Azure AppGateway WAF is blocking requests that have blob SAS token

Question

The application gateway has WAF in prevention mode. When there are file download requests from blob storage, these are getting blocked by WAF, applying rules 942450,942340.

The request URL has the Blob SAS token in query string, which is treated as harmful[ WAF log shows SQL Hex Encoding Identified]. Disabling the rule is feasible, but that is vulnerable.

What other way to handle this?

Answer 1

Hi,

The other option is to use exclusions. Identify common attributes for those requests and create exclusions based on them.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Hello Anand Sowmithiran

I wanted to follow up and check if you had the opportunity to review the information provided by Stanislav Zhelyazkov in our previous post.

Additionally, I’d like to suggest the following:

Use a Custom WAF Policy with Conditional Exclusions

Instead of disabling the rule globally, you can exclude specific request paths or query parameters from inspection:

• Create a custom WAF policy.
• Add exclusions for:
  • Request URI (e.g., /download/*)
    • Query string parameters (e.g., sig, se, sp, etc.)

This way, the WAF still protects the rest of your app, but ignores SAS tokens where appropriate.

🔧 In Azure Portal: Go to your WAF Policy → Exclusions → Add exclusion for RequestArgNames or RequestUri.

Since the blocked requests include SAS tokens in the query string, you can:

• Create an exclusion for rules 942450 and 942340
• Target the query string where the SAS token appears (e.g., contains sig=)

This approach will ensure the WAF skips evaluating those specific rules only when the request meets the exclusion criteria, while maintaining protection for all other traffic.

If you are testing, you can temporarily switch WAF to Detection mode to monitor without blocking. But this is not recommended for production.

Kindly let us know if the above helps or you need further assistance on this issue.

---

I hope this helps! If these answers your query, do click the "Upvote" and click "Accept the answer" of which might be beneficial to other community members reading this thread.

If the above is unclear or you are unsure about something, please add a comment below.

please don’t forget to close the thread by clicking Accept the answer wherever the information provided helps you, as this can be beneficial to other community members.