azureazure-front-doorazure-waf

Allow a custom content-type in Azure Front Door WAF without bypassing rules

We have an application that uses application/merge-patch+json extensively for PATCH requests. When it is deployed behind Azure Front Door, the firewall complains that the content type is not allowed by the policy (see screen shot).

WAF screen shot

This is a blocker (literally if the firewall is in blocking mode). I have been able to find some workarounds:

  1. Disable the offending rules in the WAF
  2. Create exclusions for content-type, allowing the requests
  3. Create manual rules allowing requests with this content type

Unfortunately, all these options are bad, as they bypass the firewall. Ideally, I would like to update the policy to add application/merge-patch+json as one of the content types that should be allowed. Then all the firewall rules still get to run.

Is there a way to do this, or are the allowed content types hard-coded by Microsoft?

Solution

  • Is there a way to do this, or are the allowed content types hard-coded by Microsoft?

    AFAIK, Azure WAF’s managed rule sets (based on the OWASP Core Rule Set) do not support extending or customizing the list of allowed Content-Typevalues for rules like 920300. These rules are hard-coded by Microsoft in alignment with OWASP, so there is no way to add application/merge-patch+jsonto the allowed content types list used by Azure WAF’s managed rules.

    Alternatively, if you want your app to function without fully bypassing the firewall, the best compromise is to add an exclusion for rule 920300 (or 920440), scoped only to the Content-Type header with the value application/merge-patch+jsonThis approach offers the below benefits:

    Reference: What content types does WAF support?

    https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-crs-rulegroups-rules?tabs=drs21%2Cowasp30#tuning-of-managed-rule-sets