Skip to content

fix(apps): log inbound activities at info, warn on missing Authorization#425

Draft
corinagum wants to merge 3 commits into
mainfrom
cg/silent-401
Draft

fix(apps): log inbound activities at info, warn on missing Authorization#425
corinagum wants to merge 3 commits into
mainfrom
cg/silent-401

Conversation

@corinagum
Copy link
Copy Markdown
Contributor

@corinagum corinagum commented May 8, 2026

Summary

Test plan

  • uv run poe check (ruff format + ruff check, all pass)
  • uv run pyright src/microsoft_teams/apps/http/http_server.py (0 errors)
  • uv run poe test (580/580 pass)
  • Reviewer eyeball: confirm log message wording

Copilot AI review requested due to automatic review settings May 8, 2026 21:02
…zation header

Inbound activities only logged at debug (and only after auth+parse), and the
missing-Bearer-token path returned 401 with no log line. At default info level
this made it impossible to tell "request never arrived" from "request arrived
and was silently 401'd by the SDK." Adds an info-level entry log on every
inbound and a warn log when rejecting for a missing or malformed Authorization
header.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds additional diagnostics to the Apps HTTP ingress path (HttpServer.handle_request) to make it easier to determine whether inbound Teams activities are reaching the SDK and why they may be rejected.

Changes:

  • Log an inbound activity summary (type/id) at info level at the start of request handling.
  • Emit a warning when the Authorization header is missing or doesn’t contain a Bearer token (before returning 401).

Comment thread packages/apps/src/microsoft_teams/apps/http/http_server.py Outdated
Comment thread packages/apps/src/microsoft_teams/apps/http/http_server.py Outdated
…ype/id

Addresses Copilot review feedback on #425:
- Activity type/id come from the untrusted request body before auth runs.
  Strip control characters and cap length before formatting them into log
  lines so an attacker cannot forge multi-line log entries.
- Include type/id on the missing-Authorization-header warn, so users running
  at WARNING level can correlate the rejection with a specific activity
  without needing the preceding info entry.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@corinagum corinagum marked this pull request as draft May 8, 2026 21:45
Per review feedback: the info-level entry log on every inbound activity is
redundant with the existing debug log nearby, and operators who want
diagnostic visibility into "did the request reach the SDK" can already get
it by flipping the logger to debug. The genuinely new diagnostic value is
the warn on the missing-or-malformed Authorization header path, which is
silent at every log level today; that stays.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants