptions;
 using Azure.DataApiBuilder.Service.HealthCheck;
 using Azure.DataApiBuilder.Service.Telemetry;
+using Azure.DataApiBuilder.Service.Utilities;
 using HotChocolate;
 using HotChocolate.AspNetCore;
 using HotChocolate.Execution;
@@ -49,7 +50,6 @@
 using Microsoft.Extensions.Hosting;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
-using Microsoft.Extensions.Primitives;
 using NodaTime;
 using OpenTelemetry.Exporter;
 using OpenTelemetry.Logs;
@@ -284,25 +284,9 @@ public void ConfigureServices(IServiceCollection services)
             services.AddHttpClient("ContextConfiguredHealthCheckClient")
                 .ConfigureHttpClient((serviceProvider, client) =>
                 {
-                    IHttpContextAccessor httpCtxAccessor = serviceProvider.GetRequiredService<IHttpContextAccessor>();
-                    HttpContext? httpContext = httpCtxAccessor.HttpContext;
-                    string baseUri = string.Empty;
-
-                    if (httpContext is not null)
-                    {
-                        string scheme = httpContext.Request.Scheme;  // "http" or "https"
-                        string host = httpContext.Request.Host.Host ?? "localhost"; // e.g. "localhost"
-                        int port = ResolveInternalPort(httpContext);
-                        baseUri = $"{scheme}://{host}:{port}";
-                        client.BaseAddress = new Uri(baseUri);
-                    }
-                    else
-                    {
-                        // Optional fallback if ever needed in non-request scenarios
-                        baseUri = $"http://localhost:{ResolveInternalPort()}";
-                        client.BaseAddress = new Uri(baseUri);
-                    }
-
+                    int port = PortResolutionHelper.ResolveInternalPort();
+                    string baseUri = $"http://localhost:{port}";
+                    client.BaseAddress = new Uri(baseUri);
                     _logger.LogInformation($"Configured HealthCheck HttpClient BaseAddress as: {baseUri}");
                     client.DefaultRequestHeaders.Accept.Clear();
                     client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
@@ -472,21 +456,21 @@ private void AddGraphQLService(IServiceCollection services, GraphQLRuntimeOption
             }
 
             server.AddErrorFilter(error =>
+            {
+                if (error.Exception is not null)
                 {
-                    if (error.Exception is not null)
-                    {
-                        _logger.LogError(exception: error.Exception, message: "A GraphQL request execution error occurred.");
-                        return error.WithMessage(error.Exception.Message);
-                    }
+                    _logger.LogError(exception: error.Exception, message: "A GraphQL request execution error occurred.");
+                    return error.WithMessage(error.Exception.Message);
+                }
 
-                    if (error.Code is not null)
-                    {
-                        _logger.LogError(message: "Error code: {errorCode}\nError message: {errorMessage}", error.Code, error.Message);
-                        return error.WithMessage(error.Message);
-                    }
+                if (error.Code is not null)
+                {
+                    _logger.LogError(message: "Error code: {errorCode}\nError message: {errorMessage}", error.Code, error.Message);
+                    return error.WithMessage(error.Message);
+                }
 
-                    return error;
-                })
+                return error;
+            })
                 .AddErrorFilter(error =>
                 {
                     if (error.Exception is DataApiBuilderException thrownException)
@@ -565,7 +549,12 @@ public void Configure(IApplicationBuilder app, IWebHostEnvironment env, RuntimeC
 
             if (!Program.IsHttpsRedirectionDisabled)
             {
-                app.UseHttpsRedirection();
+                // Use HTTPS redirection for all endpoints except /health and /graphql.
+                // This is necessary because ContextConfiguredHealthCheckClient base URI is http://localhost:{port} for internal API calls
+                app.UseWhen(
+                    context => !(context.Request.Path.StartsWithSegments("/health") || context.Request.Path.StartsWithSegments("/graphql")),
+                    appBuilder => appBuilder.UseHttpsRedirection()
+                );
             }
 
             // URL Rewrite middleware MUST be called prior to UseRouting().
@@ -1055,59 +1044,5 @@ public static void AddValidFilters()
             LoggerFilters.AddFilter(typeof(IAuthorizationResolver).FullName);
             LoggerFilters.AddFilter("default");
         }
-
-        /// <summary>
-        /// Get the internal port of the container.
-        /// </summary>
-        /// <param name="httpContext">The HttpContext</param>
-        /// <returns>The internal container port</returns>
-        private static int ResolveInternalPort(HttpContext? httpContext = null)
-        {
-            // Try X-Forwarded-Port if context is present
-            if (httpContext is not null &&
-                httpContext.Request.Headers.TryGetValue("X-Forwarded-Port", out StringValues fwdPortVal) &&
-                int.TryParse(fwdPortVal.ToString(), out int fwdPort) &&
-                fwdPort > 0)
-            {
-                return fwdPort;
-            }
-
-            // Infer scheme from context if available, else default to "http"
-            string scheme = httpContext?.Request.Scheme ?? "http";
-
-            // Check ASPNETCORE_URLS env var
-            string? aspnetcoreUrls = Environment.GetEnvironmentVariable("ASPNETCORE_URLS");
-
-            if (!string.IsNullOrWhiteSpace(aspnetcoreUrls))
-            {
-                foreach (string part in aspnetcoreUrls.Split(new[] { ';', ',' }, StringSplitOptions.RemoveEmptyEntries))
-                {
-                    string trimmed = part.Trim();
-
-                    // Handle wildcard format (e.g. http://+:5002)
-                    if (trimmed.StartsWith($"{scheme}://+:", StringComparison.OrdinalIgnoreCase))
-                    {
-                        int colonIndex = trimmed.LastIndexOf(':');
-                        if (colonIndex != -1 &&
-                            int.TryParse(trimmed.Substring(colonIndex + 1), out int wildcardPort) &&
-                            wildcardPort > 0)
-                        {
-                            return wildcardPort;
-                        }
-                    }
-
-                    // Handle standard URI format
-                    if (trimmed.StartsWith($"{scheme}://", StringComparison.OrdinalIgnoreCase) &&
-                        Uri.TryCreate(trimmed, UriKind.Absolute, out Uri? uri))
-                    {
-                        return uri.Port;
-                    }
-                }
-            }
-
-            // Fallback
-            return scheme.Equals("https", StringComparison.OrdinalIgnoreCase) ? 443 : 5000;
-        }
-
     }
 }
diff --git a/src/Service/Utilities/PortResolutionHelper.cs b/src/Service/Utilities/PortResolutionHelper.cs
