Azure应用网关WAF拦截常规ASP.Net Core请求问题求助

Hey there, I’ve run into this exact issue countless times—Azure’s default OWASP 3.0 WAF rules are robust, but they often flag legitimate requests as malicious (false positives), which is exactly what’s happening with your ASP.Net Core app. Let’s walk through how to fix this step by step:

1. First, pinpoint the exact rule IDs causing blocks #

The pattern match you mentioned ((?i:(?:\\\\A|[^\\\\d])0x[a-f\\\...) maps directly to OWASP rule 942100 (SQL Hex Encoding Identified). You’ll want to list all rules that are triggering blocks to avoid missing any. Use Log Analytics to pull this data quickly:

AzureDiagnostics
| where ResourceType == "APPLICATIONGATEWAYS" and OperationName == "ApplicationGatewayFirewall"
| where action_s == "Blocked"
| project TimeGenerated, client_ip_s, request_uri_s, ruleId_s, message_s

This query will show you every blocked request, including the rule ID that triggered it and the request details.

2. Fix false positives without disabling entire security layers #

Never disable a full rule group unless absolutely necessary—instead, target the specific problematic rules:

Option A: Add rule exclusions for legitimate content #

If your app intentionally uses hex-encoded values (like in parameters or request body fields), add an exclusion for the rule to ignore those specific parts of the request:

• Go to your Application Gateway in the Azure Portal, navigate to Web Application Firewall > Rule Sets
• Select your OWASP 3.0 rule set, then click Manage Exclusions
• Click Add exclusion, pick the rule ID (e.g., 942100), then specify what to exclude:
  • For query parameters: Choose "Query string" and enter the parameter name
  • For POST body fields: Choose "Request body" and enter the field name
  • For entire request URIs: Choose "Request URI" and enter the path pattern

Option B: Change the rule action from Block to Log #

If a rule doesn’t apply to your app at all (e.g., you don’t use SQL in a way that triggers this check), tweak its action to only log instead of blocking:

• In the WAF Rule Sets page, find the rule group (e.g., SQLi for rule 942100)
• Click the edit icon next to the rule, switch the action from "Block" to "Log", then save

3. Test thoroughly after changes #

After adjusting the rules, test all core functionality of your app—use tools like Postman or curl to send requests that were previously blocked, and check the WAF logs to confirm they’re now allowed. Make sure you don’t accidentally open up security gaps while fixing the false positives.

4. Consider upgrading to OWASP 3.2 (optional) #

OWASP 3.2 has significant improvements over 3.0, including fewer false positives. If your setup allows it, switching to the 3.2 rule set might resolve this issue (and others) without needing custom exclusions.

Remember: The goal is to keep your app secure while letting legitimate traffic through—targeted adjustments are always better than broad disables.

内容的提问来源于stack exchange，提问作者Corneliu