how to make an azurefd endpoint to be like brand.azurefd.net than brand7990090.azurefd.net ?

Question

how to make an azurefd endpoint to be like brand.azurefd.net than brand7990090.azurefd.net ?

pedistellar 0

It's autogenerated and it becomes brand7990090.azurefd.net , but then I see people are making something like: brand.azurefd.net

how to do that?

KapilAnanth-MSFT 49,616 Reputation points Microsoft Employee Moderator

2023-08-02T13:03:53.99+00:00

@pedistellar

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Thanks,

Kapil
KapilAnanth-MSFT 49,616 Reputation points Microsoft Employee Moderator

2023-08-03T13:54:33+00:00

@pedistellar

Reaching out to check if there are any questions on this.

Please let us know if we can be of any further assistance here.

Thanks,

Kapil

Please Accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer.
KapilAnanth-MSFT 49,616 Reputation points Microsoft Employee Moderator

2023-08-04T11:36:06.2066667+00:00

@pedistellar

Could you please provide an update on this post?

Kindly let us know if this helps or you need further assistance on this issue.

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

1 answer

Your answer

KapilAnanth-MSFT 49,616 Reputation points Microsoft Employee Moderator

2023-08-02T13:03:53.99+00:00

@pedistellar

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Thanks,

Kapil
KapilAnanth-MSFT 49,616 Reputation points Microsoft Employee Moderator

2023-08-03T13:54:33+00:00

@pedistellar

Reaching out to check if there are any questions on this.

Please let us know if we can be of any further assistance here.

Thanks,

Kapil

Please Accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer.
KapilAnanth-MSFT 49,616 Reputation points Microsoft Employee Moderator

2023-08-04T11:36:06.2066667+00:00

@pedistellar

Could you please provide an update on this post?

Kindly let us know if this helps or you need further assistance on this issue.

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Answer 1

@pedistellar

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to create an endpoint with a streamlined name in Azure Front Door.

I am afraid this won't be possible.

Azure generates a unique subdomain in this format : <endpointname>-hash.z01.azurefd.net

The intention here is to prevent subdomain takeover

What is a Subdomain TakeOver:

Let's say we have a legitimate user USERA (from CompanyA) and Malicious actor USERX
USERA creates a domain companyA.azurefd.net
- All the users of companyA access through companyA.azurefd.net
For some reason, companyA.azurefd.net endPoint gets deleted
Now, Malicious actor USERX creates a new endPoint companyA.azurefd.net (in a different subscription with different backend Origins)
In this case, users are forwarded to Malicious origins behind the newly created companyA.azurefd.net endPoint.
- Thus, this leads to users to an unknown site.
More information:
- https://learn.microsoft.com/en-us/azure/security/fundamentals/subdomain-takeover
  - Same explanation goes for a CNAME such as "www.contoso.com" that is pointing to companyA.azurefd.net

What can be done here is:

You must consider Adding a custom domain to Azure Front Door
Let's say you create an endPoint companyA-hashA.azurefd.net
And your CNAME(www.companyA.com) points towards "companyA-hashA.azurefd.net"
Now, even if Malicious actor USERX tried to create an endPoint "companyA", they will end up with "companyA-hashX.azurefd.net"
So, your CNAME record will always be pointing to companyA-hashA.azurefd.net (even if the endPoint is deleted) and never to companyA-hashX.azurefd.net

Hope I was able to provide clarity on why we add this hash to the endPoint names.

Kindly let us know if this helps or you need further assistance on this issue.

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

KapilAnanth-MSFT 49,616 Reputation points Microsoft Employee Moderator

2023-08-01T10:39:39.7833333+00:00

@pedistellar

A visual representation of subdomain takeover:

As you can see, if the endpoint name were app-contogreat-dev-001-hashA.azurefd.net,

the newly created endpoint would be app-contogreat-dev-001-hashX.azurefd.net and subdomain takeover would have never happened

Share via

how to make an azurefd endpoint to be like brand.azurefd.net than brand7990090.azurefd.net ?

1 answer

Your answer