Azure WAF best practice for specific rules

Hello Eddie Vincent,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you need Azure WAF best practice for specific rules.

The Azure WAF best practice for specific rules is the following specific for your scenario:

• Exclude specific rule for specific URI especially for ModSecurity (Apache/Nginx) with OWASP CRS 3.2: SecRule REQUEST_URI "@beginsWith /your/uri" \ "id:10001, phase:1, pass, nolog, ctl:ruleRemoveById=942430"
  • Removes rule 942430 only for /your/uri- https://coreruleset.org/docs/2-how-crs-works/2-3-false-positives-and-tuning/
• Exclude specific parameter from rule: SecRule REQUEST_URI "@beginsWith /your/uri" \ "id:10002, phase:1, pass, nolog, ctl:ruleRemoveTargetById=942430;ARGS:user_id"
  • Removes user_id from rule 942430 - https://stackoverflow.com/questions/78664420/modsecurity-blocks-after-despite-rule-exclusions
• Reduce anomaly score instead of disabling: SecRule REQUEST_URI "@beginsWith /your/uri" \ "id:10003, phase:1, pass, setvar:'tx.anomaly_score=-1'"
  • Reduces score to avoid blocking - https://coreruleset.org/docs/2-how-crs-works/2-3-false-positives-and-tuning/

More so, for Azure WAF with OWASP CRS 3.2:

• Use custom rule to allow specific URI

    MatchVariable: RequestUri
    Operator: Equals
    Value: /smail/page/2
    Action: Allow
  

  • This bypasses all WAF inspection for this URI - https://free.blessedness.top/en-us/answers/questions/1428650/how-to-disable-specific-owasp-3-2-rule-for-a-speci
• Use per-URI WAF policy by:
  • Create a separate WAF policy for /smail/page/2
  • Disable specific rule (e.g., 942430) in that policy
  • Associate policy via path-based routing as you see in this link - https://free.blessedness.top/en-us/answers/questions/1428650/how-to-disable-specific-owasp-3-2-rule-for-a-speci

Also, you need to be aware that, there is limitations:

• Query strings (e.g., ?post=66) are not part of RequestUri
• Cannot exclude based on CookieName, HeaderName, etc. - Check for more lists here: https://free.blessedness.top/en-us/answers/questions/2277818/how-to-add-exclusions-for-restricted-file-access-a

I hope this is helpful! Do not hesitate to let me know if you have any other questions or clarifications.

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful.

Hello @Eddie Vincent,

We haven't heard back from you regarding the last response from Sina Salam and wanted to check if you had the opportunity to review our previous post.

Please "up vote" if the information helped you. This will help us and others in the community as well

Hello @Eddie Vincent,

We haven't heard back from you regarding the last response from Sina Salam and wanted to check if you had the opportunity to review our previous post.

Thank you and apologies for the delay @Ravi Varma Mudduluru

The core of the issue is a little more nuanced than above.

Basically it possible in to access a specific field from a request body and run regex checks against it's value? All our requests are sent to the same endpoint in this specific scenario.

Example below (including link):

Imagine a request body; { "linkToThing": "https://base-url/1234-5678/xyz?=8877" } OWASP rule 12345 might block this request because linkToThing contains the character ? .

Instead of just excluding rule 12345, is it possible to write a 'Custom rule' that knows and allows for values of linkToThing to contain a '?' at position 31, but still check the remainder of linkToThing 's value for ? characters, in a manner similar to 12345?

 Hopefully this makes sense but happy to explain further if required.

Hello @Eddie Vincent

• You have the option to set up a custom rule that permits requests to certain URIs, which will let you bypass the WAF inspection for those specific URIs. This action allows all traffic to that URI without inspection.

MatchVariable: RequestUri
Operator: Equals
Value: /your/specific/uri
Action: Allow

• If you need to exclude specific OWASP rules for certain URIs, you can use ModSecurity rule syntax. For example, to disable rule 942430 for a particular URI. This ensures that the specified traffic is allowed through without being blocked by that rule.

SecRule REQUEST_URI "@beginsWith /your/uri" "id:10001, phase:1, pass, nolog, ctl:ruleRemoveById=942430"

• One option is to set up a separate WAF policy for the specific URI, disable the rules causing issues in that policy, and then link it to the route that processes that URI. This way, you can customize responses for the traffic on those routes.

If turning off rules isn't the best solution, you could also lower the anomaly score for certain URIs, which may help prevent those requests from being blocked.

SecRule REQUEST_URI "@beginsWith /your/uri" "id:10003, phase:1, pass, setvar:'tx.anomaly_score=-1'"

Kindly let us know if the above helps or you need further assistance on this issue.

Please "upvote" if the information helped you. This will help us and others in the community as well.