[azure-core] Warn when an LRO poll target host differs from the client's endpoint

[Anna Tchijova (annatchijova)]

Summary

Long-running-operation (LRO) polling reads the next poll URL from a service response header (Operation-Location / Azure-AsyncOperation / Location) and sends that GET through the client's credentialed pipeline (LROBasePolling.request_status, sync and async). There is no check that the poll target host matches the host the client was configured for, so when the response names a different host, the poll request carries the client's credentials (API key or bearer token) to that host.

SensitiveHeaderCleanupPolicy already strips sensitive headers on cross-domain 3xx redirects, but the LRO poll target reaches a new host without a 3xx redirect, so that policy does not cover this path.

Change

Add a defense-in-depth warning (it does not block the request) in both the sync and async request_status paths when the poll target host differs from the initial request host, reusing the existing get_domain helper for the comparison.

• Same-host poll targets and relative (no-host) targets are quiet.
• The warning names both hosts so operators can see when credentials would go to an unconfigured host.

_LOGGER.warning(
    "Long-running-operation poll target host '%s' differs from the client's configured "
    "endpoint host '%s'. The poll request carries the client's credentials to that host. ...",
    poll_domain, initial_domain,
)

Why a warning, not a block (question for maintainers)

I deliberately left this as a warning rather than a hard block or a credential strip. A raise-on-mismatch broke 16 existing test_base_polling tests, because several fixtures configure the client on one host (http://example.org) while the Operation-Location/Location header points to another (http://dummyurl...). That could be test-only sloppiness, or it could reflect services that legitimately poll a different host — I can't tell from outside.

Question: Is credentialed cross-host LRO polling ever legitimate for shipping Azure services (regional/failover endpoints, sovereign clouds, private endpoints, Traffic-Manager-fronted services)? If not, this could be escalated to strip the credential (mirroring SensitiveHeaderCleanupPolicy) or reject the poll. I kept it non-breaking so the decision — which needs the service inventory only Microsoft has — stays with you.

Testing

• New test_warn_on_cross_host_poll_target_warns_only_when_host_differs: warns on cross-host; quiet on same-host, same-host-with-port, and relative targets.
• Existing test_base_polling suite unchanged (no fixtures needed rewriting, since this does not block). pylint 10.00/10 on the changed modules.

Context

Reported privately to MSRC (assessed None severity / defense-in-depth; host-validation gap acknowledged). Filing this as a public hardening improvement per that assessment.

[github-actions]

Thank you for your contribution Anna Tchijova (@annatchijova)! We will review the pull request and get back to you soon.

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).
5 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

Adds defense-in-depth warnings for credentialed cross-host LRO polling.

Changes:

• Warns in synchronous and asynchronous polling paths.
• Documents the behavior and adds host-comparison tests.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
base_polling.py	Implements warning logic and sync integration.
async_base_polling.py	Adds async integration.
test_base_polling.py	Tests warning behavior.
CHANGELOG.md	Documents the hardening change.

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.