Web Application Firewall (WAF) on SWA

[ozkary]

Hi,

We would like to use a WAF to manage exploits and vulnerabilities for the Static Web App. We need to do common things like IP restrictions, Bot detection and other common rules.

Reference:
https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview

What are the recommendations for this use case?

I thank you for your time.

[miwebst]

Hey @ozkary,

As you mentioned above, you can use an Azure App Gateway and add the default hostname (or custom domain but note you will need to add it to the app gateway) as a backend in the backend pools section.

Similarly Azure Front Door also has a WAF option at the edge: https://docs.microsoft.com/en-us/azure/web-application-firewall/afds/afds-overview. You can also specify the default hostname as the backend pool in this scenario.

The remaining question you might have is "how do I lock down traffic from my WAF to my SWA?" For this we have an improvement coming in the next few weeks :)

[anthonychu]

You can now lock down traffic from Application Gateway to your static web app using IP restrictions. You'll also want to configure the allowed forwarded hosts with the domains configured on Application Gateway.

[ozkary]

This is really making a difference now. Great gateway support like front-door

Restrict traffic to only use Front Door by adding the following section to the configuration file:

Open staticwebapp.config.json to make the changes:

"networking": {
"allowedIpRanges": ["AzureFrontDoor.Backend"]
}

To define which Azure Front Door instances and domains can access your site, add the forwarding Gateway section.

"forwardingGateway": {
"requiredHeaders": {
"X-Azure-FDID" : ""
},
"allowedForwardedHosts": [
"my-sitename.com",
"ozkary.com",
]
}

First, configure your app to only allow traffic from your Front Door instance. In every backend request, Front Door automatically adds an X-Azure-FDID header that contains your Front Door instance ID. By configuring your static web app to require this header, it will restrict traffic exclusively to your Front Door instance. In the forwarding Gateway section in your configuration file, add the required Headers section and define the X-Azure-FDID header. Replace with the Front Door ID you set aside earlier.

Reference https://docs.microsoft.com/en-us/azure/static-web-apps/front-door-manual

[patelriki13]

Thanks @ozkary
But Can you please suggest how to dynamic update X-Azure-FDID in staticwebapp.config.json file using azure devops pipline deployment.