Honor secure Functions host URIs in Java worker by larohra · Pull Request #1 · larohra/azure-functions-java-worker

larohra · 2026-05-12T17:30:24Z

Summary

JavaWorkerClient always builds ManagedChannelBuilder.forAddress(...).usePlaintext(), so the Java worker ignores the already-parsed --functions-uri and can never join a secure host/worker gRPC channel.

Findings

Fix necessary: Yes. Today the worker guarantees plaintext and blocks any host-side TLS rollout, leaving any non-local transport exposed to MITM tampering.
Historical context: Plaintext dates back to the early 2018 same-machine child-process design. In 2023 the worker added prefixed startup args, including functions-uri, plus fallback to legacy args, but JavaWorkerClient was not updated; this looks like an old assumption that became a gap once URI-based startup existed.
TLS behavior clarification: The fix should honor TLS, not ignore it. When functions-uri uses https, the worker should build a TLS gRPC channel and fail if handshake, certificate, or hostname validation fails. Only http URIs, or legacy startup that supplies just host+port, should continue to use plaintext.
Regression / breaking change: No new CLI or protocol contract. Existing http and legacy host+port launches keep their current behavior. The only observable behavior change is that a previously ignored or misconfigured https endpoint will stop connecting insecurely and instead fail closed.
Customer contract: No new flags are required. Trust still comes from the JVM trust configuration already available via existing Java options, so hosts using private CAs do not need a new worker-specific switch.
Testing today: mvn test currently passes (63 tests, 0 failures/errors/skips). Repo CI also runs build plus emulated, docker, and end-to-end matrices, but there is no direct secure gRPC transport coverage.

Plan

Expose the parsed functions-uri through IApplication in a compatibility-safe way.
Make JavaWorkerClient choose transport from the URI scheme: https => TLS with no plaintext downgrade, http or legacy host+port => plaintext.
Add focused plaintext/TLS transport tests and rerun mvn test.

larohra

@copilot address the comments

Agent-Logs-Url: https://github.com/larohra/azure-functions-java-worker/sessions/db76de91-28a8-4391-b3a2-d8796d6725e4 Co-authored-by: larohra <41490930+larohra@users.noreply.github.com>

Copilot · 2026-05-12T17:42:33Z

@copilot address the comments

Done in 0c9d360 and 5a9ed39. I addressed both review threads, ran targeted tests and full mvn test, and pushed the updates.

Agent-Logs-Url: https://github.com/larohra/azure-functions-java-worker/sessions/db76de91-28a8-4391-b3a2-d8796d6725e4 Co-authored-by: larohra <41490930+larohra@users.noreply.github.com>

larohra · 2026-05-12T18:10:52Z

+    }
+
+    @Test
+    public void legacyPlaintextTransportStillWorks() throws Exception {


@copilot apply changes based on this feedback

Implemented in f7e6bc4. I updated GrpcTransportTest to scope azure.functions.worker.java.skip.testing with an AutoCloseable (SkipTestingScope) so each test restores the original property value and avoids cross-test leakage. No UI changes were made in this PR, so there is no UI screenshot to provide.

@copilot this is the feedback - These tests set the global system property azure.functions.worker.java.skip.testing but never restore/clear it. Since surefire runs tests in the same JVM by default, this can leak into other tests and make the suite order-dependent. Consider capturing the original value and restoring it in a finally block (or via a small AutoCloseable/JUnit extension similar to TrustStoreScope).

Can you address it please

Agent-Logs-Url: https://github.com/larohra/azure-functions-java-worker/sessions/bc5fc454-8077-4ad5-b568-3befc6ceb14c Co-authored-by: larohra <41490930+larohra@users.noreply.github.com>

Copilot · 2026-05-12T18:15:19Z

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/repos/Azure/azure-functions-java-worker/pulls/comments/3228705589
- Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Auto-detected new Java versions from Microsoft OpenJDK releases. This PR was automatically generated by the Java version check pipeline. Pipeline Run: 20260504.1 Co-authored-by: Azure Functions Java Worker Bot <azfunc-java-worker-bot@microsoft.com>

* Add es-metadata.yml to schema 1.0.0 * Update area path to internal\Azure Functions

larohra · 2026-05-15T23:41:05Z

@copilot can you address these comments - Azure#872 (comment) and Azure#872 (comment)

Copilot · 2026-05-15T23:42:25Z

@copilot can you address these comments - Azure#872 (comment) and Azure#872 (comment)...

