Possible security concern: Static Web App serves arbitrary files from repo root

[ChevronSoftware]

Thanks to all involved in creating this excellent service and associated documentation!

The docs (if not the product itself) should perhaps address the following scenario:

1. A web app exists at the root of a repo;
2. The guidance here is followed to create the workflow YAML;
3. The YAML can be downloaded by URL sniffing the deployed site, e.g. at /azure-pipelines.yml.

This feels like information that should not be made public, even assuming that secure variables have been properly used. Could other non-application files also be sniffed from the repo root in a similar manner?

I suggest the inclusion of best practices around this, even if as simple as placing the static app within a subfolder of the repo.

---

Document details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 63230b97-2269-3fed-7fca-882bb380c5f6
• Version Independent ID: feb2708e-5cea-4ad8-eaaa-f3061e18c11a
• Content: Tutorial: Publish Azure Static Web Apps with Azure DevOps
• Content Source: articles/static-web-apps/publish-devops.md
• Service: static-web-apps
• GitHub Login: @scubaninja
• Microsoft Alias: apedward

[NavtejSaini-MSFT]

@ChevronSoftware We are checking this and will get back to you.

[ChevronSoftware]

@ChevronSoftware We are checking this and will get back to you.

Thank you very much for looking into this so promptly, much appreciated!

[SnehaAgrawal-MSFT]

@ChevronSoftware Thanks again for the feedback! I have assigned the issue to the content author to review further and update the document as appropriate.

[scubaninja]

Hi @ChevronSoftware ! Thanks for the comment. The repo used in the tutorial is a public repo available on GitHub, we wanted users to have an easy to start tutorial for the documentation. While there are a lot of best practices that an organisation should follow, we do not address that in this article. I appreciate the input on putting a web app in a sub folder, but more to the point, a repo should be protected (authentication, etc),

I appreciate the feedback, it's difficult sometimes to address every scenario. I'll notify the owner of the vanilla API repo to include the files in a subfolder. Yes, if we do move those files into a subfolder, it protects the access to the YAML. We wanted to show a 'root' folder config in the docs, but will discuss if this is something we should address with the team in the docs.

Including @anthonychu, can we look at getting an 'exclude files' tag in the ADO task?

[scubaninja]

@ChevronSoftware I've opened an issue here

[ChevronSoftware]

@ChevronSoftware I've opened an issue here

Thank you @scubaninja, this is a great way forwards - much appreciated.

[scubaninja]

#please-close