[AzureMonitorExporter] [AzureMonitorDistro] Harden redirect handling against credential and telemetry leakage

[xiang17]

Background

IngestionRedirectPolicy and LiveMetricsRedirectPolicy followed and cached server-provided redirect targets without validating their trust boundary. When AAD authentication was enabled, this could forward the bearer token and telemetry payload to an attacker-controlled endpoint.

The ingestion redirect could remain cached for up to 12 hours, while the Live Metrics redirect remained active for the policy lifetime.

This change addresses MSRC cases 119714, 123485, and 125643.

Changes

• Add shared validation for redirect destinations.
• Require redirect targets to:
  • be absolute HTTPS URIs;
  • contain no user information;
  • use the default HTTPS port;
  • match a trusted Azure Monitor domain policy.
• Allow ingestion redirects only when:
  • the target has the same host and port as the current endpoint; or
  • both endpoints belong to the same approved Azure Monitor domain suffix.
• Allow Live Metrics redirects only to approved Azure Monitor domains.
• Reject untrusted redirects before mutating the request, replaying telemetry, or updating redirect caches.
• Cache the complete validated Live Metrics authority instead of an unchecked host.
• Preserve support for Azure public, US Government, and China cloud endpoints.
• Preserve same-authority behavior for explicitly configured custom ingestion endpoints.

Rejected redirects are not followed or cached, preventing bearer-token disclosure, telemetry leakage, and persistent redirect cache poisoning.

Testing

Added coverage for both redirect policies, including:

• trusted regional redirects;
• same-origin redirects;
• arbitrary cross-origin targets;
• insecure HTTP targets;
• user-info in redirect URIs;
• non-default ports;
• domain suffix-confusion targets;
• malformed redirect values;
• rejected redirect cache poisoning;
• application of the complete validated Live Metrics authority.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
10 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

This PR hardens Azure Monitor ingestion and Live Metrics redirect handling in Azure.Monitor.OpenTelemetry.Exporter to prevent credential/telemetry leakage via untrusted redirect targets, by validating redirect destinations before replaying requests or updating redirect caches.

Changes:

• Introduces shared redirect destination validation (RedirectPolicyHelper) with an allowlist-based trust boundary and HTTPS/userinfo/port checks.
• Updates IngestionRedirectPolicy and LiveMetricsRedirectPolicy to only follow/cache redirects that pass validation (and to cache the validated Live Metrics authority as a Uri).
• Adds targeted unit test coverage for trusted vs. untrusted redirects (including cache-poisoning scenarios) and updates changelogs.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
sdk/monitor/Azure.Monitor.OpenTelemetry.Exporter/tests/Azure.Monitor.OpenTelemetry.Exporter.Tests/LiveMetricsRedirectPolicyTests.cs	New tests covering trusted Live Metrics redirects, validated authority application, and rejection/non-caching of untrusted/invalid targets.
sdk/monitor/Azure.Monitor.OpenTelemetry.Exporter/tests/Azure.Monitor.OpenTelemetry.Exporter.Tests/IngestionRedirectPolicyTests.cs	Updates existing tests to use trusted Azure Monitor endpoints and adds tests for rejecting/un-caching untrusted/invalid ingestion redirects.
sdk/monitor/Azure.Monitor.OpenTelemetry.Exporter/src/LiveMetrics/Internals/LiveMetricsRedirectPolicy.cs	Validates redirect URI and caches a validated Uri; applies scheme/host/port rather than only host.
sdk/monitor/Azure.Monitor.OpenTelemetry.Exporter/src/Internals/RedirectPolicyHelper.cs	Adds centralized redirect validation logic and trusted domain suffix policy.
sdk/monitor/Azure.Monitor.OpenTelemetry.Exporter/src/Internals/IngestionRedirectPolicy.cs	Validates cached and newly received ingestion redirects against the trust policy before applying or caching.
sdk/monitor/Azure.Monitor.OpenTelemetry.Exporter/CHANGELOG.md	Documents the security hardening under “Bugs Fixed”.
sdk/monitor/Azure.Monitor.OpenTelemetry.AspNetCore/CHANGELOG.md	Notes the redirect hardening in the ASP.NET Core package changelog.