Search code examples
azureazure-front-doorazure-waf

Azure Frontdoor WAF policy is blocking requests even though I have rule disabled

I have a Microsoft.Network/FrontDoorWebApplicationFirewallPolicies@2019-10-01 policy for my web app. I pass in a token via the URL for some requests and sometimes this token has a double hyphen -- which means that Azure thinks this is a SQL injection attack.

I have tried disabling that rule that's causing it but the request still gets blocked. enter image description here

So you can see in the photo that it tells me in Azure portal which rule is responsible for blocking my request.

So this is the resource I have and I have tried a few different things in attempt to fix this issue but this is the last thing I have tried.

resource wafPolicy 'Microsoft.Network/FrontDoorWebApplicationFirewallPolicies@2019-10-01' = {
  name: wafPolicyName
  location: frontdoorLocation
  tags: tags
  properties: {
    policySettings: {
      mode: 'Prevention'
      enabledState: 'Enabled'
    }
    managedRules: {
      managedRuleSets: [
        {
          ruleSetType: 'DefaultRuleSet'
          ruleSetVersion: '1.0'
          ruleGroupOverrides: [
            {
              ruleGroupName: 'SQLI'
              rules: [
                {
                  ruleId: '942200'
                  enabledState: 'Disabled'
                  action: 'Block'
                }
                {
                  ruleId: '942440'
                  enabledState: 'Disabled'
                  action: 'Allow'
                }
              ]
            }
          ]
          exclusions: [
            {
              matchVariable: 'RequestCookieNames'
              selectorMatchOperator: 'Equals'
              selector: 'access-token'
            }
          ]
        }
      ]
    }
  }
}

So I set rule 942440 to ALLOW instead of BLOCK and it still blocks the request. What am I missing? How can the request still be blocked?

Does it have something to do with enabledState?

Solution

  • You can try to create exclusion for the specific query string against SQL injection rules. This is a safer way for the purpose which you mentioned. See documentation here https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-waf-configuration?tabs=portal