Why does Azure application gateway rate limit WAF return a 403 and not a 429?

Levi 20 Reputation points
2024-03-04T13:57:27.39+00:00

When Azure Application gateway rate limiter functions as expected, we were expecting a 429, but instead, a 403 is returned. Why is this?

Azure Application Gateway
Azure Application Gateway
An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.
962 questions
Azure Web Application Firewall
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. ChaitanyaNaykodi-MSFT 23,031 Reputation points Microsoft Employee
    2024-03-04T23:51:45.4833333+00:00

    @Levi

    Thank you for reaching out.

    I understand you wish to know why Azure application gateway rate limit returns a 403 response instead of 429 response.

    Currently 403 response is by design and the product team is aware of this scenario. The team will be releasing a feature for this scenario where customers will be able to customize the http response code for rate-limit on their own. I currently do not have a fixed ETA to share about when this feature will be released but request you to keep an eye out on Azure updates for Application Gateway.

    Hope this helps! Please let me know if you have any questions. Thank you!

    0 comments