Table of Contents

Configure and secure the relay

The Function App's settings, managing the access key and the protection measures.

Application settings

Function App, Settings, Environment variables:

Setting Role
SE_SERIAL, SE_API_USER, SE_API_PASSWORD Your licence credentials, or their Key Vault references. Each must be a non-empty GUID.
SE_ENDPOINT Address of the Secure Exchanges service. Production: https://www.secure-exchanges.com/_api/0217/0217.asmx; preview: https://preview.secure-exchanges.com/_api/0217/0217.asmx. Only use one of these two addresses.
SE_DEFAULT_CULTURE Default language of the pages your recipients see, fr-CA or en-CA. fr-CA if absent.
RELAY_PACKAGE_URL Address of the published version file, read by /api/version.
RELAY_EXTRA_API_KEY Optional, not created by the template: see Second key.
AzureWebJobsStorage, DEPLOYMENT_STORAGE_CONNECTION_STRING Access to the storage account, managed by Azure. They contain the storage account key.

The relay reads its configuration once per instance: restart the application after any change, and after rotating a Key Vault secret.

Protect the access key

The key is the Function App's default host key. It is valid for all three routes.

  • Pass it in a header: x-functions-key: <key>, rather than in the address (?code=<key>), which ends up in histories and logs.
  • Restrict who can view the deployments of the resource group: their outputs show it in plain text.
  • Renew it if you suspect a leak: Function App, App keys, default host key, renew. All three routes change key at once: update each tool. The deployment outputs keep showing the old value.

Second key

To require a second key, independent of Azure:

  1. Add the RELAY_EXTRA_API_KEY setting, with a long random value, then restart the application.
  2. In each tool, add the x-relay-key header with that same value.

Any call without this header, or with another value, then receives 401: {"status":401,"error":"Invalid x-relay-key"}. The rule applies to all three routes, /api/version included. The comparison runs in constant time.

Network

The relay applies neither IP address restrictions nor a limit on the number of calls. A leaked key allows consuming your licence up to the instance limit.

  • If your tool calls from fixed, published IP addresses, restrict inbound addresses in the Function App's Networking.
  • The template enforces HTTPS, with TLS 1.2 at minimum.

Logs and personal information

The deployment does not create Application Insights: without it, logs are not kept.

If you add it:

  • choose a Canadian region if your obligations require it;
  • be aware that logs contain the errors returned by Secure Exchanges, which can quote the refused email address or phone number;
  • set a short retention period, in line with your obligations (Quebec's Law 25).

The relay logs neither request bodies nor your credentials.

Remove the relay

Delete the resource group: the Function App, the plan and the storage disappear at once. What remains:

  • the role assignment on your vault, with the Key Vault option: remove it;
  • the Cloud Shell storage, and the relay.zip file the installation left there;
  • the messages and envelopes already created, until they expire.

Your Secure Exchanges licence is not affected.