Allow-Access-Control-Origin Error on Web App

@Joseph Dutton ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you are facing CORS error.

It is highly unlikely that App Gateway WAF can lead to CORS error.

• Can you confirm if the issue is not happening without WAF (not App Gateway)
  • Please keep the WAF in Detection Mode and see if this is happening still
• May I ask if the same domain is used to access your WebApp as well as the Application Gateway
  • i.e., what is the FQDN of the service via Application gateway?
  • what is the FQDN of the service while directly accessing it?
• Are you actually using resources from other sites?
  • If so, does the other site has the header? Access-Control-Allow-Origin: *

Cheers,

Kapil

Kapil,

Thank you for your response.

When the WAF is turned off, there is no longer a CORS error popping up. Part of me was wondering if the geolocation match rule is what is causing that Origin Header discrepancy. But I'm unsure if those two have anything to do with the other. I wouldn't think that WAF Policy being turned on would cause all of those errors to just magically pull up. Unfortunately, I'm not too familiar with these specific blades, and I wasn't present when they were configured initially.

From my awareness, the only thing that is changing is that policy being turned on. The primary URL we are using is set up as an Associated listener on the App Gateway.

Nothing has that specific header added into the code. Would adding that Access-Control-Allow-Origin header make a difference here? Why is the WAF policy causing that to trigger? Wouldn't it trigger even if the WAF policy was turned off?

Let me know if I failed to answer any of your questions. Thank you again for all of the help here!

If it would help to jump on a call, I can show you what I can see.

@KapilAnanth-MSFT

@Joseph Dutton ,

Thanks for the information, indeed, this is strange.

As next steps,

• We have to isolate if this is related to WAF as a whole or this specific Geo Match Rule.
• Can you please remove the Geo Match Rule and check with WAF Enabled?
• This way, we will know if this is caused by Geo Match Rule OR by WAF (Managed rules or just the WAF's configuration results in this)

In addition,

• Can you please confirm if there are any logs in Firewall log that indicate "Warning"
  • Specifically for details.message

Cheers,

Kapil

@KapilAnanth-MSFT

Thank you for the notes.

I am currently checking if it's been tested without the custom rule, and should have an answer for you by early next week.

In terms of Firewall logs, I do know logs are enabled, but do you have a KQL query to identify the Firewall logs? It is also disabled at the moment, but when I do something like

AzureDiagnostics
| where Category == "AzureFirewallNetworkRule" or Category == "AzureFirewallApplicationRule"

I cannot see any results. Even with my time range set back 30+ days.

I have ensured that Diagnostic Logs are enabled, as I can see Category == "ApplicationGatewayAccessLogs", but am not seeing anything pertaining to the Firewall. Let me know if there is a better query I should be using here!

Thank you.