Front door 404 error

Marco Tulio Nuñez Escobedo 40

I have a problem with my frontdoor, whenever i enter to my urls

https://example.z01.azurefd.net/

or my custom domain

https://customdomain.custom.com/

i'm getting 404 error

User's image

i don't see any problem, can anyone help me?

My custom domain

User's image

my route

User's image

My origin (wich points to my app service)

User's image

My route

User's image

GitaraniSharma-MSFT 49,001 Reputation points Microsoft Employee

2023-03-31T08:27:48.36+00:00

Hello @Anonymous ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you are getting error 404 when accessing your Azure Front Door default or custom domain URL.

From the first screenshot, I believe you are using an Azure app service in the backend of your Azure Front Door. May I know if you have a custom domain configured on your App service?

How is the origin configured in the AFD? What is the origin type, host name & host header? Also how is the health probe configured?

Regards,

Gita
Marco Tulio Nuñez Escobedo 40 Reputation points

2023-03-31T16:12:52.61+00:00

Hello @GitaraniSharma-MSFT

Yes, i'm using an azure app service, and no, i don't have a custom domain on my app service, i had one, but i removed it and put it on the front door.

Origin type: app service

host name: the url of the app service

i didn't set a host header because i want to stay on my custom domain

Edit: for more information, my custom domain CNAME is pointing to the front door generated URL
Ed Harris 25 Reputation points

2023-03-31T20:09:08.23+00:00

Did you set up your networking/firewall rules for the ports you want exposed?
Marco Tulio Nuñez Escobedo 40 Reputation points

2023-03-31T20:54:50.2933333+00:00

@Ed Harris I don't have any IP restrictions/firewall on the app service
Ed Harris 25 Reputation points

2023-03-31T21:58:19.9033333+00:00

Of course you do! Azure follows the principle of zero trust, so you must have set up the routing rules in the firewall to allow the traffic. Otherwise it's restricted.

Please refer to https://video2.skills-academy.com/en-us/azure/frontdoor/front-door-overview and check out the piece on security. By default you're behind a solid as rock firewall of zero trust. Also https://video2.skills-academy.com/en-us/azure/web-application-firewall/afds/afds-overview details setting up the rules you need.
Marco Tulio Nuñez Escobedo 40 Reputation points

2023-03-31T22:30:45.5066667+00:00

I'm not sure, i configured two connection points, one for my front-end and one for my back-end, i configured them exactly the same, and my backend it's working correctly.

Anyways i've setted my WAF to detection mode instead of prevent mode just in case that my WAF was blocking my requests, but it still showing 404 page
Marco Tulio Nuñez Escobedo 40 Reputation points

2023-03-31T22:34:40.63+00:00

Duplicated coment
GitaraniSharma-MSFT 49,001 Reputation points Microsoft Employee

2023-04-03T13:42:32.8266667+00:00

@Anonymous , Just checking in to see if you had a chance to see the below answer. To help the community find the right answers, please do mark the post which was helpful by clicking on Accept Answer.

And, if you have any further questions do let us know.

Accepted answer

GitaraniSharma-MSFT 49,001 Reputation points Microsoft Employee

2023-04-01T04:46:07.37+00:00

Hello @Anonymous ,

I understand that you are getting error 404 when accessing your Azure Front Door default or custom domain URL.

From your screenshots, I can say that the root cause of your issue is the empty origin host header.

Let us first understand what origin host header does. Requests that are forwarded by Azure Front Door to an origin will include a host header field that the origin uses to retrieve the targeted resource.

For example, a request made for www.contoso.com will have the host header www.contoso.com. If the request was made for www.contoso.com, and your origin contoso-westus.azurewebsites.net has an empty header field, Front Door will set the host header as www.contoso.com.

Most app backends (Azure Web Apps, Blob storage, and Cloud Services) require the host header to match the domain of the backend. However, the frontend host that routes to your origin will use a different hostname such as www.contoso.net.

If your origin requires the host header to match the origin hostname, make sure that the origin host header includes the hostname of the origin.

Refer: https://video2.skills-academy.com/en-us/azure/frontdoor/origin?pivots=front-door-standard-premium#origin-host-header

You are using Azure App service as your backend, and you also mentioned that there is no custom domain configured on your App service. Now, if the origin host header is kept empty, the AFD will forward the request including a host header as your custom domain, but it is not configured on your App service and hence it will not match with your App service domain and eventually fail with 404 not found error. Because the App Service doesn't recognize the custom domain and rejects all incoming requests for this host name. It can't determine where to route the request.

