Host Header Injection Mitigation through Azure Front Door

Question

Hi, we are looking for Host header injection mitigation through Azure Front Door.

Currently Azure Front Door is not able to block request when Host is directly changed from our Frontend/Domain to another site.
We have added some custom rules in our WAF to block the request, but it seems like that request is not even reaching to WAF.

Is there anything that we are missing?

Answer 1

Hello @Tanmay Srivastava ,

I discussed this requirement with our Azure Front Door product group team and below is their response:

Front Door uses the incoming host header as a key to match the customers’ profile. So, invalid host headers won’t be forwarded to the customers’ backend and won’t be processed through WAF.
If there is a more precise scenario the customer is looking to understand here, more information about the specific configuration the customer is using and behavior they expect to see is needed.

So, if you need further information on your specific setup & requirement, I would request you to send us an email as requested in the private message and I will forward the same to the PG team for validation.

Kindly let us know if the above helps or you need further assistance on this issue.

----------------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.