Authentication and security - Java code example in this page fails

[aitzhak]

There are 3 problems in the Java code in this page, specifically this code:

import java.io.Console;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.util.Base64;
import java.nio.charset.StandardCharsets;

public static Boolean headerMatchesEnvVar(String headerValue) throws NoSuchAlgorithmException {
    MessageDigest digest = MessageDigest.getInstance("SHA-256");
    String envVar = System.getenv("WEBSITE_AUTH_ENCRYPTION_KEY");
    String hash = new String(Base64.getDecoder().decode(digest.digest(envVar.getBytes(StandardCharsets.UTF_8))));
    return hash == headerValue;
}

1. It fails when trying to perform Base64.getDecoder().decode with the following Exception: java.lang.IllegalArgumentException: Illegal base64 character -5f It should instead activate Base64.getEncoder().encode as follows: String hash = new String(Base64.getEncoder().encode(digest.digest(envVar.getBytes(StandardCharsets.UTF_8))));
2. The expression hash == headerValue returns false even if the Strings have the same value. It should be changed to hash.equals(headerValue)
3. There is an unnecessary import java.io.Console

Thanks in advance, aitzhak

[Enter feedback here]

---

Document Details

⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

• ID: 20c42a13-f6cb-1e60-0438-f7f32b86a336
• Version Independent ID: 79e7dd15-24aa-2e6d-cee7-7714e1940c11
• Content: Monitor the health of App Service instances - Azure App Service
• Content Source: articles/app-service/monitor-instances-health-check.md
• Service: app-service
• GitHub Login: @msangapu-msft
• Microsoft Alias: msangapu

[AjayBathini-MSFT]

@aitzhak Thanks for your feedback! We will investigate and update as appropriate.

[RyanHill-MSFT]

Thanks for the feedback! I have assigned the issue to the content author to investigate further and update the document as appropriate.

[msangapu-msft]

#needs-sme-input

[btardif]

@msangapu-msft can we assign this to @denverbrittain

[msangapu-msft]

#reassign: denverbrittain

[jeffwmartinez]

@msangapu-msft The PR was merged to update the code with the corrections

[btardif]

#please-close based on @jeffwmartinez comment this is now fixed