how to ignore specific owasp rule for a specific URI in azure waf v2

VS 0

Need to ignore specific owasp rule for a specific url endpoint.

GitaraniSharma-MSFT 49,591 Reputation points Microsoft Employee

2023-07-21T14:42:57.7033333+00:00

@VS , Just checking in to see if you had a chance to see the below answer. To help the community find the right answers, please do mark the post which was helpful by clicking on Accept Answer.

And, if you have any further questions do let us know.

1 answer

GitaraniSharma-MSFT 49,591 Reputation points Microsoft Employee

2023-07-11T14:13:51.46+00:00
Hello @VS ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you would like to ignore specific OWASP rules for a specific URL endpoint in your Azure WAF v2 associated with your Application gateway.

You can use Web Application Firewall Policies which contain all the WAF settings and configurations. This includes exclusions, custom rules, managed rules, and so on. WAF policy associations are only supported for the Application Gateway WAF_v2 SKU.

Azure Web Application Firewall (WAF) policy can be associated to an application gateway (global), a listener (per-site), or a path-based rule (per-URI) for them to take effect. It can be associated with any combination of application gateways, listeners, and path-based rules. So, there are 3 types of WAF policy associations:

Global WAF policy: When you associate a WAF policy globally, every site behind your Application Gateway WAF is protected with the same managed rules, custom rules, exclusions, and any other configured settings.

Per-site WAF policy: With per-site WAF policies, you can protect multiple sites with differing security needs behind a single WAF by using per-site policies.

Per-URI policy: For even more customization down to the URI level, you can associate a WAF policy with a path-based rule.

By default, with WAF policies, more specific policies override less-specific ones. This means a per-URI policy on a URL path map overrides any per-site or global WAF policy above it. If there's a global policy, and a per-site policy (a WAF policy associated with a listener), then the per-site policy overrides the global WAF policy for that listener. Other listeners without their own policies will only be affected by the global WAF policy.

Refer: https://video2.skills-academy.com/en-us/azure/web-application-firewall/ag/policy-overview

https://video2.skills-academy.com/en-us/azure/web-application-firewall/ag/per-site-policies

So, you can associate different WAF policies to your listeners or path-based rule and disable the specific OWASP rule or create exclusions/custom rules for that specific listener or path-based rule.

For example: If you have 2 sites - abc.com and xyz.com behind your Application gateway WAF v2 and you have a policy XYZ associated to the whole application gateway and there is another WAF policy ABC associated with the abc.com listener, then your site abc.com will use policy ABC and xyz.com will use policy XYZ, without being affected by policy ABC. In this way, you can ignore specific QWASP rule for a specific URL endpoint by configuring the required settings within the associated WAF policy.

Kindly let us know if the above helps or you need further assistance on this issue.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.
VS 0 Reputation points

2023-07-11T14:23:02.7266667+00:00

I have only one site. I want to exclude a specific endpoint under this site, for example http://mysite/getsales, to not have any OWSAP 942430 rule executed. Rest all endpoints still should be monitored for this rule. How to configure this?

GitaraniSharma-MSFT 49,591 Reputation points Microsoft Employee

2023-07-11T15:13:37.97+00:00

Hello @Vikramaditya Shekhawat ,

How is your site configured? Is it with one listener and multiple path-based rules to direct specific paths to specific backend pools?

For example, for your site URL, http://mysite/getsales, do you have a path-based rule with /getsales configured on your Application gateway?

Refer: https://video2.skills-academy.com/en-us/azure/application-gateway/url-route-overview

If you've configured /getsales as a path-based rule, then you can create and associate a WAF policy to that path-based rule using the Per-URI policy.

This way, the OWSAP 942430 rule will only be disabled for /getsales path and will still be executed for the main site and all other paths.

Refer: https://video2.skills-academy.com/en-us/azure/web-application-firewall/ag/per-site-policies

Regards,

Gita

VS 0 Reputation points

2023-07-12T06:54:00.4166667+00:00

No, there is no path based rule on gateway.

