Best Approach to Restrict Browser Access to Azure Web App Services' Backend while Permitting Front-end and API Requests through Application Gateway with WAF

sindhu sneha 150 Reputation points
2023-11-01T07:14:08.81+00:00

We have a setup consisting of Azure Web App Services for both front-end and back-end operations, integrated with an Application Gateway and a single Web Application Firewall (WAF) configured in a multitenant environment. Our primary concern is restricting direct browser access to the back-end service while ensuring that requests originating from the front-end, including API requests, are allowed through.

Could you advise on the best method to accomplish this within our existing configuration? We aim to maintain security by preventing browser access to the back-end services while ensuring the necessary flow of traffic between the front-end and the APIs.

Any guidance, specific configurations, or recommended approaches would be greatly appreciated.

Thanks

Azure Application Gateway
Azure Application Gateway
An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.
1,003 questions
Azure Web Application Firewall
Azure App Service
Azure App Service
Azure App Service is a service used to create and deploy scalable, mission-critical web apps.
7,288 questions
Accepted answer
  1. GitaraniSharma-MSFT 49,261 Reputation points Microsoft Employee
    2023-11-01T13:04:36.57+00:00

    Hello @sindhu sneha ,

    Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

    I understand that you would like to know the best approach to restrict direct access to Azure app service backend while permitting frontend and API requests through Application Gateway with WAF.

    To restrict direct access to your backend app service, you can refer the below recommended options:

    Refer: https://video2.skills-academy.com/en-us/azure/application-gateway/configure-web-app?tabs=customdomain%2Cazure-portal#restrict-access

    You can configure other access restrictions or whitelist other IPs or service tags depending upon your exact requirement.

    Refer: https://video2.skills-academy.com/en-us/azure/app-service/app-service-ip-restrictions?tabs=azurecli#set-a-service-tag-based-rule

    Kindly let us know if the above helps or you need further assistance on this issue.

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest