403 Forbidden error in HTTP request in Application Gateway

Satyam Chauhan 537

Hi, I have an application gateway with WAF V2 enabled in prevention mode. The normal requests being processed but I have a case where large data around 120 KB is being passed in request, in this case I get net : :ERR_FAILED 403 (Forbidden). How can I resolve this issue, is there any WAF policy rule I need to change/exclude ? Thanks, Satyam

Priya Kumar 1,096 Reputation points Microsoft Employee

2024-02-28T06:19:56.3333333+00:00
@Satyam Chauhan ,

Thanks for reaching to Azure Q and A platform.

The following two size limits configurations are available:

The maximum request body size field is specified in kilobytes and controls overall request size limit excluding any file uploads. This field has a minimum value of 8 KB and a maximum value of 128 KB. The default value for request body size is 128 KB.

The file upload limit field is specified in MB and it governs the maximum allowed file upload size. This field can have a minimum value of 1 MB and the following maximums:

100 MB for v1 Medium WAF gateways 500 MB for v1 Large WAF gateways 750 MB for v2 WAF gateways The default value for file upload limit is 100 MB.

For CRS 3.2 (on the WAF_v2 SKU) and newer, these limits are as follows when using a WAF policy for Application Gateway:

2 MB request body size limit 4 GB file upload limit Only requests with Content-Type of multipart/form-data are considered for file uploads. For content to be considered as a file upload, it has to be a part of a multipart form with a filename header. For all other content types, the request body size limit applies.

Please do pull the WAF diagnostics logs, so you could know why you are having 403 from WAF. https://learn.microsoft.com/en-us/azure/application-gateway/log-analytics#explore-data-with-examples

Request body inspection

WAF offers a configuration setting to enable or disable the request body inspection. By default, the request body inspection is enabled. If the request body inspection is disabled, WAF doesn't evaluate the contents of an HTTP message's body. In such cases, WAF continues to enforce WAF rules on headers, cookies, and URI. If the request body inspection is turned off, then maximum request body size field isn't applicable and can't be set. Turning off the request body inspection allows for messages larger than 128 KB to be sent to WAF, but the message body isn't inspected for vulnerabilities. When your WAF receives a request that's over the size limit, the behavior depends on the mode of your WAF and the version of the managed ruleset you use.

When your WAF policy is in prevention mode, WAF logs and blocks requests that are over the size limit.

When your WAF policy is in detection mode, WAF inspects the body up to the limit specified and ignores the rest. If the Content-Length header is present and is greater than the file upload limit, WAF ignores the entire body and logs the request.

--Please don't forget to "[Accept the answer]" and “[Upvote]” if the reply is helpful--

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Regards, Priya Kumar
GitaraniSharma-MSFT 48,016 Reputation points Microsoft Employee

2024-03-06T13:32:18.61+00:00

@Satyam Chauhan , could you please provide an update on this post? Kindly let us know if the above helps or you need further assistance on this issue.
GitaraniSharma-MSFT 48,016 Reputation points Microsoft Employee

2024-03-15T12:48:18.3333333+00:00

@Satyam Chauhan , do you have any new updates on this issue?

Share via

403 Forbidden error in HTTP request in Application Gateway