What is the best practice to add exclusion in WAF

Hello Johnson

To address Azure WAF blocking legitimate traffic from Telerik/ASP.NET components due to special characters triggering REQUEST-942-APPLICATION-ATTACK-SQLI rules, follow these best practices based on Microsoft’s recommendations:

1.Run WAF in Detection Mode

Set WAF to Detection mode to log requests without blocking. Use Azure Monitor or Log Analytics to identify false positives such as:

• RadStyleSheetManager1_TSSM
• SignInBtn_ClientState
• UserNameTbx_ClientState

Reference: https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/create-waf-policy-ag#configure-waf-rules-optional

2.Create Targeted Exclusions: Exclude specific parameters like RadStyleSheetManager1_TSSM, RadScriptManager1_TSM, and *ClientState from REQUEST-942-APPLICATION-ATTACK-SQLI rules.

Exclude specific benign parameters from inspection to prevent false positives.

exclusion = New-AzApplicationGatewayFirewallPolicyExclusion `
    -MatchVariable "RequestArgNames" `
    -SelectorMatchOperator "Equals" `
    -Selector "RadStyleSheetManager1_TSSM"
$wafPolicy = Get-AzApplicationGatewayFirewallPolicy -Name "<policy-name>" -ResourceGroupName "<rg-name>"
$wafPolicy.ManagedRules[0].Exclusions.Add($exclusion)
$wafPolicy | Set-AzApplicationGatewayFirewallPolicy

Refer: https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-waf-configuration?tabs=portal

3.Create custom rules to allow requests with common patterns like Rad* or *ClientState. Refer: Custom WAF rule

4.Define exclusions and custom rules in PowerShell or Terraform and store in version control to handle ruleset upgrades.

5.Test changes in a staging environment. Monitor logs in Log Analytics post-deployment to catch new false positives.

Consider Disabling SQL Rules (If Safe): If your app doesn’t use a SQL database, disable REQUEST-942-APPLICATION-ATTACK-SQLI after testing.

Recommendation: Start with Detection mode, add exclusions for Rad* and *ClientState, and use custom rules for broader patterns. Test thoroughly before switching to Prevention mode.

Additionally, we have provided information on WAF.

Yes! manually excluding each parameter individually is not scalable. Fortunately, there are more efficient approaches you can take.

Wildcard-Like Matching: Most WAF platforms support wildcard-style matching through operators such as:

StartsWith

EndsWith

• Contains

Regex (if supported)

For example:

• To exclude all parameters starting with Rad, use: StartsWith: Rad
• To exclude ASP.NET hidden fields like __VIEWSTATE, use: StartsWith: __

This allows you to exclude entire categories of parameters without listing them individually.

For information please fere this document https://learn.microsoft.com/en-us/defender-endpoint/configure-extension-file-exclusions-microsoft-defender-antivirus#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists

Sharing some of the Microsoft best practices on WAF tune: https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/best-practices

Do let me know if you have further questions, we will be happy to help:)

I hope this helps! If these answers your query, do click the "Upvote" and click "Accept the answer" of which might be beneficial to other community members reading this thread.

If an answer has been helpful, please consider accepting the answer to help increase visibility of this question for other members of the Microsoft Q&A community. If not, please let us know what is still needed in the comments so the question can be answered. Thank you for helping to improve Microsoft Q&A!