WAF rules for blocking high number of query string param values

Question

I'd like to block thousands of values of a query string parameter for a certain URL in Azure Front Door Premium Tier.

My understanding is that this is best done by adding WAF custom rules.

I have created custom rules with two matching conditions, one for the RequestUri and another for QueryString with a Regex operator of the form "id=(value1|value2|....)([&#\s]|$)".

My issue is that I need to block thousands of ID values and aligning them into rules with a single regex of max length 256 characters will exceed the limit of 100 rules per WAF policy. I'm also concerned about the performance of traversing such a high number of regexes for each hit.

Is there an alternative way of doing the blocking that would suit my needs?

UPDATE: additionally, when trying to set up multiple rules like this, I'm getting the error "Policy exceeds 5 regular expressions". I can't see this kind of limit documented in AFD service limits - what's going on here?

Answer 1

Hi @metalheart ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
I understand that you are trying an add a large number of Custom regex rules to an AFD WAF Policy.

At present, a single WAF policy supports only up to 5 Custom rules with regular expressions.

Addressing your question,

• Users should be able to configure as many rules as the Limits support.
• WAF on AFD is a global and centralized solution, so there shouldn't be any performance issues.
• Refer: https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/afds-overview
• With your requirement of having to block thousands of values, you will hit the limits.

One solution I can think of is, if the IDs are GUIDs, or are similarly long/unique, then use the Contains operator instead of Regex and add each id=GUID string as a separate match value. The idea here is that you will have more options

Thanks,
Kapil

----------------------------------------------------------------------------------------------------------------

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.