Container Apps ingress returns "Bad Request" to Salesforce (works fine in App Service)

[onionhammer]

This issue is a: (mark with an x)

• bug report -> please search issues before submitting
• documentation issue or request
• regression (a behavior that used to work and stopped in a new release)

Issue description

When issuing a new request from Salesforce, no matter which container is running, the request is stopped at ingress and responds with "Bad Request" and a status code of 400.

Steps to reproduce

1. Create a new Azure Container App via the portal, using the 'hello world'
2. IN SALESFORCE: Execute anonymous request in salesforce (code below)
   or CURL: curl -X GET -H "sfdc_stack_depth: 1" https://your-aca-endpoint.centralus.azurecontainerapps.io

Expected behavior [What you expected to happen.]
The container's http server should be invoked, allowing the container to handle the request

Actual behavior [What actually happened.]
Ingress stops the request and returns literal string "Bad Request" with status code of 400. The same container running on Azure App Service works fine via Salesforce

Screenshots
Bad request in debug output of salesforce

hello world running, works fine in browser and postman:

Additional context
Code to execute:

Http http = new Http();
HttpRequest request = new HttpRequest();

request.setEndpoint('https://test.someaca-210420418.centralus.azurecontainerapps.io/');
request.setMethod('GET');

HttpResponse response = http.send(request);
System.debug(response.getStatus());
System.debug(response.getStatusCode());
System.debug('response headers:');
for(String headerKey : response.getHeaderKeys()){
    System.debug(headerKey + ': ' + response.getHeader(headerKey));
}
System.debug('response body:');
System.debug(response.getBody());

[SSilence]

I have the same Bad Request error using custom http header parameters with an underscore _ in the name. e.g. my_header: xyz. Removing this underscore solves the problem.

[onionhammer]

Indeed salesforce does send a header with sfdc_stack_depth: 1, which is the culprit.

[onionhammer]

Relates to #264

[onionhammer]

I believe ACA uses Envoy as ingress; perhaps this setting is wrong?

https://cloudnative.to/envoy/api-v2/api/v2/core/protocol.proto.html#enum-core-httpprotocoloptions-headerswithunderscoresaction

[anrub]

imho, I would suggest allowing header names with underscore, because, why not? I don't think that some legacy CGI system will be using container apps.

[torosent]

Hi. We are working on a solution to this restriction.

[torosent]

HI @anrub,@onionhammer, @SSilence . The fix is deployed in all regions. We are allowing header names with underscore.

[onionhammer]

HI @anrub,@onionhammer, @SSilence . The fix is deployed in all regions. We are allowing header names with underscore.

Should this issue be marked as closed then?