The point that you mentioned "I didn't set a host header because I want to stay on my custom domain" only applies when you've the custom domain configured on your App service as well.

Refer: https://video2.skills-academy.com/en-us/azure/architecture/best-practices/host-name-preservation#implementation-guidance-for-common-azure-services

If you don't configure the custom domain in your backend and just keep the Azure Front Door origin host header empty, it just overrides the host name, which can lead to various issues as described in the below section:

https://video2.skills-academy.com/en-us/azure/architecture/best-practices/host-name-preservation#why-you-might-be-tempted-to-override-the-host-name

The proper guidance here is to make sure you configure both the backend and AFD to preserve the host name. And to do so, you need to configure the custom domain in your App service and then keep the Azure Front Door origin host header empty. This way, when the AFD sends the request with the custom domain, the App service will be able to recognize the incoming request with the host name and will accept it without any issues.

To fix this issue, you can either add the origin host header as your App service URL.

OR

Configure the custom domain in your App service and keep the rest of configuration as it is.

Kindly let us know if the above helps or you need further assistance on this issue.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.

2 people found this answer helpful.
Hendrik Bulens 6 Reputation points

2023-07-20T08:17:14.5566667+00:00

@GitaraniSharma-MSFT , does this recommendation also work when there are multiple app services in the origin group? Adding a custom domain to multiple app services doesn't work, and removing the host header in the origin causes a 404. Keeping the host header the same as the host name causes the system to use the app services' URIs rather than the custom domain.

GitaraniSharma-MSFT 49,001 Reputation points Microsoft Employee

2023-07-21T14:35:05.18+00:00

Hello @Hendrik Bulens , although I have not tested this in my lab, I've seen customers using the same custom domain on 2 App services.

You just need to make sure that the 2nd App service is deployed into a different webspace from the 1st one. For that, you need to create a new Resource Group and a new App service Plan, then you can create the specific App Service and add the same custom domain.

Refer: https://video2.skills-academy.com/en-us/answers/questions/1198467/frontdoor-two-app-services-with-same-domain

https://video2.skills-academy.com/en-us/answers/questions/202552/running-same-custom-domain-in-different-azure-app

https://video2.skills-academy.com/en-us/azure/app-service/app-service-plan-manage#move-an-app-to-another-app-service-plan

Could you please try this and let me know if it works?

Regards,

Gita

Hendrik Bulens 6 Reputation points

2023-08-08T16:05:06.27+00:00

I could solve the issue by adding a TXT DNS record with the value of the 'Custom Domain Verification ID', and then it seemed to work. This value, in my case, is the same for the two app services (which are hosted on two different app plans across regions), so it works out perfectly.

Rick Rader 0 Reputation points

2024-06-19T12:54:17.4466667+00:00

Can you please elaborate on this step you mentioned to help clarify, "The proper guidance here is to make sure you configure both the backend and AFD to preserve the host name. And to do so, you need to configure the custom domain in your App service and then keep the Azure Front Door origin host header empty."

GitaraniSharma-MSFT 49,001 Reputation points Microsoft Employee

2024-06-28T13:34:55.9666667+00:00

Hello @Rick Rader ,

Apologies for the delay in response.

Preserving the host name in both backend and AFD (Azure Front Door) means to use the same domain in both Azure Front Door endpoint and your backend application.

Having a different host name at the Azure Front Door than the one that's provided to the back-end application server can lead to cookies or redirect URLs that don't work properly. It could lead to issues such as session state getting lost, authentication fail, or back-end URLs inadvertently being exposed to end users

You can avoid these problems by preserving the host name of the initial request so that the application server sees the same domain as the web browser.

For example: If you have a custom domain contoso.com configured in Azure Front Door, ensure that the same custom domain contoso.com is also configured in the backend web application. This way, when a client type contoso.com in the browser to access the Azure Front Door, the Azure Front Door forwards the host header contoso.com to the backend web application. The web application, recognizing the host name contoso.com configured in its custom domain settings, will accept the request without any issues.

For more information on host name preservation, you can refer the below doc:

https://video2.skills-academy.com/en-us/azure/architecture/best-practices/host-name-preservation

Regards,

Gita

Rick Rader 0 Reputation points

2024-06-28T14:01:55.1066667+00:00

I was able to accomplish having the custom domain in both the Origin host header and the backend, however we started seeing very high latency issues. I also had Advisor list out 2 potential alerts in regards to AFD.

Use the same domain name on Front Door and your origin (even though it was set)

Validate domain ownership by adding DNS TXT record to DNS provider
Sign in to comment

0 additional answers