I got Access denied with code 403 (phase 2). Match of \"eq 0\" against \"MULTIPART_UNMATCHED_BOUNDARY\" required. at app-gateway at WAF with ruleId_s = 200004 when I tried to upload screenshot to my server. I found some answer at stackoverflow from below. https://stackoverflow.com/questions/72322174/waf-200003-multipart-request-body-strict-validation I can't find official answer from Microsoft. Is it false positive ? Should I disable the rule at WAF?

Hello @Ko Ko Tun , Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well. I understand that you are getting an "Access denied with code 403 (phase 2). Match of \"eq 0\" against \"MULTIPART_UNMATCHED_BOUNDARY\" required" error in Application gateway WAF logs with ruleId_s = 200004 when you try to upload screenshots to your server. I checked with the Application gateway WAF Product Group team and below is their update: Yes, this is a known issue, and we are in process of rolling out a fix. Workaround to disable this rule is reasonable for time being. This bug/known issue is being tracked internally and a fix will be rolled out soon. Kindly let us know if the above helps or you need further assistance on this issue. Please " Accept the answer " if the information helped you. This will help us and others in the community as well.

Access denied with code 403 (phase 2). Match of \"eq 0\" against \"MULTIPART_UNMATCHED_BOUNDARY\" required. WAF 200004

Accepted answer

GitaraniSharma-MSFT 49,696 Reputation points Microsoft Employee

2022-11-17T12:22:44.72+00:00

Hello @Ko Ko Tun ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you are getting an "Access denied with code 403 (phase 2). Match of \"eq 0\" against \"MULTIPART_UNMATCHED_BOUNDARY\" required" error in Application gateway WAF logs with ruleId_s = 200004 when you try to upload screenshots to your server.

I checked with the Application gateway WAF Product Group team and below is their update:

Yes, this is a known issue, and we are in process of rolling out a fix. Workaround to disable this rule is reasonable for time being.

This bug/known issue is being tracked internally and a fix will be rolled out soon.

Kindly let us know if the above helps or you need further assistance on this issue.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.

1 person found this answer helpful.
Narendra Negi 1 Reputation point

2022-11-23T08:12:12.317+00:00

@GitaraniSharma-MSFT

I am also getting the same error when uploading more than 1.4 MB zipped file(csv, txt) with "multipart/form-data" content
type via post request and we are using v2 WAF gateways which supports max 750 MB.
Is this belongs to same known issue or anything need to be done from my side?

GitaraniSharma-MSFT 49,696 Reputation points Microsoft Employee

2022-11-24T12:10:14.367+00:00

Hello @Narendra Negi ,

Yes, this belongs to the same known issue and the workaround is to disable this rule for time being.

Regards,
Gita

Narendra Negi 1 Reputation point

2022-11-24T12:59:18.487+00:00

@GitaraniSharma-MSFT

How will I get to know the update that this issue is fixed. So that I can enable that rule back and it should work as
expected.

GitaraniSharma-MSFT 49,696 Reputation points Microsoft Employee

2022-11-25T16:47:01.89+00:00

Hello @Narendra Negi ,

I will update this thread once we have a confirmation from the PG team on the bug fix.

Regards,
Gita

GitaraniSharma-MSFT 49,696 Reputation points Microsoft Employee

2022-12-27T18:51:24.957+00:00

Hello @Narendra Negi ,

A fix for this rule has been rolled out.

However these rules are still expected to have some False Positives, so if you are facing an issue, then recommendation should be disabling the rule or adding exclusions.

The bug fix was more towards having parity between ModSec and Azure WAF, which is present now.

Regards,
Gita

Sathish Kumar Arumugam 0 Reputation points

2023-06-21T05:27:24.71+00:00

Hello @GitaraniSharma-MSFT

Is there any further fix for this issue or still we need to disable the rule or add exclusions.

We are getting 200003 Multipart Request Body Strict Validation block while uploading file to server.

So, looking forward to your reply.

Thanks

Sathish

GitaraniSharma-MSFT 49,696 Reputation points Microsoft Employee

2023-06-26T13:15:05.71+00:00

Hello @Sathish Kumar Arumugam,

There is no further fix for this issue.

This error is caused by mod_security blocking a potentially malicious upload. While it may be completely harmless, mod_security has no way of knowing if it is harmless or not.

The solution is to fix the Content-Type value in the request header to one of the types such as image/jpeg instead of something like application/json.

There could also be cases where the WAF is not able to parse the request. This mostly happens when the content length is 0 or if there is a parsing error in the JSON (due to an invalid character). In those cases, validate the JSON file against an online JSON validator such as JSONLint.

Or the last resort is to disable the rule.

Regards,

Gita
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Access denied with code 403 (phase 2). Match of \"eq 0\" against \"MULTIPART_UNMATCHED_BOUNDARY\" required. WAF 200004

0 additional answers

Your answer