Azure Application Gateway
An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.
1,048 questions
Getting 403 forbidden error when enabling OWASP 3.2 and Enforce request body inspection limit
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(256, 1%, 34%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EUR%3C/text%3E%3C/svg%3E)
Umang Raichura
0
Reputation points
There is one function in my web site to download the documents also i have 182 rules Enabled in prevention (Mode)
Azure Application Gateway
Azure Web Application Firewall
Azure Web Application Firewall
An Azure service that provides protection for web apps.
316 questions
Azure ISV (Independent Software Vendors) and Startups
Azure ISV (Independent Software Vendors) and Startups
Azure: A cloud computing platform and infrastructure for building, deploying and managing applications and services through a worldwide network of Microsoft-managed datacenters.ISV (Independent Software Vendors) and Startups: A Microsoft program that helps customers adopt Microsoft Cloud solutions and drive user adoption.
92 questions
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(217.60000000000002, 24%, 31%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAA%3C/text%3E%3C/svg%3E)
akinbade abiola 15,225 Reputation points2024-08-09T07:40:48.3366667+00:00 Try increasing both the max request body inspection limit and equest body size to match your file upload limit (100 MB or 102400 KB).
You can also WAF logs to see exactly which rules are triggering the 403 errors.
If the above does not work, temporarily switch your WAF to detection mode to see which requests would be blocked without actually blocking them.
You can mark it 'Accept Answer' and 'Upvote' if this helped you
Regards,
Abiola
-
KapilAnanth-MSFT 44,311 Reputation points Microsoft Employee2024-08-09T17:16:17.05+00:00 Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.
As mentioned in our official doc, for CRS 3.2 (on the WAF_v2 SKU) and newer, the WAF request size limits are as follows when using a WAF policy for Application Gateway: 2MB request body size limit.
As next steps,
- Disable "Enforce maximum request body limit" and give it a try (Just for testing)
- If the request passes, this simply means the request body is more than the configurable value, which is 2MB.
Can you please share what happens when you disable the above? Does the request pass through?
Cheers,
Kapil
-
Umang Raichura 0 Reputation points
2024-08-12T07:40:14.9833333+00:00 @KapilAnanth-MSFT
Thankyou for valuable input when i have disabled Enforce maximum request body limit
all things are working fine,
But my condition that on my other environment all 3 are enabled and services are working fine but over there i have not applied OWASP 3.2 rules -
KapilAnanth-MSFT 44,311 Reputation points Microsoft Employee
2024-08-12T08:39:18.8333333+00:00 @Umang Raichura , thanks for the info
- Can you confirm that the "other" environment and the affected environment are serving the same request and are running the same service?
- Can you confirm they are in "Prevention" Mode and not in "Detection"?
- Can you confirm request body inspection is turned on?
- Can you share the exact and complete error message from the WAF logs
Cheers,
Kapil
- Can you confirm that the "other" environment and the affected environment are serving the same request and are running the same service?
-
Umang Raichura 0 Reputation points
2024-08-13T03:58:39.79+00:00 @KapilAnanth-MSFT , Thank you so much your interest
- The only change in the other server is OWASP 3.2 in not implemented.
- The other Environment is in "Prevention Mode"
- I have confirm request body is enabled
Thanks & Regards
Umang -
KapilAnanth-MSFT 44,311 Reputation points Microsoft Employee
2024-08-13T05:00:41.3866667+00:00 Ideally, the other environments without using OWASP 3.2 should also block the requests since the maximum configurable value there is 128 KB.
To troubleshoot further, we will need a specialized 1:1 session, where a support engineer can have a screen share session to pinpoint the issue.
If you have a support plan you may file a support ticket, else please do let us know, we will try and help you get a one-time free technical support.
Cheers,
Kapil
Sign in to comment
Sign in to answer