How to let custom header with period to bypass application gateway

Question

I got a custom header with period which I wanted to let it pass through azure application gateway, is there any configuration I need to setup or modify in order to let the header went through the application gateway. The value for the custom header is dynamic, what should I put for the value?

For eg: custom.header

Answer 1

Hello @August Lim ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you would like to exclude a custom request header from Azure WAF evaluation.

You can configure a WAF exclusion in Application gateway using the Request Header attribute.

To do so, you can use the RequestHeaderValues match variable, the operator contains, and the selector (custom.header). This configuration stops evaluation of all values for the header custom.header.

In contrast, if your WAF detects the header's name (custom.header) as an attack, you could configure an exclusion for the header key by using the RequestHeaderKeys request attribute.

Refer: https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-waf-configuration?tabs=portal#request-attributes-by-keys-and-values

When you configure an exclusion, you need to determine whether you want to exclude the name/key or the value from WAF evaluation.

NOTE: Request attributes by key and values are only available in CRS 3.2 or newer.

Refer: https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-waf-configuration?tabs=portal#request-attributes-by-keys-and-values

The new WAF engine is a high-performance, scalable Microsoft proprietary engine and has significant improvements over the previous WAF engine.

Refer: https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/waf-engine#next-generation-of-waf-engine

If you are using the older WAF engine, I would request you to set the default rule set to OWASP 3.2 and add the above-mentioned exclusion list.

Additional reference for you:

https://learn.microsoft.com/en-us/answers/questions/1369136/exclude-an-url-in-exclution-list-waf-not-work-for

Kindly let us know if the above helps or you need further assistance on this issue.

---

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.