Azure CDN is throwing 421 HTTP Error on Safari

Fredrik 0

Hi,

We're currently proxying traffic to our Azure B2C sign in pages through a Azure Front Door Premium CDN.

However, it seems unstable for users using safari (any version). It's common that they receive a HTTP 421 response instead of the intended content.

It worked fine before we switched to a new front door instance (the old one was created ~2 years ago.

Any suggestions how we can solve this?

Deepanshukatara-6769 8,940 Reputation points

2024-08-30T06:44:37.5333333+00:00
Hello , Welcome to MS Q&A

I think Yes it is related to that and I can we have solution provided in the same link thread shared by you i.e https://video2.skills-academy.com/en-us/answers/questions/1195861/azure-cdn-is-throwing-421-http-error-on-mobile-web

So, basically When Front Door blocks a request due to a mismatch:

The client receives an HTTP "421 Misdirected Request" error code response.

Azure Front Door logs the block in the diagnostic logs under the "Error Info" property with the value SSLMismatchedSNI.

If you would like to turn off the domain fronting feature (which could be blocking your HTTP/HTTPS requests and throwing 421 error), please create a support request via Azure portal and request for the same. This has resolved the issue for customers in the past.

Please let me know if any further questions

Kindly accept answer if it helps

Thanks

Deepanshu
Fredrik 0 Reputation points

2024-08-30T08:48:06.92+00:00

Hi,

I've actually reached out using the support ticket feature, and was directed to mailing the AzCommunity@microsoft.com email. However, when I did that they told me to submit a topic here in order to get help, since the linked thread was considered "too old"..

We would like to turn off the domain fronting feature.
Deepanshukatara-6769 8,940 Reputation points

2024-08-30T10:23:23.1266667+00:00

Following up to see if the provided answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Fredrik 0 Reputation points

2024-08-30T10:48:52.83+00:00

Hi,

No, it doesn't solve the issue, please read my first reply:

I've already submitted a ticket and they told me to write here ultimately.
KapilAnanth-MSFT 44,311 Reputation points Microsoft Employee

2024-09-02T11:36:48.4233333+00:00
@Fredrik ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I see Deepanshukatara-6769 has addressed your queries, that this is related to Azure Front Door Domain Fronting.

Can you confirm if you were redirected to Microsoft Q&A after creating a Support Incident? By a Support Engineer?

If so, I have initiated a private conversation - kindly share the Support Request Number

or

You were redirected here from the Portal's suggestions?

This is just a suggestion from Portal and you should be able to ignore this and raise a support incident without any issue (provided you have an active support plan)

I think this is the recommendation steps you have mentioned and in order to continue to create a support request you have to select Return to support request, then select Next. More information can be found here.

Moreover,

I would suggest you to update your application so that they are compliant rather than disabling Domain Fronting behavior

If you have a specific business requirement for the SNI and host header to be mismatched, you need to configure them properly on Azure Front Door.
Please refer to the steps in the How does domain fronting block work on Azure Front Door and Azure CDN Standard from Microsoft (classic)?

Cheers,

Kapil

Share via

Azure CDN is throwing 421 HTTP Error on Safari

Your answer