Bug Fix: Safe Access to Response Headers Dictionary in Managed Identity Error Handling

Problem

When ManagedIdentityCredential authentication fails in Container Apps, the error message "The given key client-request-id was not present in the dictionary" is thrown because the code attempts to access the response headers dictionary without checking if the key exists first.

This occurs in the VerifyCorrelationIdHeaderInResponse method in OAuth2Client.cs which uses direct dictionary access headers[trimmedKey] without first verifying the key exists via ContainsKey().

Unlike App Services which include the "client-request-id" header in error responses, Container Apps may not include this header, causing a KeyNotFoundException.

Root Cause

In OAuth2Client.cs (line 372-385), the VerifyCorrelationIdHeaderInResponse method iterates through response headers and attempts to access the correlation ID header using direct dictionary indexing without checking if the key exists:

foreach (string responseHeaderKey in headers.Keys)
{
    string trimmedKey = responseHeaderKey.Trim();
    if (string.Compare(trimmedKey, OAuth2Header.CorrelationId, StringComparison.OrdinalIgnoreCase) == 0)
    {
        string correlationIdHeader = headers[trimmedKey].Trim();  // This can throw KeyNotFoundException
        // ...
    }
}

Solution

Wrap the dictionary access in a try-catch or use TryGetValue() method to safely handle cases where the header might not be present. This approach follows the pattern established in PR #5364.

Files to Modify

1. src/client/Microsoft.Identity.Client/OAuth2/OAuth2Client.cs - Fix the unsafe dictionary access in VerifyCorrelationIdHeaderInResponse method

Tests to Add

Add unit tests in tests/Microsoft.Identity.Test.Unit/PublicApiTests/ExtraHttpHeadersTests.cs or create a new test file to verify:

1. Normal case where correlation ID header is present
2. Case where correlation ID header is missing (should not throw)
3. Case where multiple headers are present but correlation ID is missing
4. Managed Identity scenario with missing correlation ID header