Securing Content document path in inframe

[sumit4aug]

Please provide us with the following information:

This issue is for a: (mark with an x)

- [ ] bug report -> please search issues before submitting
- [ ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

How citation link can be secure, we've already implemented msal based SSO authentication with Azure AAD, but still its not working.

Any log messages given by the failure

Expected/desired behavior

OS and Version?

Windows 7, 8 or 10. Linux (which distribution). macOS (Yosemite? El Capitan? Sierra?)

azd version?

run azd version and copy paste here.

Versions

Mention any other details that might be useful

---

Thanks! We'll be in touch soon.

[pamelafox]

Which approach did you use for AAD? Did you follow https://github.com/Azure-Samples/azure-search-openai-demo/blob/main/LoginAndAclSetup.md or use a different approach?

If you followed that guide, then I think the content_file function should check get_auth_claims as well.

If you used a different approach, then the content_file function will need to check the auth headers somehow. We have another sample app here that checks auth in Python routes: https://github.com/Azure-Samples/ms-identity-python-webapp/blob/main/app.py

[pamelafox]

cc @mattmsft since this is ACL related

[github-actions]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this issue will be closed.

[pamelafox]

Thanks for raising this. Since this was opened, the app’s /content/ route is enforced by auth and path-level ACL checks, and the login/ACL setup is documented. With auth enabled, citations should point to /content/ (not direct blob URLs), with AZURE_USE_AUTHENTICATION and AZURE_ENFORCE_ACCESS_CONTROL enabled.

If you’re still seeing issues, please open a new issue with details to reproduce: which auth mode you’re using (MSAL vs App Service), your relevant env flags, and an example citation URL. I’m happy to take another look.