Cloud Web Application Firewall blocks API POST requests containing SQL keyword strings inside legitimate JSON body attributes. How do we tune WAF rule exclusions?

Question

Cloud Web Application Firewall blocks API POST requests containing SQL keyword strings inside legitimate JSON body attributes. How do we tune WAF rule exclusions?

Answer 1

Hello Scott Truffle,

When a Cloud Web Application Firewall blocks legitimate API POST requests because SQL keywords appear inside JSON attributes, the correct approach is to configure rule exclusions at the WAF policy level rather than disabling SQL injection protection globally. In Azure WAF, for example, you can define custom exclusions under WAF Policy → Managed Rules → Exclusions, targeting specific request attributes such as RequestBodyNames or RequestBodyJsonArgNames. By specifying the exact JSON field name where SQL‑like strings are expected, the WAF will bypass inspection for that field while continuing to enforce SQL injection rules elsewhere. This ensures that legitimate payloads containing reserved words are accepted without weakening protection for other inputs. After applying the exclusion, monitor logs under Application Gateway diagnostics or Azure Front Door WAF logs to confirm that only the intended fields are excluded and no broader bypass is introduced. This fine‑grained tuning is the recommended way to balance security with application functionality.

If my answer is useful for you, please hit Accept the answer to support me.

Thank you,

HL.