Why does Azure application gateway rate limit WAF return a 403 and not a 429?

Question

When Azure Application gateway rate limiter functions as expected, we were expecting a 429, but instead, a 403 is returned. Why is this?

Answer 1

@Levi

Thank you for reaching out.

I understand you wish to know why Azure application gateway rate limit returns a 403 response instead of 429 response.

Currently 403 response is by design and the product team is aware of this scenario. The team will be releasing a feature for this scenario where customers will be able to customize the http response code for rate-limit on their own. I currently do not have a fixed ETA to share about when this feature will be released but request you to keep an eye out on Azure updates for Application Gateway.

Hope this helps! Please let me know if you have any questions. Thank you!

Answer 2

Could you please provide an update on the status of this feature?
Has there been any progress or an estimated release date for this functionality?

We're about to take Application Gateway into use in our production using rate limiting. Customers that previously had the response HTTP 429 (Too Many Requests) will get HTTP 403 (Forbidden) and it will be hard to distinguish between the two cases.