How to call Azure Functions App from SharePoint Online as the signed-in User (via Client-side JavaScript)?

Question

I have an Azure Functions App (with HTTP API endpoint) which, upon triggered, needs to know the EMAIL ADDRESS of the caller; calling via the client-side (SPFx) JavaScript on the SharePoint Online Site.

I know, at the SP online side, I can get the @odata.context User Object and then grab the user's EMAIL ADDRESS from it, and then pass it as a variable (e.g, [email protected]) in the HTTP Request upon calling the Azure Functions App. But that variable can be spoofed and manipulated. I do not want to pass it as a variable.

Is there a better/proper way where SharePoint Client-side Javascript can make the HTTP Request to the Azure Functions App as the currently signed-in SharePoint User, and then the Azure Functions App can know who is calling?

Appreciate for the helps in advance.

Answer 1

In case you're using SPFx, you can use Azure Active Directory app registration and AadHttpClient to call the Azure Function. Then you can get user email from request info, I think.

More details about secured API: Sergei Sergeev and MS Docs.

Answer 2

Except for passing parameters, I think there is no other way to know who called the API. The API can be called in places other than SharePoint. Like Postman, there is no information needed in the API at all in the request segment. If you are worried about inaccurate data, you can verify whether the mailbox belongs to your organization in the azure function.