5.3 Web Application Firewall (WAF) & Azure Front Door

4.3 Web Application Firewall (WAF) & Azure Front Door

Azure Web Application Firewall (WAF) provides centralized, Layer 7 protection for web applications against common web exploits, vulnerabilities, and malicious bot traffic. WAF policies can be attached to two distinct Azure delivery services: Azure Application Gateway (for regional HTTP/HTTPS load balancing) and Azure Front Door (for global edge content acceleration and routing).

---

Architectural Comparison: Application Gateway WAF vs. Azure Front Door WAF

Selecting the correct WAF deployment model depends on application distribution and traffic entry points:

---

OWASP Top 10 Protection & Core Rule Sets (CRS / DRS)

Azure WAF includes pre-configured, managed rule sets maintained by Microsoft security researchers to guard against the Open Web Application Security Project (OWASP) Top 10 web vulnerabilities.

Primary Threat Categories Defended

• SQL Injection (SQLi): Detects malicious SQL syntax in query parameters, forms, or headers intended to manipulate backend databases.
• Cross-Site Scripting (XSS): Blocks injected client-side scripts in request parameters that execute in end-user browsers.
• Local File Inclusion (LFI) & Remote File Inclusion (RFI): Prevents attackers from forcing web applications to read local server files (/etc/passwd) or execute remote scripts.
• Remote Code Execution (RCE): Blocks system command injection strings targeting operating system shells.
• Protocol Violations & Anomalies: Detects malformed HTTP headers, missing user agents, or HTTP request smuggling patterns.

---

Operational Modes: Detection vs. Prevention

WAF policies run in one of two modes, controlled at the policy level:

1. Detection Mode

• WAF evaluates requests against all active rules and logs detected threats to a Log Analytics workspace.
• Does NOT block traffic. All requests are forwarded to the backend application regardless of rule matches.
• Mandatory Use Case: Always deploy new WAF policies in Detection mode during initial onboarding. Analyze log telemetry over a 1–2 week baseline to identify legitimate application traffic flagged as false positives before switching to Prevention mode.

2. Prevention Mode

• WAF evaluates requests against active rules.
• When a request triggers a rule match, WAF immediately drops the request and returns an HTTP 403 (Forbidden) status code to the client.
• The block action and matching rule ID are logged to diagnostic streams.

---

False Positive Tuning & WAF Exclusion Lists

In production web applications, legitimate complex requests (e.g., rich text editor inputs containing HTML tags or JSON payloads containing SQL-like keywords) may trigger WAF rule false positives.

Anti-Pattern to Avoid

Do NOT disable an entire rule group (such as SQLI or XSS) to fix a single false positive. Disabling entire rule groups creates severe security vulnerabilities.

Recommended Remediation Methods

1. WAF Exclusion Lists: Exclude specific request attributes from rule evaluation while maintaining protection across all other parameters.
   • Supported Match Targets: Request Header names, Request Cookie names, Query String parameter names, Request Body attribute names.
   • Example: If an admin portal sends HTML content in a request body field named articleContent, create an exclusion for Request Body Attribute Name Equals articleContent. WAF will ignore articleContent while continuing to inspect all other body fields.
2. Custom Rules with Allow Actions: Create high-priority custom rules that permit traffic from trusted IP ranges or specific API endpoints before Core Rule Sets are evaluated.

---

Custom Rules & Bot Protection Engine

Custom WAF Rules

Custom rules are evaluated prior to managed Core Rule Sets. Common custom rules include:

• Geo-Filtering Rules: Allow or block incoming traffic based on two-letter country codes (e.g., block inbound web traffic originating outside corporate operating regions).
• IP Match Rules: Create explicit Allow CIDR lists for administrative endpoints or Deny CIDR lists for known malicious networks.
• Rate Limiting Rules: Prevent Denial of Service (DoS) and brute-force attacks by limiting the number of requests allowed from a single client IP address within a 1-minute or 5-minute window.

Bot Protection Engine

The managed Bot Protection engine integrates with Microsoft Threat Intelligence feeds to categorize incoming request traffic:

• Good Bots: Search engine crawlers (Google, Bing) allowed through without friction.
• Bad Bots: Malicious web scrapers, credential-stuffing tools, vulnerability scanners, and known command-and-control IPs automatically blocked or challenged.
• Unknown Bots: Uncategorized automated traffic evaluated against standard rate-limiting and custom rules.

---

TLS Termination & End-to-End Encryption

WAF appliances serve as the primary entry point for HTTPS traffic and manage transport layer security policies:

• TLS Termination: WAF decrypts incoming HTTPS client traffic, performs deep packet payload inspection against WAF rule sets, and routes plain HTTP or re-encrypted HTTPS traffic to backend pools.
• End-to-End TLS Encryption: For high-compliance environments, WAF inspects traffic at Layer 7 and re-encrypts the request using a new TLS session to the backend web servers, validating backend server certificates against approved Root CA pools.
• TLS Protocol Enforcement: WAF policies can enforce minimum TLS protocol versions (disabling deprecated TLS 1.0/1.1 and requiring TLS 1.2 or TLS 1.3) and restrict cipher suites to modern forward-secrecy standards.