Azure Function Javascript Invocation hooks usage with HTTP triggers

In order to protect an API a function may retrieve a Bearer token from the HTTP request. As I wanted to to the same for multiple functions I thought I may implement that in an preInvocation hook. However, a hook has no access to the request. I really wonder what are the use cases for invocation hooks.

I hoped to find something similar to ExpressJS middlewares.

Thanks

Solution

You’re correct that Azure Functions currently don’t offer pre-invocation hooks with access to the HTTP request directly. However, there are alternative approaches to achieve token-based authentication across multiple functions:

1. Function-Level Authentication (Simple Cases):

If your authentication logic is relatively simple and doesn’t require complex reuse, you can integrate token retrieval and validation directly within each function:.

module.exports = async function (context, req) {
  const token = req.headers.authorization?.split(' ')[1]; // Extract token from Authorization header

  if (!token) {
    context.res = {
      status: 401, // Unauthorized
      body: 'Missing or invalid authorization token'
    };
    return;
  }

  // Validate token (replace with your actual validation logic)
  const isValid = validateToken(token); // Replace with a function that returns true/false

  if (!isValid) {
    context.res = {
      status: 401, // Unauthorized
    };
    return;
  }

  // Access protected resources here
  // ...

  context.res = {
    body: 'Success! (Protected resource accessed)'
  };
};

// Sample token validation function (replace with your actual logic)
function validateToken(token) {
  // Simulate token validation
  return token === 'secret-token'; // Replace with actual token validation
}

This approach keeps the code localized but might not be the most maintainable for complex scenarios.

2. Shared Authentication Module (Recommended for Reusability):

For reusable and more maintainable authentication logic, create a separate module to handle token validation:

const jwt = require('jsonwebtoken'); // Install using npm install jsonwebtoken

// Authentication module (replace with your actual token validation logic)
const auth = {
  validateToken: (token) => {
    try {
      const decoded = jwt.verify(token, 'your-secret-key'); // Replace with your secret key
      return decoded.userId !== undefined; // Check for a valid user identifier
    } catch (error) {
      return false;
    }
  }
};

module.exports = async function (context, req) {
  const token = req.headers.authorization?.split(' ')[1];

  if (!token || !auth.validateToken(token)) {
    context.res = {
      status: 401, // Unauthorized
      body: 'Missing or invalid authorization token'
    };
    return;
  }

  // Access protected resources here
  // ...

  context.res = {
    body: 'Success! (Protected resource accessed)'
  };
};

Import the auth module into your function files and leverage its validateToken method.
This approach promotes code reusability and simplifies authentication logic across multiple functions.

Use Cases for Invocation Hooks (While Not Ideal for Token Retrieval):

While not suitable for request object access, invocation hooks in Azure Functions (Node.js) have other valuable use cases:

Centralized Logging: Implement a pre-invocation hook to log details common to all functions, such as function name, invocation ID, and timestamp.
Metrics Tracking: Use a pre-invocation hook to capture custom metrics for all functions, providing insights into overall function usage.
Pre-Processing Data: For specific scenarios, you might use a pre-invocation hook to perform preliminary data transformations or validation common across functions.

If you need more advanced authentication with Azure Functions, explore integrating with Azure Active Directory (AAD) for centralized authorization and management.