I can’t access those two Azure PR discussion links from this environment right now. Please paste the exact comment text (or screenshots) for discussion_r3245098945 and discussion_r3245102893, and I’ll apply the fixes immediately.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/repos/Azure/azure-functions-java-worker/pulls/comments/3245098945
- Triggering command: /usr/bin/curl curl -sS REDACTED (http block)
- Triggering command: /usr/bin/curl curl -i -sS REDACTED (http block)
https://api.github.com/repos/Azure/azure-functions-java-worker/pulls/comments/3245102893
- Triggering command: /usr/bin/curl curl -i -sS REDACTED (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

larohra

@copilot address these comments

Agent-Logs-Url: https://github.com/larohra/azure-functions-java-worker/sessions/f12a179d-bf43-486b-b716-cf4f837012ff Co-authored-by: larohra <41490930+larohra@users.noreply.github.com>

Copilot · 2026-05-16T01:15:21Z

@copilot address these comments

Addressed in dd4c111.

swarm-bot added 8 commits May 12, 2026 15:59

chore: bootstrap swarm original prompt

544542b

chore: persist swarm plan

76ad703

chore: persist swarm plan

9869c32

Expose functions-uri to worker startup code

3a32920

Choose gRPC transport from endpoint scheme

2b78a7c

Add plaintext and TLS transport coverage

079a4d4

chore: persist review round 1

2e77ed2

chore: strip evidence store for clean PR

8fbdc25

larohra commented May 12, 2026

View reviewed changes

Comment thread src/main/java/com/microsoft/azure/functions/worker/JavaWorkerClient.java Outdated

Comment thread src/test/java/com/microsoft/azure/functions/worker/test/utilities/FunctionsTestHost.java

Copilot started work on behalf of larohra May 12, 2026 17:35 View session

Copilot AI and others added 2 commits May 12, 2026 17:37

Address review feedback on annotations and test-host scope

0c9d360

Agent-Logs-Url: https://github.com/larohra/azure-functions-java-worker/sessions/db76de91-28a8-4391-b3a2-d8796d6725e4 Co-authored-by: larohra <41490930+larohra@users.noreply.github.com>

Refine comment follow-up on nullability and test host waits

5a9ed39

Agent-Logs-Url: https://github.com/larohra/azure-functions-java-worker/sessions/db76de91-28a8-4391-b3a2-d8796d6725e4 Co-authored-by: larohra <41490930+larohra@users.noreply.github.com>

Deduplicate test host message response handling

adbd845

Agent-Logs-Url: https://github.com/larohra/azure-functions-java-worker/sessions/db76de91-28a8-4391-b3a2-d8796d6725e4 Co-authored-by: larohra <41490930+larohra@users.noreply.github.com>

Copilot finished work on behalf of larohra May 12, 2026 17:44

larohra commented May 12, 2026

View reviewed changes

Copilot started work on behalf of larohra May 12, 2026 18:11 View session

Scope skip-testing property in GrpcTransportTest

f7e6bc4

Agent-Logs-Url: https://github.com/larohra/azure-functions-java-worker/sessions/bc5fc454-8077-4ad5-b568-3befc6ceb14c Co-authored-by: larohra <41490930+larohra@users.noreply.github.com>

Copilot finished work on behalf of larohra May 12, 2026 18:15

Copilot started work on behalf of larohra May 12, 2026 18:31 View session

Copilot finished work on behalf of larohra May 12, 2026 18:33

azure-pipelines Bot and others added 4 commits May 12, 2026 17:26

Update Java versions (Azure#870)

0696ee1

Auto-detected new Java versions from Microsoft OpenJDK releases. This PR was automatically generated by the Java version check pipeline. Pipeline Run: 20260504.1 Co-authored-by: Azure Functions Java Worker Bot <azfunc-java-worker-bot@microsoft.com>

Merge branch 'dev' into swarm/83f39e36/integration

9f4f823

Add es-metadata.yml (schema 1.0.0) (Azure#871)

ba67f1d

* Add es-metadata.yml to schema 1.0.0 * Update area path to internal\Azure Functions

Merge branch 'dev' into swarm/83f39e36/integration

f5ac9cc

Copilot started work on behalf of larohra May 15, 2026 23:41 View session

Copilot finished work on behalf of larohra May 15, 2026 23:55

larohra commented May 16, 2026

View reviewed changes

Comment thread src/main/java/com/microsoft/azure/functions/worker/JavaWorkerClient.java Outdated

Comment thread src/main/java/com/microsoft/azure/functions/worker/Application.java Outdated

Copilot started work on behalf of larohra May 16, 2026 01:10 View session

refactor URI parsing and transport security selection

dd4c111

Agent-Logs-Url: https://github.com/larohra/azure-functions-java-worker/sessions/f12a179d-bf43-486b-b716-cf4f837012ff Co-authored-by: larohra <41490930+larohra@users.noreply.github.com>

Copilot finished work on behalf of larohra May 16, 2026 01:15

Conversation

larohra commented May 12, 2026

Summary

Findings

Plan

Uh oh!

larohra left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI commented May 12, 2026

Uh oh!

larohra May 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI May 12, 2026

Choose a reason for hiding this comment

Uh oh!

larohra May 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented May 12, 2026

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

larohra commented May 15, 2026

Uh oh!

Copilot AI commented May 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

larohra left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI commented May 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented May 15, 2026 •

edited

Loading