GitaraniSharma-MSFT 49,591 Reputation points Microsoft Employee

2023-07-13T14:46:20.96+00:00

Hello @Vikramaditya Shekhawat ,

If you don't have path-based rules distinguishing the paths, then you can use WAF exclusion lists or custom rules.

You can configure an exclusion list for a specific rule, group of rules, or rule set. You must specify the rule or rules that the exclusion applies to. But exclusion lists do not support hostname or requesturi attributes.

Custom rules support requesturi attribute but it will not give you the flexibility to ignore specific OWASP rule. It will bypass the WAF completely, if allowed.

So, if you could share the WAF log which is showing this URI to be blocked, I can help you create an exclusion list or custom rule based on the same.

Regards,

Gita

VS 0 Reputation points

2023-07-14T08:44:08.3633333+00:00

Thanks. We already have WAF exclusion and custom rules. But, we wanted to have something which can provide both, uri based and OWASP rule based exclusions.

GitaraniSharma-MSFT 49,591 Reputation points Microsoft Employee

2023-07-14T15:26:48.2233333+00:00

Hello @Vikramaditya Shekhawat ,

As of today, you can configure a WAF exclusion for the following supported request attributes:

Request headers

Request cookies

Request attribute name (args) can be added as an exclusion element, such as:

Form field name

JSON entity

URL query string args

Hostname attribute is not supported yet but it is in our long-term roadmap (No ETA as of yet).

If you need to exclude a hostname or requesturi, then custom rules should be created.

Or if you have path-based rules, then you could create and associate a WAF policy to that path-based rule using the Per-URI policy.

Currently, these are the only available options in Azure WAF.

Regards,

Gita

VS 0 Reputation points

2023-09-07T07:13:43.6833333+00:00

The proposed solution appears to be somewhat unwieldy. Creating distinct policies for individual URIs, especially when there are approximately 5-10 URIs that require specific policies, can lead to a substantial maintenance burden. Furthermore, if a global exclusion needs to be applied, it would necessitate replicating the exclusion across all 5-10 policies each time, which adds to the administrative overhead.

GitaraniSharma-MSFT 49,591 Reputation points Microsoft Employee

2023-09-07T13:06:32.7933333+00:00

Hello VS,

Creating distinct policies for individual URIs --> This solution is only recommended when you've path based rules and you would like to add different rules & exclusions based on different paths.

Refer: https://video2.skills-academy.com/en-us/azure/web-application-firewall/ag/policy-overview#per-uri-policy

However, you mentioned that you have only one site and you want to exclude a specific endpoint under this site, for example http://mysite/getsales, to not have any OWSAP 942430 rule executed but rest all endpoints still should be monitored for this rule.

As of today, the above requirement can only be achieved using custom rules.

You can create 1 custom rule with match variable Request URI and add up to 10 match values or URIs in that rule to allow/block it.

I've already shared the feedback with the Azure WAF Product Group team requesting the feature of URI based OWASP rule exclusions and they've confirmed that it is in our long-term roadmap (No ETA as of yet).

I would also request you to upvote this existing feature request in the below feedback forum:

https://feedback.azure.com/d365community/idea/60cfcfda-502f-ed11-a81b-000d3ae3db6e

All the feedback you share in these forums will be monitored and reviewed by the Microsoft engineering teams responsible for building Azure.

Regards,

Gita

VS 0 Reputation points

2023-09-07T13:17:17.5133333+00:00

Thank you for the suggestion. However, the custom rule solution mentioned above is not a suitable workaround. It would effectively bypass all rules for the configured URI. Therefore, at the moment, there is no viable solution or workaround available until the requested feature is implemented.

GitaraniSharma-MSFT 49,591 Reputation points Microsoft Employee

2023-09-07T14:54:07.6233333+00:00

Hello @VS ,

Yes, I understand your requirement and would try to get this feature request pushed further with the PG for quicker implementation.

Regards,

Gita
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

how to ignore specific owasp rule for a specific URI in azure waf v2

1 answer

Your answer